Brief items

Project Zero on Arm MTE

Google's Project Zero has spent some time studying the Arm memory tagging extension (MTE), support for which was merged into the 5.10 kernel, and posted the results:

Despite its limitations, MTE is still by far the most promising path forward for improving C/C++ software security in 2023. The ability of MTE to detect memory corruption exploitation at the first dangerous access provides a significant improvement in diagnostic and potential security effectiveness.

There is a separate section on weaknesses in the current kernel implementation of MTE support.

Comments (1 posted)

Exploiting the StackRot vulnerability

For those who are interested in the gory details of how the StackRot vulnerability works, Ruihan Li has posted a detailed writeup of the bug and how it can be exploited.

As StackRot is a Linux kernel vulnerability found in the memory management subsystem, it affects almost all kernel configurations and requires minimal capabilities to trigger. However, it should be noted that maple nodes are freed using RCU callbacks, delaying the actual memory deallocation until after the RCU grace period. Consequently, exploiting this vulnerability is considered challenging.

To the best of my knowledge, there are currently no publicly available exploits targeting use-after-free-by-RCU (UAFBR) bugs. This marks the first instance where UAFBR bugs have been proven to be exploitable, even without the presence of CONFIG_PREEMPT or CONFIG_SLAB_MERGE_DEFAULT settings.

Comments (none posted)

Kernel release status

The current development kernel is 6.5-rc4, released on July 30. Linus said:

So here we are, and the 6.5 release cycle continues to look entirely normal.

In fact, it's *so* normal that we have hit on a very particular (and peculiar) pattern with the rc4 releases: we have had *exactly* 328 non-merge commits in rc4 in 6.2, 6.3 and now 6.5. Weird coincidence.

And honestly, that weird numerological coincidence is just about the most interesting thing here.

Stable updates: 6.4.7, 6.1.42, 5.15.123, 5.10.188, and 5.4.251 were released on July 27.

The 6.4.8, 6.1.43, and 5.15.124 updates are in the review process; they are due on or after August 3.

Comments (none posted)

Quote of the week

I burned out years ago trying to juggle the roles senior developer, reviewer, tester, triager (crappily), release manager, and (at times) manager liaison. There's enough work here in this one subsystem for a team of 20 FT, but instead we're squeezed to half that. I thought if I could hold on just a bit longer I could help to maintain the focus on long term development to improve the experience for users. I was wrong.

Nowadays, people working on XFS seem to spend most of their time on distro kernel backports and dealing with AI-generated corner case bug reports that aren't user reports. Reviewing has become a nightmare of sifting through under-documented kernel code trying to decide if this new feature won't break all the other features. Getting reviews is an unpleasant process of negotiating with demands for further cleanups, trying to figure out if a review comment is based in experience or unfamiliarity, and wondering if the silence means anything.

— Darrick Wong bows out as XFS maintainer

Comments (1 posted)

Asahi Linux to become a Fedora remix

The Asahi Linux project, which is working to create a Linux distribution for Apple hardware, has announced that its new "flagship" distribution will be based on Fedora Linux.

Working directly with upstream means not only can we integrate more closely with the core distribution, but we can also get issues in other packages fixed quickly and smoothly. This is particularly important for platforms like desktop ARM64, where we still run into random app and package bugs quite often. ARM64 desktop Linux has been a niche platform (until now!), and with much less testing comes a higher propensity for bugs, so it’s very important that we can address these issues quickly. Fedora already has a very solid, fully supported ARM64 port with a large userbase in the server/headless segment, so it is an excellent base to build upon and help improve the state of desktop Linux on ARM64 for everyone.

There is a version for "adventurous users" to play with now, with an official release expected by the end of the month.

Comments (22 posted)

Hall: IBM, Red Hat and Free Software: An old maddog’s view

Here is a long reminiscence from Jon "maddog" Hall leading up to some thoughts on Red Hat's source-release policy changes.

Recently I have been seeing some cracks in the dike. As more and more users of FOSS come on board, they put more and more demands on developers whose numbers are not growing sufficiently fast enough to keep all the software working.

I hear from FOSS developers that too few, and sometimes no, developers are working on blocks of code. Of course this can also happen to closed-source code, but this shortness hits mostly in areas that are not considered “sexy”, such as quality assurance, release engineering, documentation and translations.

Comments (105 posted)

Distributions quotes of the week

People using Linux distributions have for years been in the fortunate position that companies with money were willing to fund a lot of painstaking work and then make the result available for free. One of the artifacts of this was free distributions with long support periods. My view is that this supply of corporate money is in the process of drying up, and with it will go that free long term support. This won't be a pleasant process.

— Chris Siebenmann

We've gone ahead and decided not to replace DNF with DNF05 in Fedora 39 and, perhaps notably, Fedora 40 as well. Fedora 41 is the safest option at the moment.

With a core system component like DNF, it's crucial that we provide a stable, complete, and thoroughly tested experience to everyone. In its current state, we would not be able to deliver that. With more time, we'll be able to regain our footing and do things properly. Furthermore, this team, which has worked tirelessly over these last several months especially, will be able to avoid burnout. This was not an easy decision to make, but it is the best decision for the team, for this project, and for Fedora.

— Samantha Bueno

Comments (none posted)

Emacs 29.1 released

Version 29.1 of the Emacs editor has been released. There is a long list of changes, including integration with the Tree-sitter incremental parsing library, the ability to access SQLite databases, "pure GTK" display support (which enables Wayland support), and a lot more; see the NEWS file for all the details.

Full Story (comments: 47)

GNU C Library 2.38 released

Version 2.38 of the GNU C Library has been released. This release consists mostly of relatively small changes, including improved support for working with binary integer constants, some new printf() formatting options, libmvec support for 64-bit Arm systems, the strlcpy() and strlcat() string functions, and more. See the release notes for the details.

Comments (6 posted)

GnuCOBOL 3.2 released

Version 3.2 of the GNU COBOL compiler is out. "The amount of features are too much to note, but you can skip over the attached NEWS file to investigate them." These new features include improved support for COBOL dialects, performance improvements, better GDB debugging support, and more.

Full Story (comments: 4)

No-GIL mode coming for Python

The Python Steering Council has announced its intent to accept PEP 703 (Making the Global Interpreter Lock Optional in CPython), with initial support possibly showing up in the 3.13 release. There are still some details to work out, though.

We want to be very careful with backward compatibility. We do not want another Python 3 situation, so any changes in third-party code needed to accommodate no-GIL builds should just work in with-GIL builds (although backward compatibility with older Python versions will still need to be addressed). This is not Python 4. We are still considering the requirements we want to place on ABI compatibility and other details for the two builds and the effect on backward compatibility.

Comments (29 posted)

Systemd 254 released

Systemd 254 has been released. As usual, there is a long list of changes, including a new list-paths command for systemctl, the ability to send POSIX signals to services, a "soft reboot" feature that restarts user space while leaving the kernel in place, improved support for "confidential virtual machines", and a lot more.

The announcement also notes the support for split-/usr systems will be removed in the next release, and support for version-one control groups and for System V service scripts will be deleted in the near future as well.

Full Story (comments: 95)