Linux creator Linus Torvalds has hailed the removal of defunct addressing function set_fs() in 5.10 which has featured in the kernel since its early days.
In his weekly kernel update, Torvalds said:
“The most interesting – to me – change here is Christoph’s setf_fs() removal (it got merged through Al Viro, as you can see in my mergelog below).
It’s not a _huge_ change, but it’s interesting because the whole model of set_fs() to specify whether a userspace copy actually goes to user space or kernel space goes back to pretty much the original release of Linux, and while the name is entirely historic (it hasn’t used the %fs segment register in a long time), the concept has remained. Until now.”
Set_fs() has been the source of various security problems over the years. Jonathan Corbet, a kernel contributor and editor of Linux news site LWN, published an article in 2017 titled ‘A farewell to set_fs()?’ in which he highlighted some of the aforementioned issues.
“Set_fs() is clearly the sort of interface that can easily create severe security bugs,” Corbet wrote. “It is also a tempting shortcut that tends to find its way into code of questionable quality such as out-of-tree drivers.”
The function has been part of Linux since around 1991 and enabled the kernel to override address spaces. In 2010, the National Institute of Standards and Technology detailed how it could be used to “overwrite arbitrary kernel memory locations and gain privileges”.
That particular bug was fixed in 2010 but set_fs() has continued to be a concern and many within the community have called for its removal for many years. However, there’s a lack of developers willing to do such deep infrastructural changes.
Other notable changes in the release include support for NVIDIA Orin SoCs designed for autonomous cars, improved support for the Broadcom BCM2711 chip used in the Raspberry Pi 4, support for upcoming Arm-based CPUs and GPUs, a fix for the ‘Year 2038 Problem’, virtualisation tweaks, and ending support for PowerPC 601 CPUs.
“This looks to be a bigger release than I expected, and while the merge window is smaller than the one for 5.8 was, it’s not a *lot* smaller. And 5.8 was our biggest release ever,” Torvalds wrote.
Linux 5.10 features around 14,000 commits from close to 1,700 people.
(Photo by Mohamed Nohassi on Unsplash)
