Bug 12696 - empty /etc/pkcs11/pkcs11.conf breaks some apps with drivers nvidia
Summary: empty /etc/pkcs11/pkcs11.conf breaks some apps with drivers nvidia
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: RPM Packages (show other bugs)
Version: 4
Hardware: All Linux
Priority: High major
Target Milestone: ---
Assignee: QA Team
QA Contact:
URL: https://bugs.freedesktop.org/show_bug...
Whiteboard: has_procedure MGA4-32-OK MGA4-64-OK a...
Keywords: validated_update
Depends on:
Blocks: 11193 11666 11946 12021
  Show dependency treegraph
 
Reported: 2014-02-09 23:26 CET by Luc Menut
Modified: 2014-02-15 10:41 CET (History)
13 users (show)

See Also:
Source RPM: p11-kit-0.20.1-3.mga4.src.rpm
CVE:
Status comment:


Attachments
gdb trace (broken kwrite with nvidia current 325.15) (4.67 KB, text/plain)
2014-02-09 23:39 CET, Luc Menut
Details
last lines gdb bt full (broken kwrite with nvidia current 325.15) (2.72 KB, text/plain)
2014-02-09 23:40 CET, Luc Menut
Details

Description Luc Menut 2014-02-09 23:26:10 CET
Description of problem:
Some applications (kdenlive, kwrite, digikam, xbmc, claws-mail, ...) don't run with nvidia drivers in Mga4 and cauldron. cf. bug 11193, bug 11666, bug 11946, bug 12021 .
It appears that it's due to an empty config file - /etc/pkcs11/pkcs11.conf . Many users have confirmed that removing this file or simply adding a space in this file fix these bugs.
For now, I don't know exactly which of p11-kit or nvidia drivers don't handle properly this empty /etc/pkcs11/pkcs11.conf. Any help is welcome, I'm really bad in C :-(
Ideally, this file should be handle properly even when it is empty.

Reading their spec files, Fedora and OpenSuse don't seem to provide this file.
We have always installed this empty file (with %create_ghostfile in %post then %posttrans).
http://svnweb.mageia.org/packages?view=revision&revision=129272
@wally, do you remember why you added this empty config file?

If it's not absolutly needed, perhaps we can remove it? or install it with a comment? or ...


Version-Release number of selected component (if applicable):
p11-kit-0.20.1-3.mga4


Reproducible: 

Steps to Reproduce:
Luc Menut 2014-02-09 23:34:19 CET

Priority: Normal => High
CC: (none) => jani.valimaa, mageia, mageia, mageia, pterjan, tmb
Blocks: (none) => 11193, 11666, 11946, 12021

Comment 1 Luc Menut 2014-02-09 23:39:02 CET
Created attachment 4968 [details]
gdb trace (broken kwrite with nvidia current 325.15)
Comment 2 Luc Menut 2014-02-09 23:40:26 CET
Created attachment 4969 [details]
last lines gdb bt full (broken kwrite with nvidia current 325.15)
Comment 3 Pascal Terjan 2014-02-10 00:22:06 CET
The p11 code is buggy.

mmap man page:
On error, the value MAP_FAILED (that is, (void *) -1) is returned, and errno is set appropriately.

The code does:
        map->data = mmap (NULL, map->size, PROT_READ, MAP_PRIVATE, map->fd, 0);
        if (map->data == NULL) {
                close (map->fd);
                free (map);
                return NULL;
        }

        *data = map->data;
        *size = map->size;
        return map;

But map->data will never be NULL, it will be either the address or -1.

When the file is empty, mmap fails but it doesn't notice and will try to munmap(-1, 0) later.

Not sure what happen next, maybe some signal is triggered and then we hit the famous "nvidia driver breaks signals".
Comment 4 Pascal Terjan 2014-02-10 00:43:54 CET
I submitted p11-kit-0.20.1-4.mga5 to cauldron with a patch
Comment 5 Sander Lepik 2014-02-10 09:28:32 CET
Patch applied for mga4 too, submitted into updates_testing.

