Bug 2239146
| Summary: | perl-Crypt-Argon2 crashes | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Charles R. Anderson <cra> |
| Component: | perl-Crypt-Argon2 | Assignee: | Charles R. Anderson <cra> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | rawhide | CC: | barsnick, chazmcgarvey, cra, echevemaster, extras-qa, lester.hightower, mkreder |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | perl-Crypt-Argon2-0.019-6.fc40 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | 2118421 | Environment: | |
| Last Closed: | 2023-09-17 15:59:07 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 2118421 | ||
|
Description
Charles R. Anderson
2023-09-15 13:42:14 UTC
Please download one or more of these builds and try them. If they work for you, please add karma so the fixed package can be released and the File::KDBX package can be built:
Fedora 37:
https://bodhi.fedoraproject.org/updates/FEDORA-2023-c1045623bf
https://koji.fedoraproject.org/koji/buildinfo?buildID=2289885
Fedora 38:
https://bodhi.fedoraproject.org/updates/FEDORA-2023-c694005278
https://koji.fedoraproject.org/koji/buildinfo?buildID=2289883
Fedora 39:
https://bodhi.fedoraproject.org/updates/FEDORA-2023-174b1a814e
https://koji.fedoraproject.org/koji/buildinfo?buildID=2289884
Thanks.
I downloaded and installed perl-Crypt-Argon2-0.019-5.fc38 from https://bodhi.fedoraproject.org/updates/FEDORA-2023-c694005278 into "Fedora Linux 38 (Server Edition)" and it supported a clean build of File::KDBX and kpcli-4.0 seemed to properly with it. However, when trying to perform a simple operation on a KDBX4 file with kpcli, it crashes with an "Illegal instruction (core dumped)" problem. And so, I suspect that perl-Crypt-Argon2-0.019-5.fc38 is an improvement, but that it did not fix the root problem on Fedora, whatever that is... Here is how to replicate the problem that I see (and this works perfectly on other OSes): [hightowe@localhost ~]$ kpcli-4.0.pl KeePass CLI (kpcli-4.0) v4.0 is ready for operation. Type 'help' for a description of available commands. Type 'help <command>' for details on individual commands. kpcli-4.0:/> newdb Choose your file format: 1. KDB - The original KeePass format (*.kdb). Supported using File::KeePass 2. KDBX3 - The first KeePass XML format (*.kdbx v3). Supported using File::KeePass 3. KDBX4 - The second KeePass XML format (*.kdbx v4). Supported using File::KDBX Choose: (1)/(2)/(3)/(c)ancel? 3 Done. Use the saveas command to write to disk. kpcli-4.0:/Root> stats File: N/A Type: KDBX v4.1 Key file: N/A Module: File::KDBX Cipher: AES256 Rounds: 10 Iterations: 10 KDF Cipher: Argon2d Compression: gzip Number of groups: 1 Number of entries: 0 kpcli-4.0:/Root> saveas foo.kdbx Provide the master password: ************************* Retype to verify: ************************* Illegal instruction (core dumped) [hightowe@localhost ~]$ ################### When it works properly, the "saveas foo.kdbx" command will yield this result: kpcli-4.0:/Root> saveas foo.kdbx Provide the master password: ************************* Retype to verify: ************************* You are now operating on a KDBX v4.1 file: foo.kdbx kpcli-4.0:/Root> Notably, this simple test still crashes as well:
[hightowe@localhost ~]$ perl -MCrypt::Argon2=argon2i_raw -e'printf("%v02X\n", argon2i_raw("test", "somesalt", 2, "256k", 2, 32))'
Illegal instruction (core dumped)
More complete info showing the installed version of perl-Crypt-Argon2:
[hightowe@localhost ~]$ dnf info perl-Crypt-Argon2 && perl -MCrypt::Argon2=argon2i_raw -e'printf("%v02X\n", argon2i_raw("test", "somesalt", 2, "256k", 2, 32))'
Last metadata expiration check: 0:02:58 ago on Sat 16 Sep 2023 09:22:47 AM EDT.
Installed Packages
Name : perl-Crypt-Argon2
Version : 0.019
Release : 5.fc38
Architecture : x86_64
Size : 73 k
Source : perl-Crypt-Argon2-0.019-5.fc38.src.rpm
Repository : @System
Summary : Perl interface to the Argon2 key derivation functions
URL : https://metacpan.org/release/Crypt-Argon2
License : Apache-2.0
Description : This module implements the Argon2 key derivation function, which is
: suitable to convert any password into a cryptographic key. This is most
: often used to for secure storage of passwords but can also be used to
: derive a encryption key from a password. It offers variable time and memory
: costs as well as output size.
