Post Syndicated from corbet original https://lwn.net/Articles/948894/

The LWN.net Weekly Edition for November 2, 2023 is available.

Post Syndicated from corbet original https://lwn.net/Articles/949461/

LWN.net is looking to hire a full-time writer/editor to help us keep the
news flowing and to expand our content in areas of interest to our readers.
We are certain that the person we need is out there somewhere, and are
counting on help from LWN readers to find them. Read on for details on who
we are looking for and how we see them fitting in here.

Post Syndicated from corbet original https://lwn.net/Articles/949647/

LWN editor Jonathan Corbet was asked to give a brief talk about kernel
maintainership at the recently concluded Linux
Foundation Member Summit. That talk was recorded and has now been made available
on YouTube. There is little in it that will be news to regular LWN
readers, but it may be instructive to folks who are less well versed in how
kernel development works.

Post Syndicated from corbet original https://lwn.net/Articles/949625/

Matthew Garrett explains
why ACPI exists and why it is not as bad a thing as some think.

There’s an alternative universe where we decided to teach the
kernel about every piece of hardware it should run on. Fortunately
(or, well, unfortunately) we’ve seen that in the ARM world. Most
device-specific simply never reaches mainline, and most users are
stuck running ancient kernels as a result. Imagine every x86 device
vendor shipping their own kernel optimised for their hardware, and
now imagine how well that works out given the quality of their
firmware. Does that really seem better to you?

Post Syndicated from corbet original https://lwn.net/Articles/949612/

Security updates have been issued by Debian (h2o, open-vm-tools, pmix, and zookeeper), Gentoo (GitPython), Oracle (firefox, java-11-openjdk, java-17-openjdk, libguestfs-winsupport, nginx:1.22, and thunderbird), Red Hat (samba), SUSE (container-suseconnect, libsndfile, and slurm), and Ubuntu (krb5, linux, linux-aws, linux-aws-5.15, linux-azure, linux-azure-5.15,
linux-azure-fde, linux-azure-fde-5.15, linux-gcp, linux-gcp-5.15,
linux-gkeop, linux-gkeop-5.15, linux-hwe-5.15, linux-ibm, linux-ibm-5.15,
linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-nvidia,
linux-oracle, linux-oracle-5.15, linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4,
linux-bluefield, linux-gcp, linux-gcp-5.4, linux-gkeop, linux-hwe-5.4,
linux-ibm, linux-ibm-5.4, linux-kvm, linux-oracle, linux-oracle-5.4,
linux-raspi, linux-raspi-5.4, linux-xilinx-zynqmp, linux, linux-aws, linux-aws-6.2, linux-azure, linux-azure-6.2,
linux-azure-fde-6.2, linux-gcp, linux-gcp-6.2, linux-hwe-6.2, linux-kvm,
linux-lowlatency, linux-lowlatency-hwe-6.2, linux-oracle, linux-raspi,
linux-starfive, linux-laptop, linux-nvidia-6.2, linux-oem-6.1, linux-raspi, open-vm-tools, and xorg-server).

Post Syndicated from corbet original https://lwn.net/Articles/949411/

Version
0.2 of Incus, an LXD fork, has been released. “This version
incorporates most changes that went into LXD 5.19 as well as introduce a
few additional features and improvements.” Changes include NVME
storage support, support for migrating clustered environments from LXD, and
more.

Post Syndicated from corbet original https://lwn.net/Articles/949391/

Security updates have been issued by Debian (jetty9, node-browserify-sign, request-tracker4, and request-tracker5), Fedora (golang-github-altree-bigfloat, golang-github-seancfoley-bintree, golang-github-seancfoley-ipaddress, kitty, slurm, and thunderbird), Gentoo (ConnMan, libxslt, and Salt), Mageia (chromium-browser-stable), Red Hat (firefox, libguestfs-winsupport, and thunderbird), SUSE (clamav, gcc13, gstreamer-plugins-bad, icu73_2, java-17-openjdk, nodejs10, poppler, python-Werkzeug, redis, thunderbird, webkit2gtk3, xorg-x11-server, and xwayland), and Ubuntu (kernel, linux-aws, linux-azure, linux-gcp, linux-oracle, linux-raspi, linux-iot, linux-raspi, linux-raspi-5.4, and mysql-8.0).

Post Syndicated from corbet original https://lwn.net/Articles/949269/

The New Stack covers
a conference talk by Bjarne Stroustrup on turning C++ into a safer
language.

Stroustrup has arrived at his solution: profiles. (That is, a set
of rules which, when followed, achieve specific safety guarantees.)
They’d be defined by the ISO C++ standard, addressing common safety
issues like pointers and array ranges. In response to a later
question from the audience about the difficulty of adding new
tooling, Stroustrup pointed out that the C++ compiler itself is now
a pretty sophisticated static analyzer, and could also be tasked
with meeting the profile’s requirements.

Post Syndicated from corbet original https://lwn.net/Articles/948970/

The 6.6 kernel was released,
right on schedule, on October 29. This development cycle saw the
addition of 14,069 non-merge changesets from 1,978 developers — fairly
typical numbers for recent releases. The time has come for LWN’s
traditional look at where the changes in this release came from, along with
a look at the longer development “supercycle” that (probably) ends with
6.6.

Post Syndicated from corbet original https://lwn.net/Articles/949179/

Linus has released the 6.6 kernel. “So
this last week has been pretty calm, and I have absolutely no excuses to
delay the v6.6 release any more, so here it is.”

