lwn.net

"Retbleed" is the name given to a class of speculative-execution vulnerabilities involving return instructions. Mitigations for Retbleed have found their way into the mainline kernel but, as of this writing, some remaining problems have kept them from the stable update releases. Mitigating Retbleed can impede performance severely, especially on some Intel processors. Thomas Gleixner and Peter Zijlstra think they have found a better way that bypasses the existing mitigations and misleads the processor's speculative-execution mechanisms instead.

Security updates have been issued by Fedora (gnupg2, oci-seccomp-bpf-hook, suricata, and vim), Oracle (java-11-openjdk), Slackware (net), and SUSE (kernel, nodejs16, rubygem-rack, and webkit2gtk3).

The 5.15.56, 5.10.132, 5.4.207, 4.19.253, 4.14,289, and 4.9.324 stable kernels have been released. The 5.18.13 stable kernel has been delayed due to some problems found during review; 5.18.13-rc3 is out for review and is due on July 23. Note that none of these kernels has mitigations for the Retbleed vulnerabilities; those are still in the works for the stable kernels.

The intersection of free software and trademark law has not always been smooth. Free-software licenses have little to say about trademarks but, sometimes, trademark licenses can appear to take away some of the freedoms that free-software licenses grant. The Firefox browser has often been the focal point for trademark-related controversy; happily, those problems appear to be in the past now. Instead, the increasing popularity of the Rust language is drawing attention to its trademark policies.

Security updates have been issued by Mageia (kernel and kernel-linus), SUSE (dovecot23), and Ubuntu (freetype, libxml-security-java, and linux-oem-5.17).

The LWN.net Weekly Edition for July 21, 2022 is available.

It was not all that long ago that Python began its experiment with replacing one of its mailing lists with a forum on its Discourse discussion site. Over time, the Discourse instance has become more and more popular within the Python community. It would seem that another mailing list will soon be subsumed within Discourse as the Python steering council is planning to effectively retire the venerable python-dev mailing list soon.

Martin Heinz encourages Python developers to move on to a number of newer modules.

Using os.urandom isn't actually the problem here though, the reason the secrets module got introduced is because people were using the random module for generating passwords and such, even though the random module doesn't produce cryptographically safe tokens.

Security updates have been issued by Fedora (golang-github-gosexy-gettext, golang-github-hub, oci-seccomp-bpf-hook, and popub), Oracle (kernel and kernel-container), SUSE (python2-numpy), and Ubuntu (check-mk and pyjwt).

Google has released Cirq 1.0 for developers working with leading-edge computers:

Cirq is a Python framework for writing, running, and analyzing the results of quantum computer programs. It was designed for near-term quantum computers, those with a few hundred qubits and few thousands of quantum gates. The significance of the 1.0 release is that Cirq has support for the vast majority of workflows for these systems and is considered to be a stable API that we will only update with breaking changes at major version numbers.

It is not uncommon for users to want to run a program targeted to one operating system on another type of system. With the increasing prevalence of smartphones, Android has become the world's most widely used operating system. So users may want to run Android apps on Linux systems in order to get access to a game or other app that is not available in a Linux version or to develop mobile apps on their desktop system. The Waydroid project provides a way to run those apps on Linux, which means they can run on a variety of devices, including Linux-based smartphones like the PinePhone.

From Berkeley comes the sad news of the passing of Tom Lord, a longtime free-software developer and the original author of GNU arch. He will be missed.

Security updates have been issued by Fedora (buildah), SUSE (dovecot23 and nodejs12), and Ubuntu (harfbuzz, libhttp-daemon-perl, tiff, and webkit2gtk).

The Ubuntu 21.10 ("Impish Indri") release is no longer supported as of July 14; users who are on that version will want to look into upgrading soon.

This is a follow-up to the End of Life warning sent earlier to confirm that as of July 14, 2022, Ubuntu 21.10 is no longer supported. No more package updates will be accepted to 21.10, and it will be archived to old-releases.ubuntu.com in the coming weeks.

One of the key selling points of the BPF subsystem is that loading a BPF program is safe: the BPF verifier ensures that the program cannot hurt the kernel before allowing the load to occur. That guarantee is perhaps losing some of its force as more capabilities are made available to BPF programs but, even so, it may be a bit surprising to see this proposal from Artem Savkov adding a BPF helper that is explicitly designed to crash the system. If this patch set is merged in something resembling its current form, it will be the harbinger of a new era where BPF programs are, in some situations at least, allowed to be overtly destructive.

