rust: bug: pass TAINT_WARN to warn_slowpath_fmt() on UML

On UML, `warn_flags!` calls `warn_slowpath_fmt()` directly. Its third
argument is a taint number, but `warn_on!` passes its bug flags there.

As a result, `add_taint()` gets 2304 instead of 9 (`TAINT_WARN`). The
warning is not recorded: `/proc/sys/kernel/tainted` stays 0 after
`warn_on!` fires, where it should be 512. It also causes an
out-of-bounds write in `add_taint()`.

Pass `TAINT_WARN` directly, as C does on UML.

Cc: stable@vger.kernel.org
Fixes: dff64b0727 ("rust: Add warn_on macro")
Signed-off-by: FUJITA Tomonori <fujita.tomonori@gmail.com>
Link: https://patch.msgid.link/20261001123103.2198104-1-tomo@flapping.org
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
This commit is contained in:
FUJITA Tomonori 2026-10-01 21:31:03 +09:00 committed by Miguel Ojeda
parent e91836593f
commit 951d09ca45

View File

@ -85,6 +85,7 @@ macro_rules! warn_flags {
($file:expr, $flags:expr) => {
if false {
_ = $file;
_ = $flags;
}
// SAFETY: It is always safe to call `warn_slowpath_fmt()`
@ -93,7 +94,7 @@ macro_rules! warn_flags {
$crate::bindings::warn_slowpath_fmt(
$crate::str::CStrExt::as_char_ptr($crate::c_str!(::core::file!())),
line!() as $crate::ffi::c_int,
$flags as $crate::ffi::c_uint,
$crate::bindings::TAINT_WARN,
::core::ptr::null(),
);
}