From nobody Fri Sep 25 09:19:52 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D082547FB1A; Mon, 14 Sep 2026 14:30:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789396257; cv=none; b=pvI5KTZZqreeHSkBgl2V39OuUB2BKnar1tHCKnFlo8dw4JKpYdcAu47kKMzetBGr0O4/ZmB6rHbEgxpFY0Qn0YmvGuroyqiUpkfH3Bqf8RsDPB9SEMptyztzNGf6PmsH3FfEjbm3sfIwYHq7teJt+KUMLzrxKm32ZJQBW8ncUxw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789396257; c=relaxed/simple; bh=URX8vYc8KtPY8CChyuSazeO6itWMsbkI6i5GQUyhLlw=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=eu4wlxFmZ4GyWPLr4RQR48YcJnjnivNN3Ghn1RvnjrzxAvgDKb0gIGTD1FV/eY/0a4E9qJfvuxZ0plr6RQ267zwfoezJ2MVPZyfC8TB894dmq0mhYz69z1pwz/VkjS94N7ufKL9DfHl0tIwPDOqtuovbG5F6A7M9jQy540MjFNM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=lEIozhEn; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="lEIozhEn" Received: by smtp.kernel.org (Postfix) with ESMTPSA id B15A51F00893; Mon, 14 Sep 2026 14:30:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1789396255; bh=IQgf6xMSaKfx++A8iUCfAMe8Zs9EXdbYSGldWIGIUGQ=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=lEIozhEn/QZnplosVw+ZvN+WZ3c5S/m8rh9c6aR5hzDauEgIR/q7zWqxHPORZD7vL zuuwwNAsuwoCgQB3XwbAE6hgq43u70s/nVOXQBS4a1zlAuFT7CGhR9E01Ai7Rpb2Y1 JCpMiDCaBGstJL+HY0XB7QDgdsmDMWTzC/pnYCBo= From: Greg Kroah-Hartman Date: Mon, 14 Sep 2026 16:30:31 +0200 Subject: [PATCH v4 1/3] module: pull out add_taint_module() to be public Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260914-bind_taint-v4-1-eadf8a090903@linuxfoundation.org> References: <20260914-bind_taint-v4-0-eadf8a090903@linuxfoundation.org> In-Reply-To: <20260914-bind_taint-v4-0-eadf8a090903@linuxfoundation.org> To: Luis Chamberlain , Petr Pavlu , Daniel Gomez , Sami Tolvanen , Aaron Tomlin , Jonathan Corbet , Shuah Khan , Randy Dunlap , "Rafael J. Wysocki" , Danilo Krummrich , Steven Rostedt , Masami Hiramatsu , Mathieu Desnoyers Cc: Bradley Morgan , Aleksandr Nogikh , linux-modules@vger.kernel.org, linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-usb@vger.kernel.org, driver-core@lists.linux.dev, linux-trace-kernel@vger.kernel.org, Greg Kroah-Hartman , Johan Hovold X-Mailer: b4 0.17-dev-362b8 X-Developer-Signature: v=1; a=openpgp-sha256; l=2729; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=URX8vYc8KtPY8CChyuSazeO6itWMsbkI6i5GQUyhLlw=; b=owGbwMvMwCRo6H6F97bub03G02pJDFkrWIVueJQWlUx/HlzCmfiVv1jWoT2PP/jHs7hF2szfx ddfitraEcvCIMjEICumyPJlG8/R/RWHFL0MbU/DzGFlAhnCwMUpABNZ1cEwP39dt63PVufqgqa9 HRc1o0+UNhzsY5jv8HY6K4OWtqDntusvf7eozqh6U7MHAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Other kernel code might want to call add_taint_module() so pull it out and make it global. If modules are not enabled, this defaults to a call to add_taint(), so all is fine. Reviewed-by: Johan Hovold Tested-by: Johan Hovold Reviewed-by: Bradley Morgan Reviewed-by: Petr Pavlu Signed-off-by: Greg Kroah-Hartman Acked-by: Danilo Krummrich --- include/linux/module.h | 10 ++++++++++ kernel/module/main.c | 16 +++++++++++++--- 2 files changed, 23 insertions(+), 3 deletions(-) diff --git a/include/linux/module.h b/include/linux/module.h index 96cc98568eea..f6f90cd88f15 100644 --- a/include/linux/module.h +++ b/include/linux/module.h @@ -29,6 +29,7 @@ #include #include #include +#include =20 #include #include @@ -770,6 +771,9 @@ static inline bool is_livepatch_module(struct module *m= od) =20 void module_for_each_mod(int(*func)(struct module *mod, void *data), void = *data); =20 +void add_taint_module(struct module *mod, unsigned flag, + enum lockdep_ok lockdep_ok); + #else /* !CONFIG_MODULES... */ =20 static inline struct module *__module_address(unsigned long addr) @@ -877,6 +881,12 @@ static inline bool module_is_coming(struct module *mod) static inline void module_for_each_mod(int(*func)(struct module *mod, void= *data), void *data) { } + +static inline void add_taint_module(struct module *mod, unsigned flag, + enum lockdep_ok lockdep_ok) +{ + add_taint(flag, lockdep_ok); +} #endif /* CONFIG_MODULES */ =20 #ifdef CONFIG_SYSFS diff --git a/kernel/module/main.c b/kernel/module/main.c index d0e1e0bd2ad0..444d990c9983 100644 --- a/kernel/module/main.c +++ b/kernel/module/main.c @@ -191,11 +191,21 @@ static inline int strong_try_module_get(struct module= *mod) return -ENOENT; } =20 -static inline void add_taint_module(struct module *mod, unsigned flag, - enum lockdep_ok lockdep_ok) +/** + * add_taint_module: add a taint flag if not already set for a specific mo= dule + * @mod: pointer to the module that caused the problem + * @flag: one of the TAINT_* constants. + * @lockdep_ok: whether lock debugging is still OK. + * + * If something bad has gone wrong, you'll want @lockdebug_ok =3D false, b= ut for + * some noteworthy-but-not-corrupting cases, it can be set to true. + */ +void add_taint_module(struct module *mod, unsigned flag, + enum lockdep_ok lockdep_ok) { add_taint(flag, lockdep_ok); - set_bit(flag, &mod->taints); + if (mod) + set_bit(flag, &mod->taints); } =20 /* --=20 2.55.0 From nobody Fri Sep 25 09:19:52 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D223B47F791; Mon, 14 Sep 2026 14:30:58 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789396260; cv=none; b=MRmijD9BqaS3U7mXnBhzB8IaN3UEYeFcI7Me49ekVo4eBYhlz8aBnbwkkmRT4LVqIQjxO9Y6Z5BFyFREubyGFm3V5UxZ3ZbnNc9l5lJMubDwP6cC7BFLKuSF2x1n18O80AXhD0y0Pz+8pCOubo13H+LINQGNNvznsE52BgHaWfw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789396260; c=relaxed/simple; bh=rB0gS0/7VR217VT3T628b9RwU4hsVyXcwKPN7D+kptY=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=RPPP5zYDRu2iOEihrLp7fSrIp6TOh1ysHAPO/hTVzfmO8EMtQIly9WWUM4l0SMVkmT500RBFWPDJzijigeRClNbHjfvsg26s4a5PA6rXJYmZsOQp5SZJ0Bhb49f9fFpnNIGYuOc3dZysmNp4h96S0/qqypGlvxBRY5oRl6LzKmk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Ye/cwf8j; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="Ye/cwf8j" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8F82C1F00893; Mon, 14 Sep 2026 14:30:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1789396258; bh=Ts4nmcnRuTobgxxVWZKuuAu6DjtIQRF+o73GWydBbk8=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=Ye/cwf8jGIOQEZuP+QmxA9EevHaCQZlEWundsTWXDVE50FBN3bSMUoM9JYDqWtqG2 iC9GjDHAXRxrtyc//EXzyuyjdNPkvMwqb09auZApdiGCkUqe2/bPfLic9eCrTG6bDx jXmlx9HXgA7W5lwAMVmu+Api3g2QP7DrWxQdNvFU= From: Greg Kroah-Hartman Date: Mon, 14 Sep 2026 16:30:32 +0200 Subject: [PATCH v4 2/3] module: fix up documentation for add_taint() and add_taint_module() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260914-bind_taint-v4-2-eadf8a090903@linuxfoundation.org> References: <20260914-bind_taint-v4-0-eadf8a090903@linuxfoundation.org> In-Reply-To: <20260914-bind_taint-v4-0-eadf8a090903@linuxfoundation.org> To: Luis Chamberlain , Petr Pavlu , Daniel Gomez , Sami Tolvanen , Aaron Tomlin , Jonathan Corbet , Shuah Khan , Randy Dunlap , "Rafael J. Wysocki" , Danilo Krummrich , Steven Rostedt , Masami Hiramatsu , Mathieu Desnoyers Cc: Bradley Morgan , Aleksandr Nogikh , linux-modules@vger.kernel.org, linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-usb@vger.kernel.org, driver-core@lists.linux.dev, linux-trace-kernel@vger.kernel.org, Greg Kroah-Hartman X-Mailer: b4 0.17-dev-362b8 X-Developer-Signature: v=1; a=openpgp-sha256; l=2030; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=rB0gS0/7VR217VT3T628b9RwU4hsVyXcwKPN7D+kptY=; b=owGbwMvMwCRo6H6F97bub03G02pJDFkrWIVEV5gt3Wdulyb3YpOmXeG6py9ZDhyvjljpvnSm9 Apn5hDtjlgWBkEmBlkxRZYv23iO7q84pOhlaHsaZg4rE8gQBi5OAZhIzSmGBUsurtg94d/m1V2+ HV3xi69/nxnGuoZhQffkqzVHbnq86J0cqXg7ZdIVq50huwE= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 When add_taint_module() was added, the documentation for it was copied directly from add_taint(). But that documentation was a bit wrong (wrong variable name, and misleading boolean reference.) Fix up both functions to have the correct documentation for how to use the lockdep_ok parameter to these functions. Reported-by: Petr Pavlu Signed-off-by: Greg Kroah-Hartman Acked-by: Danilo Krummrich Reviewed-by: Aaron Tomlin Reviewed-by: Bradley Morgan --- kernel/module/main.c | 5 +++-- kernel/panic.c | 5 +++-- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/kernel/module/main.c b/kernel/module/main.c index 444d990c9983..369794876c3e 100644 --- a/kernel/module/main.c +++ b/kernel/module/main.c @@ -197,8 +197,9 @@ static inline int strong_try_module_get(struct module *= mod) * @flag: one of the TAINT_* constants. * @lockdep_ok: whether lock debugging is still OK. * - * If something bad has gone wrong, you'll want @lockdebug_ok =3D false, b= ut for - * some noteworthy-but-not-corrupting cases, it can be set to true. + * If something bad has gone wrong, you'll want + * @lockdep_ok =3D LOCKDEP_NOW_UNRELIABLE, but for some + * noteworthy-but-not-corrupting cases, it can be set to LOCKDEP_STILL_OK. */ void add_taint_module(struct module *mod, unsigned flag, enum lockdep_ok lockdep_ok) diff --git a/kernel/panic.c b/kernel/panic.c index 213725b612aa..892045d8409e 100644 --- a/kernel/panic.c +++ b/kernel/panic.c @@ -948,8 +948,9 @@ unsigned long get_taint(void) * @flag: one of the TAINT_* constants. * @lockdep_ok: whether lock debugging is still OK. * - * If something bad has gone wrong, you'll want @lockdebug_ok =3D false, b= ut for - * some notewortht-but-not-corrupting cases, it can be set to true. + * If something bad has gone wrong, you'll want + * @lockdep_ok =3D LOCKDEP_NOW_UNRELIABLE, but for some + * noteworthy-but-not-corrupting cases, it can be set to LOCKDEP_STILL_OK. */ void add_taint(unsigned flag, enum lockdep_ok lockdep_ok) { --=20 2.55.0 From nobody Fri Sep 25 09:19:52 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A834A480DEC; Mon, 14 Sep 2026 