Bug 2022416

This bug was initially created as a copy of Bug #1979256



Created attachment 1798118 [details]
Kickstart

Description of problem:

Trying to install a QEMU/KVM with 2GB of memory (which should be enough for RHEL8.4) with Luks + TPM2 unlocking, it appears that installing through the network is not possible: cryptsetup called by "clevis luks bind" gets killed by OOM killer:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
# chroot /mnt/sysimage 
# clevis luks bind -f -k - -d /dev/vda3 tpm2 '{"pcr_ids":"7"}' <<< "temppass"
Warning: Value 512 is outside of the allowed entropy range, adjusting it.
/bin/clevis-luks-bind: line 198: 54461 Killed                  cryptsetup luksAddKey --key-file <(echo -n "${existing_key}") "$DEV"
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

OOM-Kill:
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
Jul 05 11:58:19 vm-tpm84 kernel: Out of memory: Killed process 54461 (cryptsetup) total-vm:1148728kB, anon-rss:724452kB, file-rss:13920kB, shmem-rss:0kB, UID:0 pgtables:1600kB oom_score_adj:0
-------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

Initially I though about some leak, but executing under Valgrind works for some reason, as if less memory was getting used (or valgrind allocates differently).

Booting with 4GB works, it seems cryptsetup uses ~1GB RSS at some point in time.


Version-Release number of selected component (if applicable):

cryptsetup-2.3.3-4.el8.x86_64


How reproducible:

Always

Steps to Reproduce:

1. Boot a UEFI VM with 2GB over the network (UEFI+HTTP boot), with TPM2 emulated device

  RHEL8.4 DVD mounted on http://192.168.122.1/rhel84 (/var/www/html/rhel84 on my HTTP server)


  UEFI+HTTP bootloader available as http://192.168.122.1/EFI/rhel84/:
  -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
  # mkdir -p /var/www/html/EFI/rhel84
  # cp /var/www/html/rhel84/EFI/BOOT/* /var/www/html/EFI/rhel84/
  -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

  Edit /var/www/html/EFI/rhel84/grub.cfg to specify the boot params for the VM (attached for convenience)

  libvirt "default" network configuration to UEFI+HTTP boot (path to BOOTX64: http://192.168.122.1/EFI/rhel84/BOOTX64.EFI):
  -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------
  <network xmlns:dnsmasq='http://libvirt.org/schemas/network/dnsmasq/1.0' connections='1'>
  <name>default</name>
  <uuid>e2d07733-03c4-448c-a9b1-5b192f7010a9</uuid>
  <forward mode='nat'>
    <nat>
      <port start='1024' end='65535'/>
    </nat>
  </forward>
  <bridge name='virbr0' stp='on' delay='0'/>
  <mac address='52:54:00:5a:ef:0d'/>
  <domain name='libvirt' localOnly='yes'/>
  <ip address='192.168.122.1' netmask='255.255.255.0'/>
  <dnsmasq:options>
    <dnsmasq:option value='dhcp-vendorclass=set:efi-http,HTTPClient:Arch:00016'/>
    <dnsmasq:option value='dhcp-option-force=tag:efi-http,60,HTTPClient'/>
    <dnsmasq:option value='dhcp-boot=tag:efi-http,&quot;http://192.168.122.1/EFI/rhel84/BOOTX64.EFI&quot;'/>
  </dnsmasq:options>
  </network>
  -------- 8< ---------------- 8< ---------------- 8< ---------------- 8< --------

  tpm8.4 XML attached for convenience

  kickstart "tpm8.ks" attached for convenience (root password: "redhat")


Actual results:

"clevis luks bind" aborts.


Expected results:

Success