Bug 1350174 - KASLR disabled: 'kaslr' not on cmdline (hibernation selected).
Summary: KASLR disabled: 'kaslr' not on cmdline (hibernation selected).
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: kernel
Version: rawhide
Hardware: x86_64
OS: Linux
unspecified
unspecified
Target Milestone: ---
Assignee: Kernel Maintainer List
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-06-26 09:25 UTC by deadrat
Modified: 2016-09-15 20:55 UTC (History)
34 users (show)

Fixed In Version: kernel-4.7.3-200.fc24
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-09-13 22:22:49 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)
screenshot (1.62 MB, image/jpeg)
2016-06-26 09:25 UTC, deadrat
no flags Details

Description deadrat 2016-06-26 09:25:21 UTC
Created attachment 1172479 [details]
screenshot

Description of problem:
A warning/error during startup, right after the GRUB screen and before dracut. 

Version-Release number of selected component (if applicable):
Fedora rawhide ( Linux machine 4.7.0-0.rc4.git1.1.fc25.x86_64 #1 SMP Tue Jun 21 15:11:37 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux )



How reproducible:
Happens everytime on boot

Steps to Reproduce:

1. Install Fedora rawhide. ( I installed Fedora-Workstation-Live-x86_64-Rawhide-20160623.n.0.iso )
2. boot fedora. 

Actual results:
After the boot goes past GRUB screen, this message comes up. 

Expected results:
n/a

Additional info:
I have tried it on another machine (Thinkpad T450) and this issue occurs.

Comment 1 Josh Boyer 2016-06-26 12:19:47 UTC
This looks to be from commit 0f8ede1b8c4cb845c53072d7e49d71ca24a61ced upstream.

Since we build with CONFIG_HIBERNATION, it does the weird WARN thing now.  We'll look into this but I'm not sure there's going to be a great resolution.

Comment 2 Josh Boyer 2016-06-26 12:25:05 UTC
Actually, this looks to have been fixed by commit 65fe935dd2387a4faf15314c73f5e6d31ef0217e in the tip tree.  That hasn't quite hit Linus' tree yet, but I suspect it will sometime next week.

Comment 3 deadrat 2016-07-05 08:40:40 UTC
(In reply to Josh Boyer from comment #2)
> Actually, this looks to have been fixed by commit
> 65fe935dd2387a4faf15314c73f5e6d31ef0217e in the tip tree.  That hasn't quite
> hit Linus' tree yet, but I suspect it will sometime next week.

Thanks for the update and thanks for looking into it!

Comment 4 Bill 2016-08-26 01:12:29 UTC
This has now showed up in Fedora 24 with 4.7.2-200.fc24.x86_64 update that came through updates testing today.

Comment 5 Christian Stadelmann 2016-08-28 11:52:19 UTC
(In reply to Bill from comment #4)
> This has now showed up in Fedora 24 with 4.7.2-200.fc24.x86_64 update that
> came through updates testing today.

Confirmed, same issue here with this exact same kernel version on F24.

Comment 6 RudraB 2016-08-31 12:43:08 UTC
I have not faced it with 4.7.2-200.fc24.x86_64 (installed from updates-testing), but with 4.7.2-201 (installed using koji download-build), this error came up.

Comment 7 Talip Durmuş 2016-09-03 14:02:38 UTC
I'm using Fedora 24 and after 4.7.2 kernel update this error came up

Comment 8 SteveCr48 2016-09-03 14:45:56 UTC
This isn't a bug or warning per se. The Fedora devs have chosen to build the kernel with CONFIG_HIBERNATION, as noted above. 

We can learn from the LKML, the kernel developers prioritized CONFIG_RANDOMIZE_BASE over CONFIG_HIBERNATION to improve security. The kernel team recommends DISABLING hibernation by default AND passing "nokaslr" on the kernel command line. 