14:31:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789396263; cv=none; b=cwcQcCJUMHfrXwM9yMxGgriRuyu6li7jgm/CJjgYm3MnDZ7gNcVwTl4MtGbiyMKMWgv6MOUCGtsH9ocz8YzBr5CjTTsOR1bcvGwSAk94XyVRvSJCClhnV/LmjvhydaduVLYczIZiBTtpOluTRDE1EnVAnKD2koLiA+nhRXGh7+I= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789396263; c=relaxed/simple; bh=Z3E1hZeNvURbzCH4DGhMWQZAayLO6QmTSTK8h0higAc=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=AWdnjTuNq/keWl4o4qGMJHcbqWV/uCsCo2Tglsqexf1OswmDIlDoHXqMLYXLJLCYcv3XDT508GHxkTFovqZFpku5snkm0jrEapqt0REPBuWItX7NwBxNfqglVs3TvBWW+o0lbDxbpvv+KHi6bF/wuoj7TbZeP8mjht5MRDXpD6w= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=oX+q0OYO; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="oX+q0OYO" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 824541F000FF; Mon, 14 Sep 2026 14:31:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1789396261; bh=QU/gZVED0AtjJX6+GC2V0P7psA+KVinUaVQghPSJtXw=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=oX+q0OYO1Fktez0rwXQHiVnV+hWx4Kv7NlHOJGc7Y4bbZyCPD80FO1KcxhSpBfbYX X++G0vdPmuBOKbkgMFl2U3G1wS7V1NvnCp4W8x7oTys1xs8hwXO5UaWq2TASnRagEG zhwpPDJwB20IhdrlkZivltLl7K4/RF0a8GokOf40= From: Greg Kroah-Hartman Date: Mon, 14 Sep 2026 16:30:33 +0200 Subject: [PATCH v4 3/3] driver core: add TAINT_FORCED_BIND for when userspace manually messes with devices and drivers Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260914-bind_taint-v4-3-eadf8a090903@linuxfoundation.org> References: <20260914-bind_taint-v4-0-eadf8a090903@linuxfoundation.org> In-Reply-To: <20260914-bind_taint-v4-0-eadf8a090903@linuxfoundation.org> To: Luis Chamberlain , Petr Pavlu , Daniel Gomez , Sami Tolvanen , Aaron Tomlin , Jonathan Corbet , Shuah Khan , Randy Dunlap , "Rafael J. Wysocki" , Danilo Krummrich , Steven Rostedt , Masami Hiramatsu , Mathieu Desnoyers Cc: Bradley Morgan , Aleksandr Nogikh , linux-modules@vger.kernel.org, linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-usb@vger.kernel.org, driver-core@lists.linux.dev, linux-trace-kernel@vger.kernel.org, Greg Kroah-Hartman , Johan Hovold X-Mailer: b4 0.17-dev-362b8 X-Developer-Signature: v=1; a=openpgp-sha256; l=10654; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=Z3E1hZeNvURbzCH4DGhMWQZAayLO6QmTSTK8h0higAc=; b=owGbwMvMwCRo6H6F97bub03G02pJDFkrWIWK++seileE2bVHfp3Rr9rS6XP9Kp9pw7fmFX/rj 95emn6zI5aFQZCJQVZMkeXLNp6j+ysOKXoZ2p6GmcPKBDKEgYtTACZieZxhwaWmQ6+s72aJf4qc 8zYtu/qL11G7WoZ51p6S8fsUbC5PsLgtIiRvonpy7aqzAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 The ability to add and remove devices from a driver through the sysfs "bind" and "unbind" files was created all those decades ago as a way that kernel developers can iterate faster, and provide a debugging way for users to attempt to add a new device to a driver without having to rebuild their kernel. This api over the years has been abused and recently come under a major fuzzing "attack" through tools like syzbot which decided that it would attempt to just randomly bind any driver to any type of device, causing loads of unneeded errors and pointless kernel patches to be generated by unsuspecting new developers. Handle all of this by adding a new taint flag, TAINT_FORCED_BIND, which will be set on the driver if the bind/unbind sysfs files are ever written to. This lets kernel developers "know" that a user is attempting to do something that is not normal, and as such, if the kernel breaks