#1105164 linux-image-6.1.0-35-amd64: watchdog kernel module load errors with "Bad message"

Package:
src:linux
Source:
src:linux
Submitter:
Robert Shearman
Date:
2025-05-19 18:33:07 UTC
Severity:
normal
#1105164#5
Date:
2025-05-12 15:38:19 UTC
From:
To:
    rob@graph-dev-bookworm:~$ sudo modprobe watchdog
    modprobe: ERROR: could not insert 'watchdog': Bad message

Using extract-module-sig.pl from
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/plain/scripts/extract-module-sig.pl
shows there is no signature present for the watchdog kernel object
file:

    $ ~/Downloads/extract-module-sig.pl -s
/lib/modules/6.1.0-35-amd64/kernel/drivers/watchdog/watchdog.ko
    Read 91616 bytes from module file
    Found magic number at 91616
    Found PKCS#7/CMS encapsulation

Compared to 6.1.0-34-amd64 version:

    $ ~/Downloads/extract-module-sig.pl -s
/lib/modules/6.1.0-34-amd64/kernel/drivers/watchdog/watchdog.ko
    Read 92027 bytes from module file
    Found magic number at 92027
    Found PKCS#7/CMS encapsulation
    Found 411 bytes of signature [3082019706092a864886f70d010702a0]
    ...
#1105164#10
Date:
2025-05-12 20:34:51 UTC
From:
To:
Hi Robert,

So indeed there was likely a temporary problem when doing the signing
of the modules for linux-signed-amd64. There is the watchdog module
and w83977f_wdt one which have zero size signature:

./linux-signed-amd64-6.1.137+1/debian/signatures/linux-image-6.1.0-35-amd64-unsigned/lib/modules/6.1.0-35-amd64/kernel/drivers/watchdog/watchdog.ko.sig
./linux-signed-amd64-6.1.137+1/debian/signatures/linux-image-6.1.0-35-amd64-unsigned/lib/modules/6.1.0-35-amd64/kernel/drivers/watchdog/w83977f_wdt.ko.sig

I checked as well linux-signed-i386 and linux-signed-arm64 but there I
found none with a problem.

Ansgar, assuming at this point we cannot do something anymore for the
point release.

Cyril, Adam, so skip the kernel update for the upcoming point release?

Regards,
Salvatore
#1105164#17
Date:
2025-05-12 21:02:56 UTC
From:
To:
The alternative would be given that the "only" two modules affected
are watchdog and w83977f_wdt to proceed as planned with the point
release (testing, Cyril?) and make a nearby src:linux DSA release
including further security fixes.

6.14.7, 6.12.29 and 6.1.139 are currently beeing reviewed upstream in
particular including the ITS variant of the "Training Solo" issue
(side note, to be effective the fixes will need as well a
intel-microcode update, cf. #1105172).

Regards,
Salvatore
#1105164#22
Date:
2025-05-12 21:16:23 UTC
From:
To:
Hola,

We discussed briefly just now and decided that:

 - as it's "just" amd64 watchdog and w83977f_wdt modules, and
 - a kernel DSA is imminent anyway, and
 - deferring the point release and skipping the kernel are both major
   upheavals,

we intend to continue as planned and include a warning in the announcement
on release, that affected users should disable their watchdogs or not
reboot until an updated kernel is released very soon after the point
release will be.

If there are other issues we have not considered please speak up urgently.
#1105164#27
Date:
2025-05-12 21:53:13 UTC
From:
To:
Hi,

Jonathan Wiltshire <jmw@debian.org> (2025-05-12):

It's been a while since I last toyed with watchdogs (and those needed
explicit actions to be enabled anyway), but I'd expect those not to be
shipped or used within d-i, so probable ACK on the installer front.

A quick look through Contents-udeb-* through a reconfigured apt-file
seems to suggest they're not shipped in any udeb. Definitive ACK then.

Unless you tell me otherwise I'll stick to testing then uploading d-i
with the ABI bumped to 35. (And it can still be rejected from pu-NEW
anyway?)


Cheers,
#1105164#32
Date:
2025-05-13 00:06:52 UTC
From:
To:
Cyril Brulebois <kibi@debian.org> (2025-05-12):

Local testing looked good, so src:debian-installer is on its way.

Please let me know if and when I should move on to d-i-n-i (in case I
miss a “no no no, let's find a different solution” kind of answer).


Cheers,
#1105164#43
Date:
2025-05-17 06:51:54 UTC
From:
To:
Hi

[not yet trimming the CC list to give a short update]

After a short double-checking with Ansgar, the check might be
included in
https://salsa.debian.org/ftp-team/code-signing/-/blob/master/secure-boot-code-sign.py?ref_type=heads#L180
in the sign_kmod function. And similarly in sign_efi function as well
in
https://salsa.debian.org/ftp-team/code-signing/-/blob/master/secure-boot-code-sign.py?ref_type=heads#L200

Regards,
Salvatore
#1105164#50
Date:
2025-05-17 18:13:48 UTC
From:
To:
Hello.

Reporting that this bug affects my bookworm amd64 system after the
latest 12.11 point release. The only difference is I am trying to load
w83627hf_wdt module. The error message is the same:

modprobe: ERROR: could not insert 'w83627hf_wdt': Bad message
#1105164#55
Date:
2025-05-17 19:41:03 UTC
From:
To:
Hi,

Yes this is explained in the known issues of todays 12.11
announcement:

https://lists.debian.org/debian-announce/2025/msg00002.html

it will be resolved with a linux which we can expect soon due to other
reasons.

Regards,
Salvatore