Linux 5.10 终于抛弃了造成了安全隐患的老函数
Linux 内核

> 
> 多年来，set\_fs() 一直是众所周知的麻烦，现在它终于消失了。
> 
> 
> 


![](/data/attachment/album/202010/27/215001zpsdddd3gs72s227.jpg)


Linus Torvalds 开启了 Linux 内核的又一个开发周期，宣布 5.10-rc1 发布了，而且这一次还有一个历史性的转折：新内核标志着一个几十年前的函数的落幕，这个函数在被发现会导致安全漏洞后早已成为多余的函数。


随着长达两周的，每一次新的 Linux 内核迭代发布前的合并窗口的关闭，Torvalds 在 Linux 内核邮件列表上分享了他的感想，他认为“事情似乎相当顺利”。


“合并窗口”是 Linux 新内核发布过程中的一个关键部分，在此窗口期间，每天有多达 1000 个由开发者社区提交的补丁被合并到 Torvalds 管理的主线仓库中。而审查过程会确保每个补丁都能实现理想的变化。


这一次，Torvalds 提请大家注意移除了一个叫 `set_fs()` 的寻址函数，这个函数可以追溯到 Linux 的最初版本。“对我来说，这是最有趣的变化，`set_fs()` 被移除了，”他写道，“这不是一个巨大的变化，但很有趣，因为 `set_fs()` 指定用户空间副本是否真正进入用户空间或内核空间的这个模式，几乎可以追溯到 Linux 的最初版本。”


正如 Torvalds 所解释的那样，`set_fs()` 函数可以通过取消用户空间和内核空间之间的分界来覆盖地址空间。该函数在管理英特尔早期 x86 处理器时被广泛使用，以控制非特权代码可以访问的虚拟地址范围。


然而，2010 年，“[常见漏洞和暴露](Common%20Vulnerabilities and Exposures)”（CVE）详细披露了 `set_fs()` 带来的安全问题。通过绕过某些访问限制，证实该函数能够“覆盖任意内核内存位置”和“获得特权” —— 在某些情况下，这可以让用户空间覆盖内核数据。


鉴于该工具的安全缺陷，包括 x86、PowerPC、s390 和 RISC-V 在内的一些架构已经取消了地址空间覆盖功能。但是，正如 Torvalds 写道：“我们仍然留着 `set_fs()`，因为并不是每个架构都已经转换为新的世界秩序。”


除了这个久违的历史补救之外，5.10-rc1 版本和大多数内核版本一样，还伴随着无数的变化。Torvalds 统计了近 1700 人的近 1.4 万次提交，改动范围从支持自动驾驶汽车和机器人的 Nvidia SOC 芯片到支持任天堂 Switch 控制器。


统计结果表明。大约新增了 70.4 万行代码和删除了 41.9 万行代码，这使得 5.10-rc1 的大小与 Linux 有史以来最大的内核 5.8 相当。“这看起来是一个比我预期的更大的版本，虽然合并窗口比 5.8 的窗口小，但也小不了多少，”Torvalds 说，“而 5.8 是我们有史以来最大的版本。”


按照 Linux 典型的时间表，5.10-rc1 之后将有几个星期时间来提交修复问题的补丁，在预计 12 月发布稳定内核之前，将发布几个候选版本。




---


via: <https://www.zdnet.com/article/linux-5-10-finally-ditches-decades-old-tool-that-caused-security-bugs/> 


作者：[Daphne Leprince-ringuet](https://www.zdnet.com/meet-the-team/uk/daphne+leprince-ringuet/) 译者：[wxy](https://github.com/wxy) 校对：[wxy](https://github.com/wxy)


本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出


OK
# Linux 5.10 finally ditches decades-old tool that caused security bugs

![headshot-daphne-leprince.jpg](https://www.zdnet.com/a/img/resize/02471794e2b1562c20cb7af46bb5452a964898f3/2019/10/02/0eff5eb4-57a8-4543-a0d1-b2d34f0c1c3e/headshot-daphne-leprince.jpg?auto=webp&fit=crop&frame=1&height=192&width=192)

Linus Torvalds has kicked off yet another development cycle for the Linux kernel, announcing the release of 5.10-rc1, and this time with an historical twist. The new version of the kernel effectively marks the end of a decade-old feature that has long been made redundant after it was found to cause security bugs.

With the closing of the two-week-long merge window, which precedes the release of every new iteration of the Linux kernel, Torvalds shared his reflections [on the Linux kernel mailing list](http://lkml.iu.edu/hypermail/linux/kernel/2010.3/00552.html), maintaining that "things seem to have gone fairly smoothly".

### Linux

The merging window is a key part of any new kernel release process, during which up to 1,000 patches submitted by the developer community are merged every day into the mainline repository managed by Torvalds. A review process ensures that each patch implements a desirable change.

**SEE: ****Diversity and Inclusion policy**** (TechRepublic Premium)**

This time around, Torvalds drew attention to the removal of an addressing tool, called set_fs(), which goes back to the original release of Linux. "The most interesting -- to me -- change here is Christoph's set_fs() removal," he wrote. "It's not a huge change, but it's interesting because the whole model of set_fs() to specify whether a userspace copy actually goes to user space or kernel space goes back to pretty much the original release of Linux."

As Torvalds explained, the set_fs() function could be used to override address spaces, by nullifying the split between user space and kernel space. The tool was widely used when managing Intel's early x86 processors, to control the range of virtual addresses that could be accessed by unprivileged code.

However, in 2010 the Common Vulnerabilities and Exposures (CVE) dictionary [detailed the security issues](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4258) posed by set_fs(). By bypassing certain access restrictions, the function was shown to be able to "overwrite arbitrary kernel memory locations" and "gain privileges" -- in some cases, to let user space overwrite kernel data.

Given the security shortcomings of the tool, some architectures including x86, powerpc, s390 and RISC-V have already removed address space overrides. But, as Torvalds wrote: "We still do have 'set_fs()' around, and not every architecture has been converted to the new world order."

On top of this long-overdue historical remediation, the 5.10-rc1 version, like most kernel releases, comes with innumerably more changes. Torvalds counted almost 14,000 commits by close to 1,700 people, with changes that range from support for Nvidia's SOCs for self-driving cars and robots to Nintendo Switch controller support.

**SEE: ****Windows 10: This is what your new 'Meet Now' taskbar button does, explains Microsoft**

Reports have [counted](https://www.phoronix.com/scan.php?page=news_item&px=Linux-5.10-rc1-Released) around 704,000 lines of new code and 419,000 lines deleted, making 5.10-rc1 comparable in size to Linux's biggest kernel ever -- 5.8. "This looks to be a bigger release than I expected, and while the merge window is smaller than the one for 5.8 was, it's not a lot smaller," said Torvalds. "And 5.8 was our biggest release ever."

As per Linux's typical schedule, 5.10-rc1 will be followed by several weeks' worth of problem-fixing patches, with several candidate versions to be released before the stable kernel release expected in December.

[Editorial standards](/editorial-guidelines/)