The ‘Historic’ Linux 5.10 Ditches Decades-Old Persistent Bug Once And For All

Linux 5.10 removes set_fs()

No software comes without flaws. But this particular flaw on Linux has been around for decades, persistently haunting the kernel.

But with the first release candidate of version 5.10, the Linux kernel finally fixed the bug. The version was labeled by Linux creator and principal developer Linus Torvalds, as a a historic change to the kernel

According to Torvalds, the version of the Linux simply removes an addressing tool called the set_fs() that allowed the Linux kernel to override address spaces, which was a handy thing to do with Intel’s 286 and 386 CPUs.

Torvalds wrote that the set_fs() “goes back to pretty much the original release of Linux”, and this sort of memory space override has been eliminated from the x86, powerpc, s390 and RISC-V architectures.

As Torvalds explained, the tool that Linux finally removed, controlled “whether a userspace copy actually goes to user space or kernel space”.

"It was there (as set_fs) in 0.10, and may even predate that. But sadly, I don't have tar-balls for 0.02 and 0.03, so can't check," wrote Torvalds.

But the tool comes with an annoying bug that has been persistent for more than a decade.

As was detailed in 2010 in CVE-2010-4258, it could be used to “overwrite arbitrary kernel memory locations, and gain privileges”.

Because it was persistent, chipmakers have moved away from trying to patch the bug, to improve memory management instead.

In the Linux kernel mailing list (LKML), Torvalds said that:

“It's (Linux 5.10) not a _huge_ change, but it's interesting.

“To most people that all shouldn't matter at all, and it's mainly a small historical footnote that 5.10 no longer relies on the whole set_fs() model.”

Linux 5.10 - LKML

Torvalds added that the Linux 5.10 "looks to be a bigger release than I expected, and while the merge window is smaller than the one for 5.8 was, it's not a *lot* smaller. And 5.8 was our biggest release ever.”

He noted that the version includes almost 14,000 commits from around 1,700 people.

“I'm not entirely sure whether this is just a general upward trend (we did seem to plateau for a while there), or just a fluke, or perhaps due to 5.9 dragging out an extra week. We will see, I guess.”

Besides the removal of the tool that has the persistent bug, Linux 5.1.0 also comes with the EXT4 file-system updates, as well as some other notable additions.

Then there are changes that include the end of support for PowerPC 601 CPUs, support for Nvidia’s Orin SOCs intended for use in self-driving cars and robots, better support for the graphics driver in the Broadcom CPU used in the Raspberry Pi 4 devices, revised Spectre mitigation for Arm CPUs, the usual accommodations for future CPUs and GPUs, virtualization tweaks and squashing the year 2038 bug.

Torvalds said that the rest of the release is “fairly normal.”

Published: 
26/10/2020