they get to keep the shiny pieces laying around on the floor. The flag is 'Y' which was unused, and can remembered as the user is "yeeting" the device being operated on here (thrown with force without regard for the thing being thrown). Note, the taint flag gets set _BEFORE_ the bind/unbind callback happens, as many times crashes/oops/warnings/failures happen within the callback, and the taint flag needs to be there to show what was being attempted. If it were to be set after the callback happens, the oops report would not properly reflect what foolishness was being attempted. Fuzzing tools like syzbot, that doesn't have hand-crafted rules to keep the tool from hitting bind/unbind, should be run with panic_on_taint enabled so that they fall over and don't continue on, thinking that they actually found a real issue. Userspace operations that rely on the bind/unbind files to work around the lack of will to upgrade a kernel image to a newer version with proper support for new devices, or the lack of will to submit valid device ids to driver authors, will still work properly, but now the kernel will be flagged in a way that will show that perhaps those users should reconsider their behavior and work to have the drivers properly support these devices in a "native" manner. Finally, the bind/unbind files can find real use-after-free issues with some drivers by forcing the process to happen virtually without having to rely on manual removal processes. Those real bugs should still be worked on, but by adding this taint flag, developers can more easily determine bug reports that are actually worth looking at. Reviewed-by: Johan Hovold Tested-by: Johan Hovold Reviewed-by: Aaron Tomlin Reviewed-by: Bradley Morgan Signed-off-by: Greg Kroah-Hartman Acked-by: Danilo Krummrich --- Documentation/admin-guide/tainted-kernels.rst | 52 ++++++++++++++---------= ---- drivers/base/bus.c | 3 ++ include/linux/panic.h | 3 +- include/trace/events/module.h | 3 +- kernel/panic.c | 5 +-- tools/debugging/kernel-chktaint | 8 +++++ 6 files changed, 46 insertions(+), 28 deletions(-) diff --git a/Documentation/admin-guide/tainted-kernels.rst b/Documentation/= admin-guide/tainted-kernels.rst index 9ead927a37c0..abbf5e3dd749 100644 --- a/Documentation/admin-guide/tainted-kernels.rst +++ b/Documentation/admin-guide/tainted-kernels.rst @@ -79,30 +79,31 @@ which bits are set:: Table for decoding tainted state ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ =20 -=3D=3D=3D =3D=3D=3D =3D=3D=3D=3D=3D=3D =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D -Bit Log Number Reason that got the kernel tainted -=3D=3D=3D =3D=3D=3D =3D=3D=3D=3D=3D=3D =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D - 0 G/P 1 proprietary module was loaded - 1 _/F 2 module was force loaded - 2 _/S 4 kernel running on an out of specification system - 3 _/R 8 module was force unloaded - 4 _/M 16 processor reported a Machine Check Exception (MCE) - 5 _/B 32 bad page referenced or some unexpected page flags - 6 _/U 64 taint requested by userspace application - 7 _/D 128 kernel died recently, i.e. there was an OOPS or BUG - 8 _/A 256 ACPI table overridden by user - 9 _/W 512 kernel issued warning - 10 _/C 1024 staging driver was loaded - 11 _/I 2048 workaround for