Arch Linux

Have you restarted after updating the kernel?

well, of course. Linux 5.1.2-arch1-1-AR is the active kernel, according to uname -r

Also I'm not the only one who has this issue - see link to the forum

status with 5.1.3?

same error ...

[user@ ~]$ ecryptfs-mount-private
Enter your login passphrase:
Inserted auth tok with sig [ ] into the user session keyring
mount: No such device
[user@ ~]$ su -

[root@ ~]# modprobe ecryptfs
modprobe: ERROR: could not insert 'ecryptfs': Bad address
[root@ ~]# uname -r
5.1.3-arch1-1-ARCH
[root@Zelos ~]#

and the same with 5.1.4.

The same is for 5.1.6.

and in 5.1.6

why is is bug still unconfirmed? we now have 3 people (see also forum) with the same problem. Is there some information missing?

and in 5.1.7 the same. I also tried linux-zen 5.1.7, ecryptfs is broken.

Can confirm this.

Problem is that the dependend modul "trusted" can not be loaded.
Reason for this seems to be an invalid handling if the bios-setting TPM(Trusted Platform Module) is inactive.
Setting it to disabled instead solves the problem.

I have no idea why "inactive" seems to be the default, since it just makes the module visible to the operating system.
But the module is not working under this state.
But i guess the trusted-module makes no difference between active and inactive and thats the source for the problem.

@CrazyT if you revert c78719203fc629421a0d91d3d22240c36ae0119c , 0b6cf6b97b7ef1fa3c7fefab0cac897a1c4a3400 and 240730437deb213a58915830884e1a99045624dc
in that order can you then load the trusted module with the TPM set to inactive?

At the moment i do not have the time for compiling.

But i'm already 90% shure that the following new line (line 1251):
https://github.com/torvalds/linux/commit/0b6cf6b97b7ef1fa3c7fefab0cac897a1c4a3400#diff-c01228e6d386afb29df6aac17d9dd7abR1251
causes the problem.
Because there should be a check if the TPM-module is inactive.
Else it would probably just return a fault-code at line 1229 or 1231.
(wich explains why init_module returns EFAULT wich later gets returned as "Bad Address")

I think https://github.com/torvalds/linux/commit/c78719203fc629421a0d91d3d22240c36ae0119c fixed the issue when a TPM was not present but missed the case of an inactive TPM

@CrazyT could you please contact upstream about the issue, from

perl scripts/get_maintainer.pl security/keys/trusted.c
James Bottomley <jejb@linux.ibm.com> (supporter:KEYS-TRUSTED)
Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> (supporter:KEYS-TRUSTED)
Mimi Zohar <zohar@linux.ibm.com> (supporter:KEYS-TRUSTED)
David Howells <dhowells@redhat.com> (maintainer:KEYS/KEYRINGS:)
James Morris <jmorris@namei.org> (supporter:SECURITY SUBSYSTEM)
"Serge E. Hallyn" <serge@hallyn.com> (supporter:SECURITY SUBSYSTEM)
linux-integrity@vger.kernel.org (open list:KEYS-TRUSTED)
keyrings@vger.kernel.org (open list:KEYS-TRUSTED)
linux-security-module@vger.kernel.org (open list:SECURITY SUBSYSTEM)
linux-kernel@vger.kernel.org (open list)

I would suggest the keyrings@vger.kernel.org mailing list with a CC to roberto.sassu@huawei.com the commit author with CC's also to the supporters listed for keys-trusted

test.patch first attempt at fixing the issue. Any errors in initialization of the TPM cause the TPM to not be used instead of raising an error.
src.tar.gz included for easier testing.
Build tested only.

I opened a bug a while ago https://bugzilla.kernel.org/show_bug.cgi?id=203953.

Currently building, will report back (I'm juphu2Va over at the forum)

The patch works for me, loading the ecryptfs module works fine with it and also mounting directories works as expected.

I informed upstream and they already told they are working on it.

Your fix is nice, but probably not perfect.
The chip-object will still stay in memory for example.
But as a workaround it should not matter much, since you won't load/unload the module several times during a session.

Proposed fix from upstream https://patchwork.kernel.org/patch/11033029/

https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/commit/queue-5.2/keys-trusted-allow-module-init-if-tpm-is-inactive-or-deactivated.patch?id=c3aa6e9e53780452f7864c2a29744958feef3760
Queued for 5.2.10

installed 5.2.10-arch1-1-ARCH and now I can access my ecryptfs protected files again.
The fix seems to work :)

Can confirm that it works with 5.2.10 upwards