Illegal instruction (core dumped)
Installing again my own local copy of Crypt::Argon2 with cpanm, which compiles it on my local VM, works perfectly: [hightowe@localhost ~]$ cpanm -f Crypt::Argon2 [...snip...] Installing modules to /home/hightowe/perl5 [...snip...] --> Working on Crypt::Argon2 Fetching http://www.cpan.org/authors/id/L/LE/LEONT/Crypt-Argon2-0.019.tar.gz ... OK Configuring Crypt-Argon2-0.019 ... OK Building and testing Crypt-Argon2-0.019 ... OK Successfully reinstalled Crypt-Argon2-0.019 1 distribution installed [hightowe@localhost ~]$ PERL5LIB=/home/hightowe/perl5/lib/perl5/ ./bin/kpcli-4.0.pl KeePass CLI (kpcli-4.0) v4.0 is ready for operation. Type 'help' for a description of available commands. Type 'help <command>' for details on individual commands. kpcli-4.0:/> newdb Choose your file format: 1. KDB - The original KeePass format (*.kdb). Supported using File::KeePass 2. KDBX3 - The first KeePass XML format (*.kdbx v3). Supported using File::KeePass 3. KDBX4 - The second KeePass XML format (*.kdbx v4). Supported using File::KDBX Choose: (1)/(2)/(3)/(c)ancel? 3 Done. Use the saveas command to write to disk. kpcli-4.0:/Root> saveas foo.kdbx Provide the master password: ************************* Retype to verify: ************************* You are now operating on a KDBX v4.1 file: foo.kdbx kpcli-4.0:/Root> This makes me strongly suspect that the problem somehow lies within the Fedora automated build process for Crypt::Argon2. (In reply to Lester Hightower from comment #3) > Notably, this simple test still crashes as well: > > [hightowe@localhost ~]$ perl -MCrypt::Argon2=argon2i_raw > -e'printf("%v02X\n", argon2i_raw("test", "somesalt", 2, "256k", 2, 32))' > Illegal instruction (core dumped) > > Installed Packages > Name : perl-Crypt-Argon2 > Version : 0.019 > Release : 5.fc38 > Architecture : x86_64 > Size : 73 k > Source : perl-Crypt-Argon2-0.019-5.fc38.src.rpm I cannot reproduce with the Fedora Koji-built Crypt::Argon2 for Fedora 37: >rpm -qi perl-Crypt-Argon2 Name : perl-Crypt-Argon2 Version : 0.019 Release : 5.fc37 Architecture: x86_64 Install Date: Fri 15 Sep 2023 09:34:10 AM EDT Group : Unspecified Size : 76572 License : Apache-2.0 Signature : (none) Source RPM : perl-Crypt-Argon2-0.019-5.fc37.src.rpm Build Date : Fri 15 Sep 2023 09:27:16 AM EDT Build Host : buildhw-x86-02.iad2.fedoraproject.org Packager : Fedora Project Vendor : Fedora Project URL : https://metacpan.org/release/Crypt-Argon2 Bug URL : https://bugz.fedoraproject.org/perl-Crypt-Argon2 Summary : Perl interface to the Argon2 key derivation functions Description : This module implements the Argon2 key derivation function, which is suitable to convert any password into a cryptographic key. This is most often used to for secure storage of passwords but can also be used to derive a encryption key from a password. It offers variable time and memory costs as well as output size. >perl -MCrypt::Argon2=argon2i_raw -e'printf("%v02X\n", argon2i_raw("test", "somesalt", 2, "256k", 2, 32))' 1D.F9.12.A7.CD.A4.D8.32.10.22.EA.CB.16.2E.2D.68.D8.8B.59.C0.E3.74.E3.4C.05.86.5E.86.80.29.6C.15 Let me try with Fedora 38 next. Overnight, an idea occurred to me for what this issue may be. It occurred to me that the error that we are receiving is "Illegal instruction" and not something like a segmentation fault. And so, my idea is that the Fedora Koji-built Crypt::Argon2 is being done on a system with and utilizing more advanced CPU instructions that the VMs have that we are all testing in. I have no real proof of this, but I am highly suspicious that is the case. CPU instruction availability decisions are made by gcc at compile time and including CPU instructions in the compiled library that is later not available in the runtime environment would cause this type of "Illegal instruction" problem. This effect would also explain why compiling Crypt::Argon2 by hand in our VMs always works perfectly since gcc compiles that using only the CPU