May 2026 - Spectrum Development

[PATCH] tools: Use synchronous I/O for block devices
by Demi Marie Obenour 21 May '26

21 May '26

CVE-2026-45782 showed that the Cloud Hypervisor asynchronous block I/O code is far too subtle. Even the top-level APIs are unsafe, and so bugs in the block device itself can cause undefined behavior. In this case, the undefined behavior was a use-after free that allowed a VM escape. While the synchronous code still allows safe code to cause undefined behavior, it is somewhat simpler to reason about and so should be preferred when performance is not a concern. Disabling asynchronous I/O was a mitigation for CVE-2026-45782. Signed-off-by: Demi Marie Obenour <demiobenour(a)gmail.com> --- Upstream contributor Dylan Reid plans to fix the block layer. However, its attack surface is still much higher than the synchronous I/O code. This has not been tested beyond the integration tests. My test machine is currently not working, most likely due to the AMDGPU panel self-refresh bug. --- tools/start-vmm/ch.rs | 2 ++ tools/start-vmm/lib.rs | 2 ++ 2 files changed, 4 insertions(+) diff --git a/tools/start-vmm/ch.rs b/tools/start-vmm/ch.rs index d3ac95ed60db834e20dbd7366908ae45cbdf27a2..239d08e10721170de02ec7da92939597c72e8033 100644 --- a/tools/start-vmm/ch.rs +++ b/tools/start-vmm/ch.rs @@ -24,6 +24,8 @@ pub struct ConsoleConfig { pub struct DiskConfig { pub path: String, pub readonly: bool, + pub disable_io_uring: bool, + pub disable_aio: bool, } #[derive(Serialize)] diff --git a/tools/start-vmm/lib.rs b/tools/start-vmm/lib.rs index 1adccc1b76ce24ba0550a3db2aef1b4c8f3c231a..0fa63525eaee2f387456ed6fb9c3649188ab0e7a 100644 --- a/tools/start-vmm/lib.rs +++ b/tools/start-vmm/lib.rs @@ -75,6 +75,8 @@ pub fn vm_config(vm_dir: &Path) -> Result<VmConfig, String> { Ok(DiskConfig { path: entry, readonly: true, + disable_io_uring: true, + disable_aio: true, }) }) .collect::<Result<_, _>>()?, --- base-commit: 5b3151fd08d1f1e3e166a328449fe6fe5092f316 change-id: 20260507-sync-block-2902b6a635f8 -- Sincerely, Demi Marie Obenour (she/her/hers)

2 1

USB network cards
by Demi Marie Obenour 21 May '26

21 May '26

A lot of modern laptops don't have RJ45 jacks. Ethernet is only supported via USB Ethernet adapters. Is this just a special case of broader USB support, or is it worth handling separately? If the Linux USB core and the xHCI driver were secure against malicious input, it might make sense to implement the drivers in userspace on the router. Sadly, that isn't the case right now. -- Sincerely, Demi Marie Obenour (she/her/hers)

2 1

[PATCH] img/app: only set known interfaces to up
by Alyssa Ross 18 May '26

18 May '26

Linux 7.1-rc1 defaults IPV6_SIT to built-in, which means a sit0 device always exists. (I think this is unintentional and have sent a patch to change it back to a module by default[1].) Depending on which interface, sit0 or the eth0 connected to the router, comes up first, networking may end up not working. Make our interface handling more robust by only bringing the interfaces from the router up, rather than all interfaces unconditionally. Link: https://lore.kernel.org/netdev/20260503165714.1477819-1-hi@alyssa.is/ [1] Fixes: 88f2695c ("Initial commit") Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- Not sure whether maybe it would be a good idea to check type = 1 (ARPHRD_ETHER) as well? img/app/image/etc/mdev/iface | 1 + 1 file changed, 1 insertion(+) diff --git a/img/app/image/etc/mdev/iface b/img/app/image/etc/mdev/iface index 67eee84f..55ec160c 100755 --- a/img/app/image/etc/mdev/iface +++ b/img/app/image/etc/mdev/iface @@ -4,5 +4,6 @@ background { importas -Si INTERFACE + if { grep -q ^02:00: /sys/class/net/${INTERFACE}/address } ip link set $INTERFACE up } base-commit: ea05e3e48816037e442e6ee8205f924191c9634c -- 2.53.0

