Boot error: libgcc_s.so.1 must be installed for pthread_exit to work

Bug #1958594 reported by Athos Ribeiro
30
This bug affects 4 people
Affects Status Importance Assigned to Milestone
initramfs-tools (Ubuntu)
Fix Released
Critical
Unassigned
Jammy
Fix Released
Critical
Unassigned

Bug Description

[Bug description]

On a jammy installation, which was upgraded from focal, after a full-upgrade and a reboot,

I enter the LUKS password to decrypt the disk. Then I get the following error:

libgcc_s.so.1 must be installed for pthread_exit to work

After the error is shown, the system asks for the password again (which never works, always throwing the same error).

[Root cause]

I was able to decrypt the disk with the same password by booting from a live usb. Which allowed further investigation.

The error shown in the LUKS password prompt menu comes from
https://github.com/bminor/glibc/blob/glibc-2.34/nptl/pthread_exit.c#L31-L32, which indeed shows that pthread_exit fails when libgcc_s.so.1 is missing.

From
https://git.launchpad.net/ubuntu/+source/initramfs-tools/tree/hook-functions?h=import/0.140ubuntu10#n260,
we noticed that libgcc_s.so.1 is only copied if

1) copy_exec is called for a binary directly linked to libgcc_s.so.1, or
2) copy_exec is called for a binary linked to libpthread

The cryptsetup initramfs hook, calls copy_exec for /sbin/cryptsetup, which is linked to libargon2.so.1, which is linked to libpthread.so.0. This covers case (2) above. As a consequence, libgcc_s.so.1 is copied to the initrd image and the error reported here is not seen.

However, since glibc 2.34, libpthread is shipped within glibc, and the binaries are no longer linked to libpthread.so.0. As a consequence, an argon2 package built with glibc 2.32 will no longer be linked to libpthread.so.0 and libgcc_s.so.1 will no longer be copied to the initrd image. Triggering the reported error.

This can be verified in these two argon2 builds, from the same sources, but with different glibc versions:

https://launchpad.net/ubuntu/+source/argon2/0~20171227-0.2build21.04.0/+build/21066610
https://launchpad.net/ubuntu/+source/argon2/0~20171227-0.2build22/+build/22255217

Still lvm2 is a seeded package, which Recommends thin-provisioning-tools. thin-provisioning-tools ships a initramfs hook that calls copy_exec for /usr/sbin/pdata_tools, which is directly linked to libgcc_s.so.1. This covers the case (1) above and should suffice to ensure the boot process works properly.

Since thin-provisioning-tools is just a recommends for lvm2, it could be removed from the system (and indeed, for some reason, was not present in my focal=>jammy installation). In this case, a new kernel installation should trigger the reported error.

[Reproducer]

- Install jammy with a LUKS encrypted disk
- remove thin-provisioning-tools
- perform a full-upgrade (make sure the kernel was upgraded or run update-initramfs manually)
- reboot and verify you can no longer get past the decrypt password prompt screen

[Workaround]

A workaround for anyone affected would be to install thin-provisioning-tools and run update-initramfs.

[Impact]

Users upgrading from focal to jammy will eventually be locked out of their systems in case they are using LUKS encryption.

[Additional information]

While this issue is similar to
https://bugs.launchpad.net/ubuntu/+source/initramfs-tools/+bug/1861757,
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=950254, and
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=950551,
This is a different bug, with a different root cause.

Thanks to sergiodj for the pairing session on the root cause analysis.

Tags: fr-2002
Revision history for this message
Athos Ribeiro (athos-ribeiro) wrote :

As per https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=950254, the "libpthread copies libgcc" snippet in the copy_exec hook function may be needed for other packages such as open-iscsi, btrfs-progs. In this case these may also be affected by this issue. If this is the case, a solution should lie in the hook-functions here.

