github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

Revert "driver core: add TAINT_FORCED_BIND for when userspace manually messes with devices and drivers"

Browse Source 
This reverts commit fcbfaffee5.

Turns out that vfio is a crazy beast and people have been "relying" on
the bind/unbind debugging feature as a way to handle passing through
devices to guest instances.  Because of this (https://xkcd.com/1172/),
let's revert the feature for now until we can figure out a more agreeable
way to handle this such that normal workflows do not taint the kernel.

Odds are something like what Uwe proposes at:
	https://lore.kernel.org/lkml/cover.1790612298.git.u.kleine-koenig@baylibre.com/
will be the best way forward and will be revisited after for after 7.4.

The feature was originally intended to stem the flow of unnecessary
fuzzing reports of "broken" drivers where random devices were being
bound to random drivers and of course things were going wrong.  The main
syzbot tool is now not doing this anymore, and hopefully no one else
starts it up again (but in this madness of LLMs these days, you can't be
sure.)

Thanks to everyone for telling me just how wrong I was to implement
this, I appreciated the feedback :)

Link: https://lore.kernel.org/all/DLIL9H50MALI.3JROXYEEUM3KU@kernel.org/
To: Jonathan Corbet <corbet@lwn.net>
To: Shuah Khan <skhan@linuxfoundation.org>
To: Randy Dunlap <rdunlap@infradead.org>
To: "Rafael J. Wysocki" <rafael@kernel.org>
To: Danilo Krummrich <dakr@kernel.org>
To: Johan Hovold <johan@kernel.org>
To: Steven Rostedt <rostedt@goodmis.org>
To: Masami Hiramatsu <mhiramat@kernel.org>
To: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Reported-by: Leon Romanovsky <leon@kernel.org>
Reported-by: Jason Gunthorpe <jgg@ziepe.ca>
Reported-by: Michal Pecio <michal.pecio@gmail.com>
Reported-by: "Uwe Kleine-König" <u.kleine-koenig@baylibre.com>
Link: https://patch.msgid.link/20261028-bind_taint-revert-v1-1-7c6b9cef30c9@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ Revert the change in Documentation/admin-guide/tainted-kernels.rst.
  - Danilo ]
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
This commit is contained in:
Greg Kroah-Hartman 2026-10-28 14:42:15 +01:00 committed by Danilo Krummrich
parent a01c8e5b1d
commit a287f97d42
6 changed files with 29 additions and 47 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

54
Documentation/admin-guide/tainted-kernels.rst
View File

@ -74,36 +74,35 @@ a particular type of taint. It's best to leave that to the aforementioned
script, but if you need something quick you can use this shell command to check
which bits are set::
$ for i in $(seq 0 20); do echo $i $(($(cat /proc/sys/kernel/tainted)>>$i&1));done
$ for i in $(seq 0 19); do echo $i $(($(cat /proc/sys/kernel/tainted)>>$i&1));done
Table for decoding tainted state
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
=== === ======= ========================================================
Bit Log Number Reason that got the kernel tainted
=== === ======= ========================================================
0 G/P 1 proprietary module was loaded
1 _/F 2 module was force loaded
2 _/S 4 kernel running on an out of specification system
3 _/R 8 module was force unloaded
4 _/M 16 processor reported a Machine Check Exception (MCE)
5 _/B 32 bad page referenced or some unexpected page flags
6 _/U 64 taint requested by userspace application
7 _/D 128 kernel died recently, i.e. there was an OOPS or BUG
8 _/A 256 ACPI table overridden by user
9 _/W 512 kernel issued warning
10 _/C 1024 staging driver was loaded
11 _/I 2048 workaround for bug in platform firmware applied
12 _/O 4096 externally-built ("out-of-tree") module was loaded
13 _/E 8192 unsigned module was loaded
14 _/L 16384 soft lockup occurred
15 _/K 32768 kernel has been live patched
16 _/X 65536 auxiliary taint, defined for and used by distros
17 _/T 131072 kernel was built with the struct randomization plugin
18 _/N 262144 an in-kernel test has been run
19 _/J 524288 userspace used a mutating debug operation in fwctl
20 _/Y 1048576 device was manually bound or unbound from a driver
=== === ======= ========================================================
=== === ====== ========================================================
Bit Log Number Reason that got the kernel tainted
=== === ====== ========================================================
0 G/P 1 proprietary module was loaded
1 _/F 2 module was force loaded
2 _/S 4 kernel running on an out of specification system
3 _/R 8 module was force unloaded
4 _/M 16 processor reported a Machine Check Exception (MCE)
5 _/B 32 bad page referenced or some unexpected page flags
6 _/U 64 taint requested by userspace application
7 _/D 128 kernel died recently, i.e. there was an OOPS or BUG
8 _/A 256 ACPI table overridden by user
9 _/W 512 kernel issued warning
10 _/C 1024 staging driver was loaded
11 _/I 2048 workaround for bug in platform firmware applied
12 _/O 4096 externally-built ("out-of-tree") module was loaded
13 _/E 8192 unsigned module was loaded
14 _/L 16384 soft lockup occurred
15 _/K 32768 kernel has been live patched
16 _/X 65536 auxiliary taint, defined for and used by distros
17 _/T 131072 kernel was built with the struct randomization plugin
18 _/N 262144 an in-kernel test has been run
19 _/J 524288 userspace used a mutating debug operation in fwctl
=== === ====== ========================================================
Note: The character ``_`` is representing a blank in this table to make reading
easier.
@ -190,6 +189,3 @@ More detailed explanation for tainting
19) ``J`` if userspace opened /dev/fwctl/* and performed a FWTCL_RPC_DEBUG_WRITE
to use the devices debugging features. Device debugging features could
cause the device to malfunction in undefined ways.
20) ``Y`` If userspace wrote to the `bind` or `unbind` sysfs files and
successfully bound or removed a device from a driver.

