mirror of
https://github.com/torvalds/linux.git
synced 2026-10-22 23:01:49 +02:00
The ability to add and remove devices from a driver through the sysfs "bind" and "unbind" files was created all those decades ago as a way that kernel developers can iterate faster, and provide a debugging way for users to attempt to add a new device to a driver without having to rebuild their kernel. This api over the years has been abused and recently come under a major fuzzing "attack" through tools like syzbot which decided that it would attempt to just randomly bind any driver to any type of device, causing loads of unneeded errors and pointless kernel patches to be generated by unsuspecting new developers. Handle all of this by adding a new taint flag, TAINT_FORCED_BIND, which will be set on the driver if the bind/unbind sysfs files are ever written to. This lets kernel developers "know" that a user is attempting to do something that is not normal, and as such, if the kernel breaks they get to keep the shiny pieces laying around on the floor. The flag is 'Y' which was unused, and can remembered as the user is "yeeting" the device being operated on here (thrown with force without regard for the thing being thrown). Note, the taint flag gets set _BEFORE_ the bind/unbind callback happens, as many times crashes/oops/warnings/failures happen within the callback, and the taint flag needs to be there to show what was being attempted. If it were to be set after the callback happens, the oops report would not properly reflect what foolishness was being attempted. Fuzzing tools like syzbot, that doesn't have hand-crafted rules to keep the tool from hitting bind/unbind, should be run with panic_on_taint enabled so that they fall over and don't continue on, thinking that they actually found a real issue. Userspace operations that rely on the bind/unbind files to work around the lack of will to upgrade a kernel image to a newer version with proper support for new devices, or the lack of will to submit valid device ids to driver authors, will still work properly, but now the kernel will be flagged in a way that will show that perhaps those users should reconsider their behavior and work to have the drivers properly support these devices in a "native" manner. Finally, the bind/unbind files can find real use-after-free issues with some drivers by forcing the process to happen virtually without having to rely on manual removal processes. Those real bugs should still be worked on, but by adding this taint flag, developers can more easily determine bug reports that are actually worth looking at. Reviewed-by: Johan Hovold <johan@kernel.org> Tested-by: Johan Hovold <johan@kernel.org> Reviewed-by: Aaron Tomlin <atomlin@atomlin.com> Reviewed-by: Bradley Morgan <brads@mainlining.org> Acked-by: Danilo Krummrich <dakr@kernel.org> Link: https://patch.msgid.link/20260914-bind_taint-v4-3-eadf8a090903@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
244 lines
4.4 KiB
Bash
Executable File
244 lines
4.4 KiB
Bash
Executable File
#! /bin/sh
|
|
# SPDX-License-Identifier: GPL-2.0
|
|
#
|
|
# Randy Dunlap <rdunlap@infradead.org>, 2018
|
|
# Thorsten Leemhuis <linux@leemhuis.info>, 2018
|
|
|
|
usage()
|
|
{
|
|
cat <<EOF
|
|
usage: ${0##*/}
|
|
${0##*/} <int>
|
|
|
|
Call without parameters to decode /proc/sys/kernel/tainted.
|
|
|
|
Call with a positive integer as parameter to decode a value you
|
|
retrieved from /proc/sys/kernel/tainted on another system.
|
|
|
|
EOF
|
|
}
|
|
|
|
if [ "$1"x != "x" ]; then
|
|
if [ "$1"x == "--helpx" ] || [ "$1"x == "-hx" ] ; then
|
|
usage
|
|
exit 1
|
|
elif [ $1 -ge 0 ] 2>/dev/null ; then
|
|
taint=$1
|
|
else
|
|
echo "Error: Parameter '$1' not a positive integer. Aborting." >&2
|
|
exit 1
|
|
fi
|
|
else
|
|
TAINTFILE="/proc/sys/kernel/tainted"
|
|
if [ ! -r $TAINTFILE ]; then
|
|
echo "No file: $TAINTFILE"
|
|
exit
|
|
fi
|
|
|
|
taint=`cat $TAINTFILE`
|
|
fi
|
|
|
|
if [ $taint -eq 0 ]; then
|
|
echo "Kernel not Tainted"
|
|
exit
|
|
else
|
|
echo "Kernel is \"tainted\" for the following reasons:"
|
|
fi
|
|
|
|
T=$taint
|
|
out=
|
|
|
|
addout() {
|
|
out=$out$1
|
|
}
|
|
|
|
if [ `expr $T % 2` -eq 0 ]; then