Changed in initramfs-tools (Ubuntu):
importance: Undecided → Critical
description: updated
tags: added: rls-jj-incoming
Revision history for this message
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in initramfs-tools (Ubuntu):
status: New → Confirmed
Changed in initramfs-tools (Ubuntu):
milestone: none → ubuntu-22.02
Revision history for this message
Harshal Prakash Patankar (pharshalp) wrote (last edit ):

Accidentally changed the status... sorry about that. Can anyone please remove the "Fix Released" status? Not sure how to do that...

Changed in initramfs-tools (Ubuntu):
status: Confirmed → Fix Released
Changed in initramfs-tools (Ubuntu):
status: Fix Released → Confirmed
tags: added: fr-2002
tags: removed: rls-jj-incoming
Revision history for this message
Athos Ribeiro (athos-ribeiro) wrote :

In case you are running Jammy and gets affected by this issue:

The workaround described consists of booting from a live usb, decrypting the disk, getting a chroot, and only then installing thin-provisioning-tools and running update-initramfs.

This is the script I was using to decrypt the disk and get the chroot (you will need to adjust it for your disk) [1].

In special, the name used with luksOpen should match the one described in /etc/crypttab

[1]:

#!/bin/bash
set -eux
sudo cryptsetup luksOpen /dev/nvme0n1p3 crypt_dev_nvme0n1p3
sudo vgscan --mknodes
sudo vgchange -ay
sudo mkdir /media/disk
sudo mount /dev/mapper/system-root /media/disk/
sudo mount /dev/nvme0n1p1 /media/disk/boot/
sudo cp -L /etc/resolv.conf /media/disk/etc/resolv.conf
cd /
sudo mount -t proc proc /media/disk/proc
sudo mount -t sysfs sys /media/disk/sys
sudo mount -o bind /dev /media/disk/dev
sudo chroot /media/disk /bin/bash

Revision history for this message
Dimitri John Ledkov (xnox) wrote :

It feels like we should just copy libgcc_s.so.1 and libpthread always. It is tiny in size and something is bound to use them.

Revision history for this message
Sergio Durigan Junior (sergiodj) wrote :

Yes, that's my take as well. I was going to proposed a patch to do just that but I decided to see if there was another way to just selectively copy lib{gcc_s,pthread}. I don't think it's worth the hassle, though.

Revision history for this message
Chris Halse Rogers (raof) wrote :

Are you guaranteed to be able to know the set of architecture(s) of libgcc_s needed? That's what's prevented me from suggesting a patch like that.

Revision history for this message
Dimitri John Ledkov (xnox) wrote :

We have been bitten by this before. And Last time I did proposed to do this:

- create a stub binary tha tis linked with pthread and libgcc_s
- copy_exec that into the initramfs

https://code.launchpad.net/~xnox/ubuntu/+source/initramfs-tools/+git/initramfs-tools/+merge/385243

This ensures that at least one binary wants pthreads and libgcc_s and those things get copied into the initramfs correctly and always for the host architecture.

I had to do this with a binary, because precisely like raof says we never know which architecture we need, and which hw optimized version of those libraries is needed.

I feel like I should upload the above (rebased on jammy) into jammy to get this done once and for all. Kind of sad that I didn't do that 2 years ago. Which would have avoided this issue today.

Revision history for this message
Sergio Durigan Junior (sergiodj) wrote :

Dimitri,

I don't know if this will suffice. With glibc's decision to remove libpthread, I believe we will need to explicitly copy libpthread.so, at least temporarily until everything else doesn't explicitly link against it.

Taking the stub binary your MP is generating as an example (running on Jammy):

# gcc -Wl,--no-as-needed -shared -pthread -l:libgcc_s.so.1 -o bla
# ldd bla
        linux-vdso.so.1 (0x00007ffdba94d000)
        libgcc_s.so.1 => /lib/x86_64-linux-gnu/libgcc_s.so.1 (0x00007f581d651000)
        libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f581d429000)
        /lib64/ld-linux-x86-64.so.2 (0x00007f581d678000)

We see that it's not linked against pthread.