instructions available in the VMs. I ran these commands on my Linux Mint host and Fedora VM and compared the two, like this: $ cat /proc/cpuinfo |grep -E '^flags'|head -1 | cut -d: -f2|xargs -n 1 |sort > cpu_flags_vm.txt $ cat /proc/cpuinfo |grep -E '^flags'|head -1 | cut -d: -f2|xargs -n 1 |sort > cpu_flags_host.txt $ diff cpu_flags_host.txt cpu_flags_vm.txt | grep -E '^< ' The output of that (not included here for brevity) shows 82 CPU flags that are available in my host that are not in my Fedora VM. I have little idea which of those missing flags may be causing this problem, but I suspect that one or more of them are the issue. My first guess would be avx_vnni, but that is just a guess: https://en.wikipedia.org/wiki/Advanced_Vector_Extensions#AVX-VNNI,_AVX-IFMA If my suspicion is correct, then perhaps setting some GCC flags, for the Fedora Koji build of Crypt::Argon2, such as the ones mentioned in this stack overflow article would be a good idea: https://stackoverflow.com/questions/60815316/disabling-all-avx512-extensions Sorry for the rapid reply, but I think that I possibly found more evidence of my suspicion about this problem being correct. In the Build.PL file that you can see here: https://github.com/Leont/crypt-argon2/blob/master/Build.PL Note that this gcc flag is set: extra_compiler_flags => [ '-march=native' ], That instructs gcc to use the CPU features that is "sees" in its native host environment at compile time, instead of using some far more safe defaults, and that quite possibly could be the root cause of this issue. -- Lester Leon Timmermans, the author of Crypt::Argon2, was very quick with a reply and a suggestion when I opened a bug report asking for his input: https://github.com/Leont/crypt-argon2/issues/12 Just so it is recorded here in case the link above disappears, his reply and suggestion is this: > I suspect you may want to apply the same patch as Debian does: > https://salsa.debian.org/perl-team/modules/packages/libcrypt-argon2-perl/-/commit/ccaa3ba6a852f3de314ad54c2da4618892026ef3 > > I really wish there was some environmental flag to detect if a dist is built > for packaging or for local use, I don't have a good solution for that. > > Or an automatic runtime switch between implementations. The Debian patch simply removes the -march=native flag from being passed to gcc... -- Lester (In reply to Lester Hightower from comment #8) > Leon Timmermans, the author of Crypt::Argon2, was very quick with a reply > and a suggestion when I opened a bug report asking for his input: > https://github.com/Leont/crypt-argon2/issues/12 > > > I suspect you may want to apply the same patch as Debian does: > > https://salsa.debian.org/perl-team/modules/packages/libcrypt-argon2-perl/-/commit/ccaa3ba6a852f3de314ad54c2da4618892026ef3 > The Debian patch simply removes the -march=native flag from being passed to > gcc... Thanks for this! I was going to ask if your CPU was different than mine. I'm pushing updates with this patch now. FEDORA-2023-e238ae3f1e has been submitted as an update to Fedora 40. https://bodhi.fedoraproject.org/updates/FEDORA-2023-e238ae3f1e FEDORA-2023-e238ae3f1e has been pushed to the Fedora 40 stable repository. If problem still persists, please make note of it in this bug report. New builds:
Fedora 37:
https://bodhi.fedoraproject.org/updates/FEDORA-2023-c1045623bf
https://koji.fedoraproject.org/koji/buildinfo?buildID=2291185
Fedora 38:
https://bodhi.fedoraproject.org/updates/FEDORA-2023-c694005278
https://koji.fedoraproject.org/koji/buildinfo?buildID=2291182
Fedora 39:
https://bodhi.fedoraproject.org/updates/FEDORA-2023-174b1a814e
https://koji.fedoraproject.org/koji/buildinfo?buildID=2291183
I downloaded and installed perl-Crypt-Argon2-0.019-6.fc38.x86_64.rpm and can confirm that it seems to have resolved all of the problems that we were seeing, including the failure cases within kpcli-4.0.pl that I reported on Comment #2 of this bug report. I think this one is fixed! |