3
drivers/base/bus.c
View File

@ -19,7 +19,6 @@
#include <linux/string.h>
#include <linux/mutex.h>
#include <linux/sysfs.h>
#include <linux/panic.h>
#include "base.h"
#include "power/power.h"
@ -242,7 +241,6 @@ static ssize_t unbind_store(struct device_driver *drv, const char *buf,
dev = bus_find_device_by_name(bus, NULL, buf);
if (dev && dev->driver == drv) {
add_taint_module(drv->owner, TAINT_FORCED_BIND, LOCKDEP_STILL_OK);
device_driver_detach(dev);
err = count;
}
@ -266,7 +264,6 @@ static ssize_t bind_store(struct device_driver *drv, const char *buf,
dev = bus_find_device_by_name(bus, NULL, buf);
if (dev && driver_match_device(drv, dev)) {
add_taint_module(drv->owner, TAINT_FORCED_BIND, LOCKDEP_STILL_OK);
err = device_driver_attach(drv, dev);
if (!err) {
/* success */

3
include/linux/panic.h
View File

@ -88,8 +88,7 @@ static inline void set_arch_panic_timeout(int timeout, int arch_default_timeout)
#define TAINT_RANDSTRUCT 17
#define TAINT_TEST 18
#define TAINT_FWCTL 19
#define TAINT_FORCED_BIND 20
#define TAINT_FLAGS_COUNT 21
#define TAINT_FLAGS_COUNT 20
#define TAINT_FLAGS_MAX ((1UL << TAINT_FLAGS_COUNT) - 1)
struct taint_flag {

3
include/trace/events/module.h
View File

@ -26,8 +26,7 @@ struct module;
{ (1UL << TAINT_OOT_MODULE), "O" }, \
{ (1UL << TAINT_FORCED_MODULE), "F" }, \
{ (1UL << TAINT_CRAP), "C" }, \
{ (1UL << TAINT_UNSIGNED_MODULE), "E" }, \
{ (1UL << TAINT_FORCED_BIND), "Y" })
{ (1UL << TAINT_UNSIGNED_MODULE), "E" })
TRACE_EVENT(module_load,

5
kernel/panic.c
View File

@ -826,7 +826,6 @@ const struct taint_flag taint_flags[TAINT_FLAGS_COUNT] = {
TAINT_FLAG(RANDSTRUCT, 'T', ' '),
TAINT_FLAG(TEST, 'N', ' '),
TAINT_FLAG(FWCTL, 'J', ' '),
TAINT_FLAG(FORCED_BIND, 'Y', ' '),
};
#undef TAINT_FLAG
@ -863,9 +862,9 @@ static void print_tainted_seq(struct seq_buf *s, bool verbose)
* exact size is allocated dynamically; the initial buffer remains
* as a fallback if allocation fails.
*
* The verbose taint string currently requires up to 344 characters.
* The verbose taint string currently requires up to 327 characters.
*/
#define INIT_TAINT_BUF_MAX 370
#define INIT_TAINT_BUF_MAX 350
static char init_taint_buf[INIT_TAINT_BUF_MAX] __initdata;
static char *taint_buf __refdata = init_taint_buf;

8
tools/debugging/kernel-chktaint
View File

@ -211,14 +211,6 @@ else
addout "J"
echo " * fwctl's mutating debug interface was used (#19)"
fi
T=`expr $T / 2`
if [ `expr $T % 2` -eq 0 ]; then
addout " "
else
addout "Y"
echo " * device was manually bound or unbound from a driver (#20)"
fi
echo "Raw taint value as int/string: $taint/'$out'"
# report on any tainted loadable modules