|
|
addout "G"
|
|
else
|
|
addout "P"
|
|
echo " * proprietary module was loaded (#0)"
|
|
fi
|
|
|
|
T=`expr $T / 2`
|
|
if [ `expr $T % 2` -eq 0 ]; then
|
|
addout " "
|
|
else
|
|
addout "F"
|
|
echo " * module was force loaded (#1)"
|
|
fi
|
|
|
|
T=`expr $T / 2`
|
|
if [ `expr $T % 2` -eq 0 ]; then
|
|
addout " "
|
|
else
|
|
addout "S"
|
|
echo " * kernel running on an out of specification system (#2)"
|
|
fi
|
|
|
|
T=`expr $T / 2`
|
|
if [ `expr $T % 2` -eq 0 ]; then
|
|
addout " "
|
|
else
|
|
addout "R"
|
|
echo " * module was force unloaded (#3)"
|
|
fi
|
|
|
|
T=`expr $T / 2`
|
|
if [ `expr $T % 2` -eq 0 ]; then
|
|
addout " "
|
|
else
|
|
addout "M"
|
|
echo " * processor reported a Machine Check Exception (MCE) (#4)"
|
|
fi
|
|
|
|
T=`expr $T / 2`
|
|
if [ `expr $T % 2` -eq 0 ]; then
|
|
addout " "
|
|
else
|
|
addout "B"
|
|
echo " * bad page referenced or some unexpected page flags (#5)"
|
|
fi
|
|
|
|
T=`expr $T / 2`
|
|
if [ `expr $T % 2` -eq 0 ]; then
|
|
addout " "
|
|
else
|
|
addout "U"
|
|
echo " * taint requested by userspace application (#6)"
|
|
fi
|
|
|
|
T=`expr $T / 2`
|
|
if [ `expr $T % 2` -eq 0 ]; then
|
|
addout " "
|
|
else
|
|
addout "D"
|
|
echo " * kernel died recently, i.e. there was an OOPS or BUG (#7)"
|
|
fi
|
|
|
|
T=`expr $T / 2`
|
|
if [ `expr $T % 2` -eq 0 ]; then
|
|
addout " "
|
|
else
|
|
addout "A"
|
|
echo " * an ACPI table was overridden by user (#8)"
|
|
fi
|
|
|
|
T=`expr $T / 2`
|
|
if [ `expr $T % 2` -eq 0 ]; then
|
|
addout " "
|
|
else
|
|
addout "W"
|
|
echo " * kernel issued warning (#9)"
|
|
fi
|
|
|
|
T=`expr $T / 2`
|
|
if [ `expr $T % 2` -eq 0 ]; then
|
|
addout " "
|
|
else
|
|
addout "C"
|
|
echo " * staging driver was loaded (#10)"
|
|
fi
|
|
|
|
T=`expr $T / 2`
|
|
if [ `expr $T % 2` -eq 0 ]; then
|
|
addout " "
|
|
else
|
|
addout "I"
|
|
echo " * workaround for bug in platform firmware applied (#11)"
|
|
fi
|
|
|
|
T=`expr $T / 2`
|
|
if [ `expr $T % 2` -eq 0 ]; then
|
|
addout " "
|
|
else
|
|
addout "O"
|
|
echo " * externally-built ('out-of-tree') module was loaded (#12)"
|
|
fi
|
|
|
|
T=`expr $T / 2`
|
|
if [ `expr $T % 2` -eq 0 ]; then
|
|
addout " "
|
|
else
|
|
addout "E"
|
|
echo " * unsigned module was loaded (#13)"
|
|
fi
|
|
|
|
T=`expr $T / 2`
|
|
if [ `expr $T % 2` -eq 0 ]; then
|
|
addout " "
|
|
else
|
|
addout "L"
|
|
echo " * soft lockup occurred (#14)"
|
|
fi
|
|
|
|
T=`expr $T / 2`
|
|
if [ `expr $T % 2` -eq 0 ]; then
|
|
addout " "
|
|
else
|
|
addout "K"
|
|
echo " * kernel has been live patched (#15)"
|
|
fi
|
|
|
|
T=`expr $T / 2`
|
|
if [ `expr $T % 2` -eq 0 ]; then
|
|
addout " "
|
|
else
|
|
addout "X"
|
|
echo " * auxiliary taint, defined for and used by distros (#16)"
|
|
|
|
fi
|
|
|
|
T=`expr $T / 2`
|
|
if [ `expr $T % 2` -eq 0 ]; then
|
|
addout " "
|
|
else
|
|
addout "T"
|
|
echo " * kernel was built with the struct randomization plugin (#17)"
|
|
fi
|
|
|
|
T=`expr $T / 2`
|
|
if [ `expr $T % 2` -eq 0 ]; then
|
|
addout " "
|
|
else
|
|
addout "N"
|
|
echo " * an in-kernel test (such as a KUnit test) has been run (#18)"
|
|
fi
|
|
|
|
T=`expr $T / 2`
|
|
if [ `expr $T % 2` -eq 0 ]; then
|
|
addout " "
|
|
else
|
|
addout "J"
|
|
echo " * fwctl's mutating debug interface was used (#19)"
|
|
fi
|
|
|
|
T=`expr $T / 2`
|
|
if [ `expr $T % 2` -eq 0 ]; then
|
|
addout " "
|
|
else
|
|
addout "Y"
|
|
echo " * device was manually bound or unbound from a driver (#20)"
|
|
fi
|
|
echo "Raw taint value as int/string: $taint/'$out'"
|
|
|
|
# report on any tainted loadable modules
|
|
[ "$1" = "" ] && [ -r /sys/module/ ] && \
|
|
cnt=`grep [A-Z] /sys/module/*/taint | wc -l` || cnt=0
|
|
|
|
if [ $cnt -ne 0 ]; then
|
|
echo
|
|
echo "Tainted modules:"
|
|
for dir in `ls /sys/module` ; do
|
|
if [ -r /sys/module/$dir/taint ]; then
|
|
modtnt=`cat /sys/module/$dir/taint`
|
|
[ "$modtnt" = "" ] || echo " * $dir ($modtnt)"
|
|
fi
|
|
done
|
|
fi
|
|
|
|
echo
|
|
echo "For a more detailed explanation of the various taint flags see"
|
|
echo " Documentation/admin-guide/tainted-kernels.rst in the Linux kernel sources"
|
|
echo " or https://kernel.org/doc/html/latest/admin-guide/tainted-kernels.html"
|
|
#EOF#
|