2 1

[PATCH] tools/vm-set-persist.c: fix "memory leak"
by Alyssa Ross 18 May '26

18 May '26

Newer versions of clang-tidy complain about the "memory leak" from strdup. This is not a problem because this is not a long lived program nor a large allocation, but I think it's probably better to appease clang-tidy than to override it. Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- tools/vm-set-persist.c | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/tools/vm-set-persist.c b/tools/vm-set-persist.c index ac759504..8f714b38 100644 --- a/tools/vm-set-persist.c +++ b/tools/vm-set-persist.c @@ -1,4 +1,4 @@ -// SPDX-FileCopyrightText: 2025 Alyssa Ross <hi(a)alyssa.is> +// SPDX-FileCopyrightText: 2025-2026 Alyssa Ross <hi(a)alyssa.is> // SPDX-License-Identifier: EUPL-1.2+ #include <err.h> @@ -142,11 +142,12 @@ static void do_rename(int mnt, const char dir_name[static 1], int main(int argc, char *argv[]) { - int mnt; + int mnt, r; mode_t mode; uint64_t mnt_id; char *disk_path, *dir_name, *old_name, *new_name, - mnt_root[MNT_ROOT_MAX_LEN], source[SOURCE_MAX_LEN]; + mnt_root[MNT_ROOT_MAX_LEN], mnt_root_copy[MNT_ROOT_MAX_LEN], + source[SOURCE_MAX_LEN]; if (argc != 3) { fprintf(stderr, "Usage: vm-set-persist ID INSTANCE\n"); @@ -168,10 +169,13 @@ int main(int argc, char *argv[]) do_statx(disk_path, &mode, &mnt_id); do_statmount(mnt_id, mnt_root, source); - if (!(dir_name = strdup(mnt_root))) - err(EXIT_FAILURE, "strdup"); - dir_name = dirname(dir_name); - old_name = basename(mnt_root); + r = snprintf(mnt_root_copy, sizeof mnt_root_copy, "%s", mnt_root); + if (r == -1) + err(EXIT_FAILURE, "snprintf"); + if ((size_t)r >= sizeof mnt_root_copy) + errx(EXIT_FAILURE, "mnt_root longer than mnt_root_copy"); + dir_name = dirname(mnt_root); + old_name = basename(mnt_root_copy); mnt = do_mount(source); base-commit: 508851e5d884bc3f2906947dcd43b055dc0465f4 -- 2.53.0

2 1

[PATCH] Documentation: don't repeat configuring the upstream cache
by Valentin Gagarin 03 May '26

03 May '26

On NixOS, repeating the default will make it show up in the configuration twice. We're now relying on option merging to do the right thing. On vanilla Linux, repeating was only necessary because not adding `extra-` would override whatever was set otherwise. This is generally undesirable, which is why now we're using `extra-` and thus don't need to repeat the defaults. Signed-off-by: Valentin Gagarin <valentin(a)gagarin.work> --- Documentation/installation/binary-cache.adoc | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/Documentation/installation/binary-cache.adoc b/Documentation/installation/binary-cache.adoc index a51e152..ec8d797 100644 --- a/Documentation/installation/binary-cache.adoc +++ b/Documentation/installation/binary-cache.adoc @@ -29,9 +29,10 @@ Add the following configuration to /etc/nixos/configuration.nix: { ... }: { - nix.settings.substituters = [ "https://cache.dataaturservice.se/spectrum/" ]; + nix.settings.substituters = [ + "https://cache.dataaturservice.se/spectrum/" + ]; nix.settings.trusted-public-keys = [ - "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=" "spectrum-os.org-2:foQk3r7t2VpRx92CaXb5ROyy/NBdRJQG2uX2XJMYZfU=" ]; } @@ -49,8 +50,8 @@ Add the following configuration to /etc/nix/nix.conf: [source] ---- -substituters = https://cache.dataaturservice.se/spectrum/ https://cache.nixos.org/ -trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= spectrum-os.org-2:foQk3r7t2VpRx92CaXb5ROyy/NBdRJQG2uX2XJMYZfU= +extra-substituters = https://cache.dataaturservice.se/spectrum/ +extra-trusted-public-keys = spectrum-os.org-2:foQk3r7t2VpRx92CaXb5ROyy/NBdRJQG2uX2XJMYZfU= ---- Run `systemctl restart nix-daemon.service` after making any changes in the Nix -- 2.51.2

3 2