Headline features in 6.6 include the earliest
eligible virtual deadline first (EEVDF) CPU scheduler, a number of
enhancements (quota support, user extended attributes, direct I/O) to the
tmpfs filesystem, the fchmodat2()
system call, initial support for building a
kernel without buffer-head support, the kmalloc() randomness patches, user-space shadow stacks for Intel CPUs, and
quite a bit more. See the LWN merge window summaries (part 1, part 2) and the KernelNewbies 6.6 page for
more information.

Post Syndicated from corbet original https://lwn.net/Articles/948870/

User-space developers working with highly threaded applications would often
like to be able to use spinlocks to protect shared data structures from
concurrent access. There is a fundamental problem with user-space
spinlocks, though: there is no way to prevent a thread from being
preempted. Various ways of working around this problem have been explored,
but this
patch from Steven Rostedt questions the premise on which much of that
work is based: what if it were possible to prevent preemption, for a
short period at least?

Post Syndicated from corbet original https://lwn.net/Articles/949078/

For a view into the OpenBSD approach to security, see this message from
Theo de Raadt, where he describes a plan to remove the syscall() system call
(which allows the invocation of any available system call by providing its
number) from the kernel. The purpose, of course, is to make it harder for
an attacker to invoke an arbitrary system call, even if they are able to
run some code on the target system.

I hope I am forcing attack coders into using increasingly more
complicated methods. Same time, it means fewer methods are
available. Other methods make exploitation more fragile. This is
pushing success rates into “low-percent statistical” success. If
we teach more software stacks to “fail hard, don’t try to
recover”, that is an improvement in security.

Post Syndicated from corbet original https://lwn.net/Articles/949057/

Security updates have been issued by Debian (chromium and firefox-esr), Fedora (firefox, redis, samba, and xen), Oracle (python39:3.9, python39-devel:3.9), Slackware (mozilla and xorg), and SUSE (libnbd, open-vm-tools, python, sox, vorbis-tools, and zchunk).

Post Syndicated from corbet original https://lwn.net/Articles/948408/

The C programming language is replete with features that seemed like a good
idea at the time (and perhaps even were good ideas then) that have not aged
well. Most would likely agree that string handling, and the use of
NUL-terminated strings, is one of those. Kernel developers have, for
years, tried to improve the handling of strings in an attempt to slow the
flow of bugs and vulnerabilities that result from mistakes in that area.
Now there is an early discussion on the idea of moving away from
NUL-terminated strings in much of the kernel.

Post Syndicated from corbet original https://lwn.net/Articles/948930/

Security updates have been issued by Debian (firefox-esr and xorg-server), Fedora (firefox, mbedtls, nodejs18, nodejs20, and xen), Gentoo (libinput, unifi, and USBView), Mageia (python-nltk), Oracle (linux-firmware), Red Hat (nginx:1.22), SUSE (chromium, firefox, java-11-openjdk, jetty-minimal, nghttp2, nodejs18, webkit2gtk3, and zlib), and Ubuntu (linux, linux-lowlatency, linux-oracle-5.15, vim, and xorg-server, xwayland).

Post Syndicated from corbet original https://lwn.net/Articles/948210/

The LWN.net Weekly Edition for October 26, 2023 is available.

Post Syndicated from corbet original https://lwn.net/Articles/948037/

The kernel has, for many years, had the ability to control how memory
allocation is performed in systems with multiple NUMA nodes. More
recently, NUMA nodes have also been pressed into service to represent
different classes of memory; those nodes are now organized into tiers
according to their performance characteristics. While memory-allocation
policies can control the placement of pages at the NUMA-node level, the
kernel provides no way to connect those policies with memory tiers. This
patch series from Gregory Price aims to change this situation by
allowing allocations to be placed across tiers in a weighted manner.

Post Syndicated from corbet original https://lwn.net/Articles/948823/

The Python Steering Council has posted a
detailed plan for the addition of “free-threaded” (no global
interpreter lock) support into the Python mainline. It will not be a short
process and does not have a guaranteed successful outcome.

Phase I: Experimental phase, which can start immediately, in which
the free-threaded build is enabled through a build-time
option. This should not be the default install anywhere. At least
one major Python release should include this experimental
free-threaded build, to allow third-party packages to test and do
their own experimentation. In this stage we should make it clear
the build is experimental, not supported for “production use”, and
may be reverted.

Post Syndicated from corbet original https://lwn.net/Articles/948815/

The
6.5.9,
6.1.60,
5.15.137,
5.10.199,
5.4.259,
4.19.297, and
4.14.328
stable kernels have all been released; each contains another set of
important fixes.

Post Syndicated from corbet original https://lwn.net/Articles/948814/

Security updates have been issued by Debian (gst-plugins-bad1.0, openssl, roundcube, and xorg-server), Fedora (dotnet6.0, dotnet7.0, roundcubemail, and wordpress), Mageia (redis), Oracle (dnsmasq, python27:2.7, python3, tomcat, and varnish), Red Hat (python39:3.9, python39-devel:3.9), Slackware (mozilla and vim), SUSE (openssl-3, poppler, ruby2.5, and xen), and Ubuntu (.Net, linux-gcp-5.15, linux-gkeop-5.15, linux-intel-iotg-5.15, linux-starfive-6.2, mysql-5.7, ncurses, and openssl).