CC: (none) => mageia

Comment 6 Samuel Verschelde 2014-02-10 10:00:41 CET
Package in updates_testing for Mageia 4: p11-kit-0.20.1-3.1.mga4

CC: (none) => stormi

Comment 7 Samuel Verschelde 2014-02-10 10:07:24 CET
Rpms in updates_testing for Mageia 4, from the SRPM mentioned at comment #6:

p11-kit-0.20.1-3.1.mga4.i586.rpm
lib{,64}p11-kit0-0.20.1-3.1.mga4.i586.rpm
lib{,64}p11-kit-devel-0.20.1-3.1.mga4.i586.rpm
p11-kit-trust-0.20.1-3.1.mga4.i586.rpm
Comment 8 Pascal Terjan 2014-02-10 10:15:44 CET
Wow I was expecting someone to test before preparing an update :)
Comment 9 Samuel Verschelde 2014-02-10 10:19:28 CET
Well, it's not a bad idea to test in Mageia 4 where the userbase is bigger :)

It was not handled to QA yet.
Comment 10 Sander Lepik 2014-02-10 10:49:16 CET
(In reply to Pascal Terjan from comment #8)
> Wow I was expecting someone to test before preparing an update :)

Well, it's updates_testing, how do you test if you don't have anything to test with? ;) Now they have :P
Comment 11 Rémi Verschelde 2014-02-10 11:12:48 CET
(In reply to Pascal Terjan from comment #4)
> I submitted p11-kit-0.20.1-4.mga5 to cauldron with a patch

I confirm that it fixes the issue in Cauldron (at least for digikam, I had no issue prior to the update with kate or kwrite).

CC: (none) => remi

Comment 12 Rémi Verschelde 2014-02-10 13:14:51 CET
(In reply to Pascal Terjan from comment #4)
> I submitted p11-kit-0.20.1-4.mga5 to cauldron with a patch

The patch fixes the issue, but now a warning appears (at least when using urpmf and urpmq), and it can be pretty annoying:

[akien@cauldron ~]$ urpmq -i null
p11-kit: couldn't open config file: /etc/pkcs11/pkcs11.conf: Invalid argument

[akien@cauldron ~]$ urpmf /dev/null
p11-kit: couldn't open config file: /etc/pkcs11/pkcs11.conf: Invalid argument
p11-kit: couldn't open config file: /etc/pkcs11/pkcs11.conf: Invalid argument
iraf:/usr/lib6/iraf/dev/null
bind:/var/lib/named/dev/null
p11-kit: couldn't open config file: /etc/pkcs11/pkcs11.conf: Invalid argument
p11-kit: couldn't open config file: /etc/pkcs11/pkcs11.conf: Invalid argument
p11-kit: couldn't open config file: /etc/pkcs11/pkcs11.conf: Invalid argument
p11-kit: couldn't open config file: /etc/pkcs11/pkcs11.conf: Invalid argument
p11-kit: couldn't open config file: /etc/pkcs11/pkcs11.conf: Invalid argument
Comment 13 Pascal Terjan 2014-02-10 14:04:02 CET
Yes the empty config file is invalid, we should not create it.
Comment 14 Sander Lepik 2014-02-10 16:43:14 CET
p11-kit contains pkcs11.conf.example (http://svnweb.mageia.org/packages/cauldron/p11-kit/current/SPECS/p11-kit.spec?revision=587833&view=markup#l95)

It should be safe to install this one as pkcs11.conf - but this won't fix the problem for current users as if I'm correct urpmi will install new conf as conf.rpmnew. Tho' patch from Pascal will probably fix the major problem, the annoying message will remain until users replace the faulty conf file.
Comment 15 Pascal Terjan 2014-02-10 16:53:17 CET
I can think of 2 solutions:

1/
- no longer marking it as ghost
- removing the posttrans
- having a pretrans removing the file if empty
- shipping the example as the config file

2/
- no longer marking it as ghost
- removing the posttrans
- having a pretrans removing the file if empty
- not ship a config file


In the first case, people who modify it and remove the package will have it renamed as rpmsave. In the second case, people who create the config file will have it staying around.
Comment 16 Sander Lepik 2014-02-10 17:00:22 CET
I'd probably go with the first option as there seems to be no way to remove it :) You may try but AFAIK urpme won't let you :)
Comment 17 Jani Välimaa 2014-02-10 17:19:40 CET
Removal in pretrans is unneeded, rpm knows if the file is unmodified and replaces it silently with the new one. Same applies if we decide to not ship .conf file at all, rpm silently removes the file if it's unmodified.