The kernel patch produces the message reported: 

-#ifdef CONFIG_HIBERNATION
-	if (!cmdline_find_option_bool("kaslr")) {
-		debug_putstr("KASLR disabled by default...\n");
-		goto out;

If my understanding is correct, the Fedora devs may want to disable hibernation by default and give users the option of modifying the kernel command line. According to LKML, implementing kASLR will improve security

Comment 9 Josh Boyer 2016-09-03 15:14:04 UTC
(In reply to SteveCr48 from comment #8)
> This isn't a bug or warning per se. The Fedora devs have chosen to build the
> kernel with CONFIG_HIBERNATION, as noted above. 
> 
> We can learn from the LKML, the kernel developers prioritized
> CONFIG_RANDOMIZE_BASE over CONFIG_HIBERNATION to improve security. The
> kernel team recommends DISABLING hibernation by default AND passing
> "nokaslr" on the kernel command line. 
> 
> The kernel patch produces the message reported: 
> 
> -#ifdef CONFIG_HIBERNATION
> -	if (!cmdline_find_option_bool("kaslr")) {
> -		debug_putstr("KASLR disabled by default...\n");
> -		goto out;
> 
> If my understanding is correct, the Fedora devs may want to disable
> hibernation by default and give users the option of modifying the kernel
> command line. According to LKML, implementing kASLR will improve security

That's inaccurate.  As I said in comment #2, the issue is fixed.  It is now in Linus' tree but didn't make the 4.7.y kernel.  The options are to wait for 4.8.y or to backport the patch that fixes it.

Comment 10 Joseph McMurray 2016-09-03 18:17:34 UTC
(In reply to Bill from comment #4)
> This has now showed up in Fedora 24 with 4.7.2-200.fc24.x86_64 update that
> came through updates testing today.

Getting this issue with 4.7.2-201.fc24.x86_64

Also loading the previous kernel versions from grub gets me an error "Oops something went wrong"

Just installed some pending updates this morning which started this issue. Everything was working fine before then.

Comment 11 Joseph McMurray 2016-09-03 19:39:17 UTC
(In reply to Joseph McMurray from comment #10)
> (In reply to Bill from comment #4)
> > This has now showed up in Fedora 24 with 4.7.2-200.fc24.x86_64 update that
> > came through updates testing today.
> 
> Getting this issue with 4.7.2-201.fc24.x86_64
> 
> Also loading the previous kernel versions from grub gets me an error "Oops
> something went wrong"
> 
> Just installed some pending updates this morning which started this issue.
> Everything was working fine before then.

Disregard the later half of that comment. That is something separate.

Comment 12 Dolmio 2016-09-04 15:23:27 UTC
Confirmed with 4.7.2-201.fc24.x86_64 on two different laptops

Comment 13 Andreas Schöneck 2016-09-05 06:30:36 UTC
Some information for the F24 users on how this is going to be officially tackled would be nice. As far as I can see, there are at least a couple of options including:

* re-configuring the kernel command line -- is this then being done by updates to the respective packages?

* back-porting the changes from https://patchwork.kernel.org/patch/9199367/ to 4.7.* kernels and building new kernel packages

* leave the choice up to the users, potentially having all their kernels producing warnings at boot time -- should provide some kind of mini-how-to then

Any statements?

Comment 14 Dan Loomis 2016-09-05 07:29:01 UTC
Now in Fedora 23 as well.  4.7.2-101.fc23.x86_64 landed on September 04.

Comment 15 Sally 2016-09-05 16:03:43 UTC
This message "kaslr disabled: 'kaslr not on cmdline (hiberation selected)" has appeared after the laptop got a sudden switched of because the battery.
I thought it was because of this, I am using SSD.
I am using F24.
Waiting for a new kernel update.

Comment 16 Matthias31 2016-09-07 09:46:33 UTC
Same problem on a DELL Optiplex 790 but not on my Dell Optiplex 760, Asus notebook and HP Pavilion x360 II.

Comment 17 Matthias31 2016-09-07 09:51:32 UTC
For those not using hibernation, adding "nohibernate" to the kernel append line does make the KASLR disabled message go away.