Ariadne Conill explores ways to make the Unix cat utility more efficient on Linux.

The first possible option is the venerable sendfile syscall, which was originally added to improve the file serving performance of web servers. Originally, sendfile required the destination file descriptor to be a socket, but this restriction was removed in Linux 2.6.33. Unfortunately, sendfile is not perfect: because it only supports file descriptors which can be memory mapped, we must use a different strategy when using copying from stdin.

Security updates have been issued by Debian (mat2 and xen), Fedora (butane, caddy, clash, direnv, geoipupdate, gitjacker, golang-bug-serial-1, golang-github-a8m-envsubst, golang-github-apache-beam-2, golang-github-aws-lambda, golang-github-cespare-xxhash, golang-github-chromedp, golang-github-cloudflare, golang-github-cloudflare-redoctober, golang-github-cockroachdb-pebble, golang-github-cucumber-godog, golang-github-dreamacro-shadowsocks2, golang-github-dustinkirkland-petname, golang-github-etcd-io-gofail, golang-github-facebookincubator-contest, golang-github-facebookincubator-dhcplb, golang-github-facebookincubator-go2chef, golang-github-facebookincubator-ntp, golang-github-facebookincubator-nvdtools, golang-github-goccy-yaml, golang-github-gojuno-minimock, golang-github-google-wire, golang-github-hexdigest-gowrap, golang-github-intel-goresctrl, golang-github-j-keck-arping, golang-github-jamesclonk-vultr, golang-github-liamg-scout, golang-github-liamg-tml, golang-github-mattn-colorable, golang-github-mdlayher-ethernet, golang-github-moby-buildkit, golang-github-mock, golang-github-niklasfasching-org, golang-github-nxadm-tail, golang-github-path-network-mmproxy, golang-github-rakyll-statik, golang-github-shopify-toxiproxy, golang-github-shulhan-bindata, golang-github-skynetservices-skydns, golang-github-sophaskins-efs2tar, golang-github-spf13-cobra, golang-github-spyzhov-ajson, golang-github-task, golang-github-temoto-robotstxt, golang-github-theoapp-theo-agent, golang-github-tinylib-msgp, golang-github-tklauser-numcpus, golang-github-valyala-fasthttp, golang-google-protobuf, golang-honnef-tools, golang-k8s-kube-openapi, golang-k8s-pod-security-admission, golang-k8s-sample-cli-plugin, golang-mvdan-sh-3, golang-storj-drpc, golang-x-tools, gopass, harfbuzz, hcloud, manifest-tool, moby-engine, mqttcli, nex, php-laminas-diactoros2, podman-tui, seamonkey, snapd, tinygo, vgrep, vultr, vultr-cli, weldr-client, xen, and yubihsm-connector), Mageia (golang and java), Oracle (grub2, kernel, kernel-container, and squid), and SUSE (crash, kernel, nodejs12, nodejs14, and nodejs16).

The 5.19-rc7 kernel prepatch is out for testing.

We obviously had that whole "Retbleed" thing, and it does show up in both the diffstat and the shortlog, and rc7 is definitely bigger than usual. And also as usual, when we've had one of those embargoed hw issues pending, the patches didn't get the open development, and then as a result missed all the usual sanity checking by all the automation build and test infrastructure we have. So no surprise - there's been various small fixup patches afterwards too for some corner cases.

That said, last week there were two other development trees that independently also asked for an extension, so 5.19 will be one of those releases that have an additional rc8 next weekend before the final release.

A page-table entry (PTE) is relatively small, requiring just eight bytes to refer to a 4096-byte page on most systems. It thus does not seem like a worrisome level of overhead, and little effort has been made over the kernel's history to reduce page-table memory consumption. Those eight bytes can hurt, though, if they are replicated across a sufficiently large set of processes. The msharefs patch set from Khalid Aziz is a revised attempt to address that problem, but it is proving to be a hard sell in the memory-management community.

Security updates have been issued by Debian (webkit2gtk and wpewebkit), Fedora (curl, kernel, openssl1.1, php, subversion, xorg-x11-server, and xorg-x11-server-Xwayland), Oracle (grub2), SUSE (gnutls, kernel, logrotate, oracleasm, p11-kit, and python-PyJWT), and Ubuntu (libhttp-daemon-perl and python2.7, python3.10, python3.4, python3.5, python3.6, python3.8, python3.9).