Hírolvasó

Security updates for Tuesday

3 év 1 hónap óta
Security updates have been issued by Debian (nodejs and squid), Fedora (uboot-tools), Red Hat (kernel-rt, kpatch-patch, and python), SUSE (drbd, openssl-1_0_0, oracleasm, and rubygem-rack), and Ubuntu (curl).
corbet

[$] Two memory-tiering patch sets

3 év 1 hónap óta
Once upon a time, computers just had one type memory, so memory within a given system was interchangeable. The arrival of non-uniform memory access (NUMA) systems complicated the situation significantly; now some memory was faster to access than the rest, and memory-management algorithms had to adapt or performance would suffer. But NUMA was just the start; today's tiered-memory systems, which may include several tiers of memory with different performance characteristics, are adding new challenges. A couple of relevant patch sets currently under review help to illustrate the types of problems that will have to be solved.
corbet

KDE Apps Mid-Year Update (KDE.news)

3 év 1 hónap óta
Here's an update on recent KDE application development on KDE.news:

KStars is probably the most feature-rich free astronomy software around and the 3.5.9 release adds some exciting new features. HiPS (Hierarchical Progressive Surveys) is a technology that provides progressive high resolution images of the sky at different zoom levels. KStars fully supports online HiPS where data is downloaded from online servers and cached to be displayed on the Sky Map.

corbet

Ojeda: Memory Safety for the World’s Largest Software Project

3 év 1 hónap óta
Miguel Ojeda has posted an update on the Rust-for-Linux project.

This second year since the RFC we are looking forward to several milestones which hopefully we will achieve:

  • More users or use cases inside the kernel, including example drivers – this is pretty important to get merged into the kernel.
  • Splitting the kernel crate and managing dependencies to allow better development.
  • Extending the current integration of the kernel documentation, testing and other tools.
  • Getting more subsystem maintainers, companies and researchers involved.
  • Seeing most of the remaining Rust features stabilized.
  • Possibly being able to start compiling the Rust code in the kernel with GCC.
  • And, of course, getting merged into the mainline kernel, which should make everything else easier!
corbet

Linux Plumbers Conference: Microconferences at Linux Plumbers Conference: Android

3 év 1 hónap óta

Linux Plumbers Conference 2022 is pleased to host the Android Microconference

Continuing in the same direction as last year, this year’s Android microconference will be an opportunity to foster collaboration between the Android and Linux kernel communities. Discussions will be centered on the goal of ensuring that both the Android and Linux development moves in a lockstep fashion going forward.

Projected topics:

  • io_uring in Android
  • MGLRU results on Android
  • Hermetic builds with Bazel
  • Android kernel testing updates
  • pKVM
  • erofs as a replacement for f2fs and the deprecation of ext4
  • eBPF-based FUSE
  • stgdiff tools
  • Technical debt
  • Parallelized suspend/resume
  • CPU DVFS for guest thread migrations

Please come and join us in the discussion of making Android a better partner with Linux.

We hope to see you there!

Security updates for Monday

3 év 1 hónap óta
Security updates have been issued by Debian (openssl), Fedora (dotnet6.0, mediawiki, and python2.7), Mageia (389-ds-base, chromium-browser-stable, exo, and libtiff), Oracle (httpd:2.4 and microcode_ctl), SUSE (dbus-broker, drbd, kernel, liblouis, mariadb, openssl, openssl-1_1, openSUSE kernel modules, oracleasm, php7, php72, python39, salt, and wdiff), and Ubuntu (linux, linux-hwe, mozjs91, and vim).
jake

Kernel prepatch 5.19-rc4

3 év 1 hónap óta
The 5.19-rc4 kernel prepatch is out for testing.

So we've had a couple of fairly small rc releases, and here we finally start to see an uptick in commits in rc4. Not what I really want to see in the middle of the release cycle, but not entirely surprising considering how quiet it's been so far.

corbet

Another set of stable kernel updates

3 év 1 hónap óta
The 5.18.7, 5.15.50, 5.10.125, 5.4.201, 4.19.249, 4.14.285, and 4.9.320 stable updates have all been released. The 5.x updates are relatively small, but the 4.x updates contain a fair number of backported random-number-generator improvements along with the usual fixes.

