mirror of
https://github.com/torvalds/linux.git
synced 2026-10-23 07:11:03 +02:00
fcbfaffee5
The ability to add and remove devices from a driver through the sysfs "bind" and "unbind" files was created all those decades ago as a way that kernel developers can iterate faster, and provide a debugging way for users to attempt to add a new device to a driver without having to rebuild their kernel. This api over the years has been abused and recently come under a major fuzzing "attack" through tools like syzbot which decided that it would attempt to just randomly bind any driver to any type of device, causing loads of unneeded errors and pointless kernel patches to be generated by unsuspecting new developers. Handle all of this by adding a new taint flag, TAINT_FORCED_BIND, which will be set on the driver if the bind/unbind sysfs files are ever written to. This lets kernel developers "know" that a user is attempting to do something that is not normal, and as such, if the kernel breaks they get to keep the shiny pieces laying around on the floor. The flag is 'Y' which was unused, and can remembered as the user is "yeeting" the device being operated on here (thrown with force without regard for the thing being thrown). Note, the taint flag gets set _BEFORE_ the bind/unbind callback happens, as many times crashes/oops/warnings/failures happen within the callback, and the taint flag needs to be there to show what was being attempted. If it were to be set after the callback happens, the oops report would not properly reflect what foolishness was being attempted. Fuzzing tools like syzbot, that doesn't have hand-crafted rules to keep the tool from hitting bind/unbind, should be run with panic_on_taint enabled so that they fall over and don't continue on, thinking that they actually found a real issue. Userspace operations that rely on the bind/unbind files to work around the lack of will to upgrade a kernel image to a newer version with proper support for new devices, or the lack of will to submit valid device ids to driver authors, will still work properly, but now the kernel will be flagged in a way that will show that perhaps those users should reconsider their behavior and work to have the drivers properly support these devices in a "native" manner. Finally, the bind/unbind files can find real use-after-free issues with some drivers by forcing the process to happen virtually without having to rely on manual removal processes. Those real bugs should still be worked on, but by adding this taint flag, developers can more easily determine bug reports that are actually worth looking at. Reviewed-by: Johan Hovold <johan@kernel.org> Tested-by: Johan Hovold <johan@kernel.org> Reviewed-by: Aaron Tomlin <atomlin@atomlin.com> Reviewed-by: Bradley Morgan <brads@mainlining.org> Acked-by: Danilo Krummrich <dakr@kernel.org> Link: https://patch.msgid.link/20260914-bind_taint-v4-3-eadf8a090903@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
115 lines
3.2 KiB
C
115 lines
3.2 KiB
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
#ifndef _LINUX_PANIC_H
|
|
#define _LINUX_PANIC_H
|
|
|
|
#include <linux/compiler_attributes.h>
|
|
#include <linux/stdarg.h>
|
|
#include <linux/types.h>
|
|
|
|
struct pt_regs;
|
|
|
|
extern long (*panic_blink)(int state);
|
|
__printf(1, 2)
|
|
void panic(const char *fmt, ...) __noreturn __cold;
|
|
__printf(1, 0)
|
|
void vpanic(const char *fmt, va_list args) __noreturn __cold;
|
|
void nmi_panic(struct pt_regs *regs, const char *msg);
|
|
void check_panic_on_warn(const char *origin);
|
|
extern void oops_enter(void);
|
|
extern void oops_exit(void);
|
|
extern bool oops_may_print(void);
|
|
|
|
extern bool panic_triggering_all_cpu_backtrace;
|
|
extern int panic_timeout;
|
|
extern unsigned long panic_print;
|
|
extern int panic_on_oops;
|
|
extern int panic_on_warn;
|
|
|
|
extern unsigned long panic_on_taint;
|
|
extern bool panic_on_taint_nousertaint;
|
|
|
|
extern int sysctl_panic_on_stackoverflow;
|
|
|
|
extern bool crash_kexec_post_notifiers;
|
|
|
|
extern void __stack_chk_fail(void);
|
|
void abort(void);
|
|
|
|
/*
|
|
* panic_cpu is used for synchronizing panic() and crash_kexec() execution. It
|
|
* holds a CPU number which is executing panic() currently. A value of
|
|
* PANIC_CPU_INVALID means no CPU has entered panic() or crash_kexec().
|
|
*/
|
|
extern atomic_t panic_cpu;
|
|
|
|
/*
|
|
* panic_redirect_cpu is used when panic is redirected to a specific CPU via
|
|
* the panic_force_cpu= boot parameter. It holds the CPU number that originally
|
|
* triggered the panic before redirection. A value of PANIC_CPU_INVALID means
|
|
* no redirection has occurred.
|
|
*/
|
|
extern atomic_t panic_redirect_cpu;
|
|
#define PANIC_CPU_INVALID -1
|
|
|
|
bool panic_try_start(void);
|
|
void panic_reset(void);
|
|
bool panic_in_progress(void);
|
|
bool panic_on_this_cpu(void);
|
|
bool panic_on_other_cpu(void);
|
|
|
|
/*
|
|
* Only to be used by arch init code. If the user over-wrote the default
|
|
* CONFIG_PANIC_TIMEOUT, honor it.
|
|
*/
|
|
static inline void set_arch_panic_timeout(int timeout, int arch_default_timeout)
|
|
{
|
|
if (panic_timeout == arch_default_timeout)
|
|
panic_timeout = timeout;
|
|
}
|
|
|
|
/* This cannot be an enum because some may be used in assembly source. */
|
|
#define TAINT_PROPRIETARY_MODULE 0
|
|
#define TAINT_FORCED_MODULE 1
|
|
#define TAINT_CPU_OUT_OF_SPEC 2
|
|
#define TAINT_FORCED_RMMOD 3
|
|
#define TAINT_MACHINE_CHECK 4
|
|
#define TAINT_BAD_PAGE 5
|
|
#define TAINT_USER 6
|
|
#define TAINT_DIE 7
|
|
#define TAINT_OVERRIDDEN_ACPI_TABLE 8
|
|
#define TAINT_WARN 9
|
|
#define TAINT_CRAP 10
|
|
#define TAINT_FIRMWARE_WORKAROUND 11
|
|
#define TAINT_OOT_MODULE 12
|
|
#define TAINT_UNSIGNED_MODULE 13
|
|
#define TAINT_SOFTLOCKUP 14
|
|
#define TAINT_LIVEPATCH 15
|
|
#define TAINT_AUX 16
|
|
#define TAINT_RANDSTRUCT 17
|
|
#define TAINT_TEST 18
|
|
#define TAINT_FWCTL 19
|
|
#define TAINT_FORCED_BIND 20
|
|
#define TAINT_FLAGS_COUNT 21
|
|
#define TAINT_FLAGS_MAX ((1UL << TAINT_FLAGS_COUNT) - 1)
|
|
|
|
struct taint_flag {
|
|
char c_true; /* character printed when tainted */
|
|
char c_false; /* character printed when not tainted */
|
|
const char *desc; /* verbose description of the set taint flag */
|
|
};
|
|
|
|
extern const struct taint_flag taint_flags[TAINT_FLAGS_COUNT];
|
|
|
|
enum lockdep_ok {
|
|
LOCKDEP_STILL_OK,
|
|
LOCKDEP_NOW_UNRELIABLE,
|
|
};
|
|
|
|
extern const char *print_tainted(void);
|
|
extern const char *print_tainted_verbose(void);
|
|
extern void add_taint(unsigned flag, enum lockdep_ok);
|
|
extern int test_taint(unsigned flag);
|
|
extern unsigned long get_taint(void);
|
|
|
|
#endif /* _LINUX_PANIC_H */
|