The 5.6 kernel has been released
Linus has released the 5.6 kernel.
Some of the headline
features in this release include Arm EOPD support, time namespaces, the BPF
dispatcher and batched BPF map operations (both described in this article), the
openat2() system call, the WireGuard virtual private network implementation, the
flow queue PIE packet scheduler, nearly complete year-2038 support, many new
io_uring features, the pidfd_getfd() system call, the ZoneFS filesystem, the
ability to implement TCP congestion-control algorithms in BPF, the dma-buf heaps
subsystem, and the removal of the /dev/random blocking pool.
See the LWN
merge-window summaries (part 1 and part 2) and the (under
construction) KernelNewbies 5.6 page for more details.
[$] Per-system-call kernel-stack offset randomization
In recent years, the kernel has (finally) upped its game
when it comes to hardening. It is rather harder to compromise a running kernel
than it used to be. But "rather harder" is relative: attackers still manage to
find ways to exploit kernel bugs. One piece of information that can be helpful
to attackers is the location of the kernel stack; this patch set from Kees Cook
and Elena Reshetova may soon make that information harder to come by and nearly
useless in any case.
Security updates for Friday
Security updates have been issued by Debian (bluez and
php5), Fedora (chromium, kernel, and PyYAML), Gentoo (adobe-flash, libvpx, php,
qtcore, and unzip), openSUSE (chromium, kernel, and mcpp), Oracle (ipmitool and
libvncserver), Red Hat (ipmitool and rh-postgresql10-postgresql), Slackware
(kernel), and SUSE (ldns and tomcat6).
Malcolm: Static analysis in GCC 10
David Malcolm writes about the static-analysis features
that he is working on adding to the GCC compiler. "This issue is, of course, a
huge problem to tackle. For this release, I’ve focused on the kinds of problems
seen in C code—and, in particular double-free bugs—but with a view toward
creating a framework that we can expand on in subsequent releases (when we can
add more checks and support languages other than C)."
[$] Avoiding retpolines with static calls
January 2018 was a sad time in the kernel community. The
Meltdown and Spectre vulnerabilities had finally been disclosed, and the
required workarounds hurt kernel performance in a number of ways. One of those
workarounds — retpolines — continues to cause pain, with developers going out of
their way to avoid indirect calls, since they must now be implemented with
retpolines. In some cases, though, there may be a way to avoid retpolines and
regain much of the lost performance; after a long gestation period, the "static
calls" mechanism may finally be nearing the point where it can be merged
upstream.