I think in most cases the file is untouched. And if it's not, then one did most probably know what he/she was doing.
Comment 18 Pascal Terjan 2014-02-10 17:25:41 CET
Except that it is currently a ghost file, meaning that rpm does not track its md5 and has no idea if it is modified.
Comment 19 Jani Välimaa 2014-02-10 17:35:08 CET
Ah, yes. Did some local testing and if we don't ship the config file at all, pretrans is needed. If we use the example as new config, it works without removal in pretrans.
Comment 20 Jani Välimaa 2014-02-10 17:37:41 CET
However, we can play on safe side and use removal in pretrans just to be sure.
Comment 21 Jani Välimaa 2014-02-10 17:41:17 CET
One mere spam: I'd vote for solution 1.
Comment 22 Luc Menut 2014-02-10 23:42:51 CET
@Pascal, many thanks for the help and the patch.
to remove the empty config file in pretrans,
if [ -f /etc/pkcs11/pkcs11.conf -a ! -s /etc/pkcs11/pkcs11.conf ]; then
    rm -f /etc/pkcs11/pkcs11.conf
fi
should to the trick ?

Between the 2 solutions, I don't have a strong opinion; 2/ strictly follows the upstream install, 1/ is fine too.
Comment 23 Pascal Terjan 2014-02-11 21:10:13 CET
Yes that looks correct

Patch sent upstream https://bugs.freedesktop.org/show_bug.cgi?id=74773
Comment 24 Luc Menut 2014-02-12 01:20:38 CET
I submitted p11-kit-0.20.1-5.mga5 in cauldron and p11-kit-0.20.1-3.2.mga4 in 4/updates_testing, using solution 1/ from comment 15. Please review.
http://svnweb.mageia.org/packages?view=revision&revision=589572
http://svnweb.mageia.org/packages?view=revision&revision=589576

We can start to test them.
When it seems OK, I'll write advisory, RPMs list, ... for QA.
Comment 25 Pascal Terjan 2014-02-12 14:15:53 CET
Looks good, thanks!
Comment 26 Rémi Verschelde 2014-02-12 15:26:27 CET
I confirm that the package in Cauldron fixes the issue, and there is no annoying warning anymore. Will soon test mga4 i586.
Comment 27 Luc Menut 2014-02-12 23:15:47 CET
Yesterday, I forgot to remove "Requires(posttrans): rpm-helper" after the posttrans removal. Fixed in p11-kit-0.20.1-6.mga5 in cauldron and p11-kit-0.20.1-3.3.mga4.
Comment 28 Luc Menut 2014-02-13 00:18:19 CET
Updated packages in mga 4 core/updates_testing:

SRPM
p11-kit-0.20.1-3.3.mga4.src.rpm

i586
p11-kit-0.20.1-3.3.mga4.i586.rpm
p11-kit-trust-0.20.1-3.3.mga4.i586.rpm
libp11-kit0-0.20.1-3.3.mga4.i586.rpm
libp11-kit-devel-0.20.1-3.3.mga4.i586.rpm

x86_64
p11-kit-0.20.1-3.3.mga4.x86_64.rpm
p11-kit-trust-0.20.1-3.3.mga4.x86_64.rpm
lib64p11-kit0-0.20.1-3.3.mga4.x86_64.rpm
lib64p11-kit-devel-0.20.1-3.3.mga4.x86_64.rpm

========================================

Suggested advisory:

This update fixes a bug in p11-kit that prevents many applications (kwrite, kdenlive, digikam, xbmc, claws-mail, ...) to start and run properly, mainly when using the Nvidia drivers (mga#12696, mga#11193, mga#11666, mga#11946, mga#12021).

References:
- https://bugs.mageia.org/show_bug.cgi?id=12696
- https://bugs.freedesktop.org/show_bug.cgi?id=74773

========================================

Testing procedures:

The updated packages provides 2 fixes:
- it replaces our previous empty and so invalid config file /etc/pkcs11/pkcs11.conf by a valid one, 
- even in case of empty /etc/pkcs11/pkcs11.conf, the library (lib64p11-kit0) now handles properly this case of empty file (patch from Pascal Terjan).

Some tests could be done on every systems:
- an empty /etc/pkcs11/pkcs11.conf (installed by default by p11-kit-0.20.1-3.mga4.x86_64.rpm and not modified) is replaced by a valid config file non empty,
- if /etc/pkcs11/pkcs11.conf was modified by users (= not empty anymore), it stays unchanged.

Some tests must be done on systems with nvidia video card using nvidia drivers:
- previously kwrite, kdenlive, digikam, xbmc, claws-mail, ... doesn't start,
- now they start and run.

