Linux 6.5-rc6 Released With Latest CPU Security Mitigations & Bug Fixes

[phoronix]

Phoronix: Linux 6.5-rc6 Released With Latest CPU Security Mitigations & Bug Fixes

Linus Torvalds released the Linux 6.5-rc6 kernel a few hours early today after capping off a busy week...

https://www.phoronix.com/news/Linux-6.5-rc6

[fitzie]

the bcachefs drama will not end ever it seems. on an interesting note Kent mentions that he intends to move bcachefs to rust at some point in the future. He goes into the reasons why here:

https://lore.kernel.org/linux-bcachefs/[email protected]/

[gavron]

The kernel shouldn't affect user-mode code. And yet, these fixes do. As of the mitigation fixes, kernels 6.4.9 and 6.4.10 don't allow the Signal app to work.

I know, you're wondering who I am and why I'm making these outlandish claims, and hey this is a 6.5-rcNEXT thread so why am I littering with other stuff. The answer is that if CONFIG_SPECULATION_MITIGATIONS=y then the built kernels at 6.4.9 (which have the backported fixes from 6.5-rcNEXT) cause Signal to throw an error. Here's what the CLI shows ... 6.4.8 being a good run with a warning.... and 6.4.9, 6.4.10 with =y set showing failure.

$ diff -U0 signal-desktop-6.4.8.log signal-desktop-6.4.10.log
--- signal-desktop-6.4.8.log 2023-08-11 13:47:37.371278092 -0700
+++ signal-desktop-6.4.10.log 2023-08-11 13:45:46.134110820 -0700
@@ -13,2 +13,5 @@
-(node:3844) [DEP0005] DeprecationWarning: Buffer() is deprecated due to security and usability issues. Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead.
-(Use `exe --trace-deprecation ...` to show where the warning was created)
+Render process is gone: Error: Reason: crashed, Exit Code: 132
+ at App.<anonymous> (/opt/Signal/resources/app.asar/app/global_errors.js:88:7)
+ at App.emit (node:events:525:35)
+ at WebContents.<anonymous> (node:electron/js2c/browser_init:2:89989)
+ at WebContents.emit (node:events:513:28)

Take out the mitigation=y and 6.4.10 (only tested there) works from the CLI ($ signal-desktop) but never pops a window up using the Gnome panel.

In summary:
6.4.8 and below: Signal works fine.
6.4.9,6.4.10 with CONFIG_SPECULATION_MITIGATIONS=y signal will die a JS error death
6.4.10 with CONFIG_SPECULATION_MITIGATIONS=n signal won't work from the Gnome panel but will work from CLI (and recognize it's #2 and display instantly).
Choosing kernel 6.4.8 after all that and full functionality is restored

So, the change in the kernel should not affect user-mode code. And yet, it does so. I used Signal as the example both because it's prevalent, and because I use it, but likely this affects other apps.

I have not examined the kernel patch. My expertise doesn't include CPU multithread speculative execution experience. I've submitted it to Signal. I even tried LKML but they don't like attachments or included text. If you know someone who can help get this to be reviewed by someone qualified to examine, evaluate, correct, and push back into the repo, that would be great. To whom am I addressing "you"... YOU, the reader.

Ehud
Tucson
Arizona
US

P.S. I have lots more data and am willing to alpha test. The point of it is that this backported kernel fix breaks user code. That's a bad thingie. Shout out to my VMS homies from the past.

[FPScholten]

The kernel shouldn't affect user-mode code. And yet, these fixes do. As of the mitigation fixes, kernels 6.4.9 and 6.4.10 don't allow the Signal app to work.

I am unable to reproduce that, using gnome and the latest 6.4.10 kernel. The signal app works just fine for me. With or without mitigations.

[gavron]

I am unable to reproduce that, using gnome and the latest 6.4.10 kernel. The signal app works just fine for me. With or without mitigations.

Interesting. The only difference between the runs is using the newer kernel with or without =y in the .config prior to kernel build.

One one run on 6.4.9 I removed the app (apt-get purge signal-desktop) and all references to .signal and .Signal and .config/both (rm -rf) and reinstalled the app... (apt-get install) to no different results.

I suppose, given your experiences, I should do a fresh install... and see if that makes a difference, and if it does, never know what the real problem is. I am hopeful someone can direct me to how to debug what is the problem prior to doing that...

Thanks!

E

[AsciiWolf]

The issue with mouse cursor having incorrect colors/gamma on RDNA2 also got fixed in 6.5-rc6. :-)

[gavron]

I am unable to reproduce that, using gnome and the latest 6.4.10 kernel. The signal app works just fine for me. With or without mitigations.

Well, I was able to reproduce it with no effort under 6.4.9 and 6.4.10. However, now that 6.5.0-rc7 is out, the issue is gone, and part of the fixes in 6.5.0-rc7 are all about removing regressions caused by CONFIG_SPECULATION_MITIGATIONS=y -- the exact thing I was mentioning.

The details are discussed by Michael here:

https://www.phoronix.com/news/AMD-Inception-Cleanups

To summarize:
The introduction of the speculation mitigation code resulted in SOME SYSTEMS not running Signal ('signal-desktop') properly, leading to either an immediate exit or an inability to display a GUI. Linux kernel 6.5.rc7 introduces code fixes which makes this (and likely other) problem(s) disappear. No further action required (NFAR).

Ehud
Tucson
Arizona
US