Update: Due to an io_uring problem reported by Greg Thelen in 5.10.125, which was quickly fixed by Jens Axboe, 5.10.126 was released less than 24 hours later.

corbet

Linux Plumbers Conference: Microconferences at Linux Plumbers Conference: Open Printing

3 év 1 hónap óta

Linux Plumbers Conference 2022 is pleased to host the Open Printing Microconference

OpenPrinting has been improving the way we print in Linux. Over the years we have changed many conventional ways of printing and scanning. Over the last few years we have been emphasizing on the fact that driverless print and scan has made life easier however this does not make us stop improving. Every day we are trying to design new ways of printing to make your printing and scanning experience better than that of today.

Proposed Topics :

  • CUPS 2.5 and 3.0 Development
  • 3D Printing
  • Testing and CI for OpenPrinting projects
  • Documentation for OpenPrinting projects
  • Sandboxing/Containerizing alternatives to Snap for Printer Applications or CUPS

Please come and join us in the discussion to bring Linux printing, scanning and fax a better experience.

We hope to see you there!

Kees Cook: finding binary differences

3 év 1 hónap óta

As part of the continuing work to replace 1-element arrays in the Linux kernel, it’s very handy to show that a source change has had no executable code difference. For example, if you started with this:

struct foo { unsigned long flags; u32 length; u32 data[1]; }; void foo_init(int count) { struct foo *instance; size_t bytes = sizeof(*instance) + sizeof(u32) * (count - 1); ... instance = kmalloc(bytes, GFP_KERNEL); ... };

And you changed only the struct definition:

- u32 data[1]; + u32 data[];

The bytes calculation is going to be incorrect, since it is still subtracting 1 element’s worth of space from the desired count. (And let’s ignore for the moment the open-coded calculation that may end up with an arithmetic over/underflow here; that can be solved separately by using the struct_size() helper or the size_mul(), size_add(), etc family of helpers.)

The missed adjustment to the size calculation is relatively easy to find in this example, but sometimes it’s much less obvious how structure sizes might be woven into the code. I’ve been checking for issues by using the fantastic diffoscope tool. It can produce a LOT of noise if you try to compare builds without keeping in mind the issues solved by reproducible builds, with some additional notes. I prepare my build with the “known to disrupt code layout” options disabled, but with debug info enabled:

$ KBF="KBUILD_BUILD_TIMESTAMP=1970-01-01 KBUILD_BUILD_USER=user KBUILD_BUILD_HOST=host KBUILD_BUILD_VERSION=1" $ OUT=gcc $ make $KBF O=$OUT allmodconfig $ ./scripts/config --file $OUT/.config \ -d GCOV_KERNEL -d KCOV -d GCC_PLUGINS -d IKHEADERS -d KASAN -d UBSAN \ -d DEBUG_INFO_NONE -e DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT $ make $KBF O=$OUT olddefconfig

Then I build a stock target, saving the output in “before”. In this case, I’m examining drivers/scsi/megaraid/:

$ make -jN $KBF O=$OUT drivers/scsi/megaraid/ $ mkdir -p $OUT/before $ cp $OUT/drivers/scsi/megaraid/*.o $OUT/before/

Then I patch and build a modified target, saving the output in “after”:

$ vi the/source/code.c $ make -jN $KBF O=$OUT drivers/scsi/megaraid/ $ mkdir -p $OUT/after $ cp $OUT/drivers/scsi/megaraid/*.o $OUT/after/

And then run diffoscope:

$ diffoscope $OUT/before/ $OUT/after/

If diffoscope output reports nothing, then we’re done. 🥳

Usually, though, when source lines move around other stuff will shift too (e.g. WARN macros rely on line numbers, so the bug table may change contents a bit, etc), and diffoscope output will look noisy. To examine just the executable code, the command that diffoscope used is reported in the output, and we can run it directly, but with possibly shifted line numbers not reported. i.e. running objdump without --line-numbers:

$ ARGS="--disassemble --demangle --reloc --no-show-raw-insn --section=.text" $ for i in $(cd $OUT/before && echo *.o); do echo $i diff -u <(objdump $ARGS $OUT/before/$i | sed "0,/^Disassembly/d") \ <(objdump $ARGS $OUT/after/$i | sed "0,/^Disassembly/d") done