Comment 18 Ali Zeynali 2016-09-07 13:07:30 UTC
yep! Same problem in Fedora 24(Kernel Version:  4.7.2_201)

Comment 19 Fedora Update System 2016-09-08 15:40:59 UTC
kernel-4.7.3-200.fc24 has been submitted as an update to Fedora 24. https://bodhi.fedoraproject.org/updates/FEDORA-2016-f9d5f8f03f

Comment 20 Fedora Update System 2016-09-08 15:42:38 UTC
kernel-4.7.3-100.fc23 has been submitted as an update to Fedora 23. https://bodhi.fedoraproject.org/updates/FEDORA-2016-91fb402c7f

Comment 21 Christopher 2016-09-09 13:29:14 UTC
I confirm, the message is present on my F23 system after the update to 4.7.2-201.fc23.x86_64

Comment 22 Fedora Update System 2016-09-09 17:56:46 UTC
kernel-4.7.3-100.fc23 has been pushed to the Fedora 23 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-91fb402c7f

Comment 23 Mike Molina 2016-09-09 21:26:16 UTC
I confirm this situation in a virtual machine. My machine virtual
is virtualbox for windows (version 5.0.26 r108824 - 64 bit) running
Fedora 23 - 64 bit with kernel 4.7.2-101.fc23.x86_64. After of
message "kaslr disabled: 'kaslr' not on cmdline (hiberation selected)",
the system is frozen and does not allow start Session in my account.

Comment 24 rhbug 2016-09-11 09:03:19 UTC
(In reply to Matthias31 from comment #17)
> For those not using hibernation, adding "nohibernate" to the kernel append
> line does make the KASLR disabled message go away.

For me on 4.7.2-101.fc23.x86_64 adding "nohibernate" didn't, but adding "kaslr" did.

Comment 25 Fedora Update System 2016-09-12 15:27:13 UTC
kernel-4.7.3-200.fc24 has been pushed to the Fedora 24 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-f9d5f8f03f

Comment 26 Bill 2016-09-13 00:46:39 UTC
Installed kernel 4.7.3-200.fc24 from updates testing and I can confirm that the problem is resolved for me,.

Comment 27 Fedora Update System 2016-09-13 22:22:23 UTC
kernel-4.7.3-200.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report.

Comment 28 Fedora Update System 2016-09-14 01:19:01 UTC
kernel-4.7.3-100.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.

Comment 29 Ernst 2016-09-14 02:25:55 UTC
A quick question.  What do ordinary folk do when this has wiped out their Fedora?

My screen flashes for a while trying to start Gnome display manager.

So again.... What do folk that can't access their system do to update so it works?
sent from my iPhone.

Comment 30 Christian Stadelmann 2016-09-14 06:27:08 UTC
(In reply to Ernst from comment #29)
> A quick question.  What do ordinary folk do when this has wiped out their
> Fedora?
> 
> My screen flashes for a while trying to start Gnome display manager.
> 
> So again.... What do folk that can't access their system do to update so it
> works?
> sent from my iPhone.

1. This issue surely didn't wipe out anyone's Fedora.
2. If your system doesn't boot, try to select an older kernel or a rescue kernel on boot.
3. go to a tty (Ctrl+Alt+F3 for example) and try to log in from there. Can you access the syslog (journalctl)? There should be some useful info there.
4. Put your question on ask.fedoraproject.org, the fedora forums or on https://lists.fedoraproject.org/archives/list/users@lists.fedoraproject.org/ . If you know what you're doing, file a bug here on this bugzilla instead.

Comment 31 Irwin 2016-09-15 18:41:07 UTC
I'm running Fedora 24 on VirtualBox. I updated my kernel to kernel-4.7.3-200.fc24.x86_64 but the the system still crashes before it can start Gnome. Adding kaslr, nokaslr, or nohibernate doesn't help. The last kernel that works is kernel-4.6.7-300.fc24.x86_64. I can't get a syslog because I can't switch to a TTY after the crash, and after rebooting with the working kernel, the boot syslog gets updated with the successful boot.

Comment 32 Laura Abbott 2016-09-15 19:50:46 UTC
This issue is not related to anything than a single print message. If you are having any other issue please open a separate bugzilla.

Comment 33 Irwin 2016-09-15 20:55:37 UTC
(In reply to Laura Abbott from comment #32)
> This issue is not related to anything than a single print message. If you
> are having any other issue please open a separate bugzilla.

You're right, sorry about that. I figured it might still be related to this issue based on Comment 29. For what it's worth, the issue I was is fixed by updating Virtual Box and the Guest Additions: http://unix.stackexchange.com/questions/309076/fedora-24-kernel-4-7-2-201-crash-on-boot-once-virtualbox-guest-additions-have


Note You need to log in before you can comment on or make changes to this bug.