URL: (none) => https://bugs.freedesktop.org/show_bug.cgi?id=74773
Assignee: bugsquad => qa-bugs

Comment 29 claire robinson 2014-02-13 09:01:59 CET
Thanks Luc

Whiteboard: (none) => has_procedure

Comment 30 Pascal Terjan 2014-02-13 10:52:22 CET
Upstream adapted my patch to also accept empty files:

https://bugs.freedesktop.org/attachment.cgi?id=93989
Comment 31 Rémi Verschelde 2014-02-13 11:29:22 CET
Testing complete on Mageia 4 i586. I could test against some applications that would not run prior to the update and now work great with nvidia GPU. I also checked that the handling of /etc/pkcs11/pkcs11.conf is done as described in comment 28.

Whiteboard: has_procedure => has_procedure MGA4-32-OK

William Kenney 2014-02-13 13:42:00 CET

CC: (none) => wilcal.int

Comment 32 Lewis Smith 2014-02-13 19:48:01 CET
Mag 4 Testing on real 64-bit hardware, but NO nvidia graphics. OK with this constraint.
I never had problems with any of the applications cited.

From comment 28:
> Some tests could be done on every systems:
> - an empty /etc/pkcs11/pkcs11.conf (installed by default by p11-kit-0.20.1-3.mga4.x86_64.rpm and not modified) is replaced by a valid config file non empty

Confirmed.
Before: p11-kit-0.20.1-3.mga4
        lib64p11-kit0-0.20.1-3.mga4
ls -l /etc/pkcs11/
drwxr-xr-x 2 root root 4096 Hyd  29 00:47 modules/
-rw-r--r-- 1 root root    0 Chw   7 11:02 pkcs11.conf    <<<
-rw-r--r-- 1 root root  390 Hyd  29 00:47 pkcs11.conf.example

After: p11-kit-0.20.1-3.3.mga4
       lib64p11-kit0-0.20.1-3.3.mga4
ls -l /etc/pkcs11/
drwxr-xr-x 2 root root 4096 Chw  12 22:53 modules/
-rw-r--r-- 1 root root  390 Chw  12 22:53 pkcs11.conf    <<<

Not enough for mga4-64-ok, but should help.

CC: (none) => lewyssmith

Comment 33 Bill Wilkinson 2014-02-13 21:28:48 CET
Attempting to update this x86_64 gave the following warning:

The following packages have to be removed for others to be upgraded:

libcups2-1.7.0-7.mga4.i586
 (due to missing libgnutls.so.28)
libgnutls28-3.2.7-1.mga4.i586
 (due to missing libp11-kit.so.0)
libgtk+-x11-2.0_0-2.24.22-3.mga4.i586
 (due to unsatisfied libgtk+2.0_0 == 2.24.22)
libgtk+2.0_0-2.24.22-3.mga4.i586
 (due to missing libcups.so.2,
  due to missing libgtk-x11-2.0.so.0,
  due to missing libgdk-x11-2.0.so.0)
liboxygen-gtk-1.4.2-0.rc1.1.mga4.i586
 (due to missing libgtk-x11-2.0.so.0,
  due to missing libgdk-x11-2.0.so.0)
libp11-kit0-0.20.1-3.mga4.i586
 (due to unsatisfied p11-kit == 0.20.1-3.mga4)

CC: (none) => wrw105

Comment 34 Thomas Backlund 2014-02-13 21:30:40 CET
(In reply to Bill Wilkinson from comment #33)
> Attempting to update this x86_64 gave the following warning:
> 
> The following packages have to be removed for others to be upgraded:
> 
> libcups2-1.7.0-7.mga4.i586
>  (due to missing libgnutls.so.28)
> libgnutls28-3.2.7-1.mga4.i586
>  (due to missing libp11-kit.so.0)
> libgtk+-x11-2.0_0-2.24.22-3.mga4.i586
>  (due to unsatisfied libgtk+2.0_0 == 2.24.22)
> libgtk+2.0_0-2.24.22-3.mga4.i586
>  (due to missing libcups.so.2,
>   due to missing libgtk-x11-2.0.so.0,
>   due to missing libgdk-x11-2.0.so.0)
> liboxygen-gtk-1.4.2-0.rc1.1.mga4.i586
>  (due to missing libgtk-x11-2.0.so.0,
>   due to missing libgdk-x11-2.0.so.0)
> libp11-kit0-0.20.1-3.mga4.i586
>  (due to unsatisfied p11-kit == 0.20.1-3.mga4)


you need to select the x86_64 packages, not the i586 ones during testing on x86_64
Comment 35 Samuel Verschelde 2014-02-13 21:42:52 CET
So far so good in MGA4 64 but I don't want to say testing complete yet, because I don't know what that package does at all in my system, and almost every package depends on it directly or indirectly :)

Any clues about what I could check?