If I see an unexpected difference, for example:

- c120: movq $0x0,0x800(%rbx) + c120: movq $0x0,0x7f8(%rbx)

Then I'll search for the pattern with line numbers added to the objdump output:

$ vi <(objdump --line-numbers $ARGS $OUT/after/megaraid_sas_fp.o)

I'd search for "0x0,0x7f8", find the source file and line number above it, open that source file at that position, and look to see where something was being miscalculated:

$ vi drivers/scsi/megaraid/megaraid_sas_fp.c +329

Once tracked down, I'd start over at the "patch and build a modified target" step above, repeating until there were no differences. For example, in the starting example, I'd also need to make this change:

- size_t bytes = sizeof(*instance) + sizeof(u32) * (count - 1); + size_t bytes = sizeof(*instance) + sizeof(u32) * count;

Though, as hinted earlier, better yet would be:

- size_t bytes = sizeof(*instance) + sizeof(u32) * (count - 1); + size_t bytes = struct_size(instance, data, count);

But sometimes adding the helper usage will add binary output differences since they're performing overflow checking that might saturate at SIZE_MAX. To help with patch clarity, those changes can be done separately from fixing the array declaration.

© 2022, Kees Cook. This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 License.

[$] NFS: the new millennium

3 év 1 hónap óta
The network filesystem (NFS) protocol has been with us for nearly 40 years. While defined initially as a stateless protocol, NFS implementations have always had to manage state, and that need has been increasingly built into the protocol over successive revisions. The early days of NFS were discussed, with a focus on state management, in the first part of this series. This article completes the job with a look at the evolution of NFS since, approximately, the beginning of this millennium.
corbet

Security updates for Friday

3 év 1 hónap óta
Security updates have been issued by Fedora (ntfs-3g and ntfs-3g-system-compression), SUSE (389-ds, chafa, containerd, mariadb, php74, python3, salt, and xen), and Ubuntu (apache2).
jake

DeVault: GitHub Copilot and open source laundering

3 év 1 hónap óta
Drew DeVault takes issue with GitHub's "Copilot" offering and the licensing issues that it raises:

GitHub’s Copilot is trained on software governed by these terms, and it fails to uphold them, and enables customers to accidentally fail to uphold these terms themselves. Some argue about the risks of a “copyleft surprise”, wherein someone incorporates a GPL licensed work into their product and is surprised to find that they are obligated to release their product under the terms of the GPL as well. Copilot institutionalizes this risk and any user who wishes to use it to develop non-free software would be well-advised not to do so, else they may find themselves legally liable to uphold these terms, perhaps ultimately being required to release their works under the terms of a license which is undesirable for their goals.

Chances are that many people will disagree with DeVault's reasoning, but this is an issue that merits some discussion still.

corbet

[$] Whatever happened to SHA-256 support in Git?

3 év 1 hónap óta
The news has been proclaimed loudly and often: the SHA-1 hash algorithm is terminally broken and should not be used in any situation where security matters. Among other things, this news gave some impetus to the longstanding effort to support a more robust hash algorithm in the Git source-code management system. As time has passed, though, that work seems to have slowed to a stop, leaving some users wondering when, if ever, Git will support a hash algorithm other than SHA-1.
corbet

Security updates for Thursday

3 év 1 hónap óta
Security updates have been issued by Debian (chromium, firejail, and request-tracker4), Fedora (ghex, golang-github-emicklei-restful, and openssl1.1), Oracle (postgresql), Scientific Linux (postgresql), Slackware (openssl), SUSE (salt and tor), and Ubuntu (apache2 and squid, squid3).
jake

Wielaard: Sourceware – GNU Toolchain Infrastructure roadmap

3 év 1 hónap óta
Mark Wielaard writes about improvements at Sourceware, the site that holds the repository for many projects in the GNU toolchain and beyond.

Although email based git workflows are great for real patch discussions, they do not always make tracking the state of patches easy. Just like our other services, such as bugzilla, mailinglists and git repos, we like to provide zero maintenance infrastructure for tracking and automation of patches and testing. So we are trying to consolidate around a shared buildbot for (test) automation and patchwork for tracking the state of contributions.

corbet