Revision history for this message
Dimitri John Ledkov (xnox) wrote :

With that branch rebased, and typpos fixed up testing locally does produce this:

Adding binary /usr/lib/initramfs-tools/bin/gcc_s1-stub
Adding binary /lib/x86_64-linux-gnu/libgcc_s.so.1
Adding binary /lib/x86_64-linux-gnu/libc.so.6
Adding binary-link /usr/lib64/ld-linux-x86-64.so.2
Adding binary /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2

Let me see if i can force linkage with pthreads too.

Revision history for this message
Dimitri John Ledkov (xnox) wrote :

$ gcc -Wl,--no-as-needed -shared -l:libpthread.so.0 -l:libgcc_s.so.1 -o bla

$ ldd bla
 linux-vdso.so.1 (0x00007ffe0e7e6000)
 libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007feeeaa32000)
 libgcc_s.so.1 => /lib/x86_64-linux-gnu/libgcc_s.so.1 (0x00007feeeaa18000)
 libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007feeea7f0000)
 /lib64/ld-linux-x86-64.so.2 (0x00007feeeaa7f000)

might do it.

Revision history for this message
Dimitri John Ledkov (xnox) wrote :

With above, when testing I now get:

Adding binary /usr/lib/initramfs-tools/bin/gcc_s1-stub
Adding binary /lib/x86_64-linux-gnu/libgcc_s.so.1
Adding binary /lib/x86_64-linux-gnu/libc.so.6
Adding binary-link /usr/lib64/ld-linux-x86-64.so.2
Adding binary /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2
Adding binary /lib/x86_64-linux-gnu/libpthread.so.0

which seems alright.

Changed in initramfs-tools (Ubuntu Jammy):
status: Confirmed → Fix Committed
Revision history for this message
Dimitri John Ledkov (xnox) wrote :

To be fair we don't need the empty pthread in the initramfs, we only need the non-empty dynamically opened libgcc_s, but it shouldn't hurt either.

Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package initramfs-tools - 0.140ubuntu12

---------------
initramfs-tools (0.140ubuntu12) jammy; urgency=medium

  * Force copy pthread and libgcc_s libraries via a stub binary.

    To avoid circular shared library dependencies between compiler and
    libc, libpthreads chooses to dlopen libgcc_s, instead of linking
    against it. However, we have no way to parse/know what it
    needs. And even when we hardcode to include libgcc_s1, we don't
    have a way to know which libgcc_s1 is needed on a given system and
    from which path to include it. But there is a hook-function to
    copy a binary and all of its shared library dependencies. Thus
    create a stub empty executable, with shared linking against
    pthreads and gcc_s1 and always include it in the initrd. This way
    at initrd creation time, ldd is used to correctly resolve these
    shared library dependencies and correctly copy them into the
    initrd. This removes hardcoding paths as to where these libraries
    must be copied from on the host. LP: #1958594 LP: #1880853

  * For net boot include most of net/usb modules, except niche modems. LP:
    #1950996

  * Cherry-pick updated merge request !26 to support xz compressed
    firmware. Uncompressed firmware is preffered, with a fallback to use
    compressed firmware files. LP: #1942260

  * Cherry-pick updated merge request !51 to decompress compressed kernel
    modules for boot speed performance. LP: #1932329

 -- Dimitri John Ledkov <email address hidden> Tue, 08 Feb 2022 20:43:02 +0000

Changed in initramfs-tools (Ubuntu Jammy):
status: Fix Committed → Fix Released
Revision history for this message
Manikanta (msreeram) wrote :

we are still observing the issue even with initramfs-tools/now 0.140ubuntu13.1 pacakge with python 3.7 version.
do we need to upgrade any other packages to fix this issue?

Revision history for this message
Benjamin Drung (bdrung) wrote :

No, updating initramfs-tools should be enough. Can you open a new bug report to investigate and attach the output of lsinitramfs on the failing initramfs?

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Duplicates of this bug

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.