It does fix the nvidia issue, though.
Comment 36 Luc Menut 2014-02-13 21:49:08 CET
(In reply to Thomas Backlund from comment #34)
> (In reply to Bill Wilkinson from comment #33)
> > Attempting to update this x86_64 gave the following warning:
> > 
> > The following packages have to be removed for others to be upgraded:
> > 
> > libcups2-1.7.0-7.mga4.i586
> >  (due to missing libgnutls.so.28)
> > libgnutls28-3.2.7-1.mga4.i586
> >  (due to missing libp11-kit.so.0)
> > libgtk+-x11-2.0_0-2.24.22-3.mga4.i586
> >  (due to unsatisfied libgtk+2.0_0 == 2.24.22)
> > libgtk+2.0_0-2.24.22-3.mga4.i586
> >  (due to missing libcups.so.2,
> >   due to missing libgtk-x11-2.0.so.0,
> >   due to missing libgdk-x11-2.0.so.0)
> > liboxygen-gtk-1.4.2-0.rc1.1.mga4.i586
> >  (due to missing libgtk-x11-2.0.so.0,
> >   due to missing libgdk-x11-2.0.so.0)
> > libp11-kit0-0.20.1-3.mga4.i586
> >  (due to unsatisfied p11-kit == 0.20.1-3.mga4)
> 
> 
> you need to select the x86_64 packages, not the i586 ones during testing on
> x86_64

Hum, the 32 bit library libp11-kit0-0.20.1-3.mga4.i586 is installed on this x86_64 system.
In order to update, you should update at the same time p11-kit-0.20.1-3.3.mga4.x86_64, and 32 bit and 64 bit libraries libp11-kit0-0.20.1-3.3.mga4.i586 and lib64p11-kit0-0.20.1-3.3.mga4.x86_64.
Comment 37 Luc Menut 2014-02-13 22:02:47 CET
(In reply to Pascal Terjan from comment #30)
> Upstream adapted my patch to also accept empty files:
> 
> https://bugs.freedesktop.org/attachment.cgi?id=93989

I will use this upstream patch in cauldron.

For mga4, as QA team have already started the tests of the updated packages, I think it's better to stay with the current patch (from pterjan). WDYT? QA team?
Comment 38 Pascal Terjan 2014-02-13 22:24:38 CET
I believe it's fine, the only difference will be the message if people create an empty configuration file themselves which is very unlikely.
Comment 39 Luc Menut 2014-02-13 22:29:50 CET
(In reply to Samuel VERSCHELDE from comment #35)

> 
> Any clues about what I could check?

sorry, personally I can't help much regarding this question.
testing that 'p11-kit list-modules' still works ?
Comment 40 Bill Wilkinson 2014-02-13 22:40:51 CET
Tested on x86_64 with nvidia 304 video.

Prior to update, kwrite does not open.
After update, kwrite, kate, kdenlive, digikam all open, kdewallet ok.

If we need to push out quickly, feel free to OK, otherwise I'll give it some time for others to test.
Comment 41 Rémi Verschelde 2014-02-14 21:14:11 CET
I've tested it too on Mageia 4 x86_64 with nvidia-current through bumblebee.

--

Validating update. Advisory has been uploaded. Please push to 4 core/updates.

Keywords: (none) => validated_update
Whiteboard: has_procedure MGA4-32-OK => has_procedure MGA4-32-OK MGA4-64-OK advisory
CC: (none) => sysadmin-bugs

Comment 42 Thomas Backlund 2014-02-14 21:57:59 CET
Update pushed:
http://advisories.mageia.org/MGAA-2014-0047.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED

Comment 43 Doug Laidlaw 2014-02-15 04:39:27 CET
I can't use the nvidia driver itself, but deleting the empty pkcs11.conf fixed the bug while the nvidia driver was installed but not being used (on Mga4 i586.)

CC: (none) => laidlaws

Lewis Smith 2014-02-15 10:41:57 CET

CC: lewyssmith => (none)


Note You need to log in before you can comment on or make changes to this bug.