bug in platform firmware applied - 12 _/O 4096 externally-built ("out-of-tree") module was loaded - 13 _/E 8192 unsigned module was loaded - 14 _/L 16384 soft lockup occurred - 15 _/K 32768 kernel has been live patched - 16 _/X 65536 auxiliary taint, defined for and used by distros - 17 _/T 131072 kernel was built with the struct randomization plugin - 18 _/N 262144 an in-kernel test has been run - 19 _/J 524288 userspace used a mutating debug operation in fwctl -=3D=3D=3D =3D=3D=3D =3D=3D=3D=3D=3D=3D =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D +=3D=3D=3D =3D=3D=3D =3D=3D=3D=3D=3D=3D=3D =3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D +Bit Log Number Reason that got the kernel tainted +=3D=3D=3D =3D=3D=3D =3D=3D=3D=3D=3D=3D=3D =3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D + 0 G/P 1 proprietary module was loaded + 1 _/F 2 module was force loaded + 2 _/S 4 kernel running on an out of specification system + 3 _/R 8 module was force unloaded + 4 _/M 16 processor reported a Machine Check Exception (MCE) + 5 _/B 32 bad page referenced or some unexpected page flags + 6 _/U 64 taint requested by userspace application + 7 _/D 128 kernel died recently, i.e. there was an OOPS or BUG + 8 _/A 256 ACPI table overridden by user + 9 _/W 512 kernel issued warning + 10 _/C 1024 staging driver was loaded + 11 _/I 2048 workaround for bug in platform firmware applied + 12 _/O 4096 externally-built ("out-of-tree") module was loaded + 13 _/E 8192 unsigned module was loaded + 14 _/L 16384 soft lockup occurred + 15 _/K 32768 kernel has been live patched + 16 _/X 65536 auxiliary taint, defined for and used by distros + 17 _/T 131072 kernel was built with the struct randomization plugin + 18 _/N 262144 an in-kernel test has been run + 19 _/J 524288 userspace used a mutating debug operation in fwctl + 20 _/Y 1048576 device was manually bound or unbound from a driver +=3D=3D=3D =3D=3D=3D =3D=3D=3D=3D=3D=3D=3D =3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D =20 Note: The character ``_`` is representing a blank in this table to make re= ading easier. @@ -189,3 +190,6 @@ More detailed explanation for tainting 19) ``J`` if userspace opened /dev/fwctl/* and performed a FWTCL_RPC_DEBU= G_WRITE to use the devices debugging features. Device debugging features could cause the device to malfunction in undefined ways. + + 20) ``Y`` If userspace wrote to the `bind` or `unbind` sysfs files and + successfully bound or removed a device from a driver. diff --git a/drivers/base/bus.c b/drivers/base/bus.c index d17bd91490ee..c51ad96d4de4 100644 --- a/drivers/base/bus.c +++ b/drivers/base/bus.c @@ -19,6 +19,7 @@ #include #include #include +#include #include "base.h" #include "power/power.h" =20 @@ -241,6 +242,7 @@ static ssize_t unbind_store(struct device_driver *drv, = const char *buf, =20 dev =3D bus_find_device_by_name(bus, NULL, buf); if (dev && dev->driver =3D=3D drv) { + add_taint_module(drv->owner, TAINT_FORCED_BIND, LOCKDEP_STILL_OK); device_driver_detach(dev); err =3D count; } @@ -264,6 +266,7 @@ static ssize_t bind_store(struct device_driver *drv, co= nst char *buf, =20 dev =3D bus_find_device_by_name(bus, NULL, buf); if (dev && driver_match_device(drv, dev)) { + add_taint_module(drv->owner, TAINT_FORCED_BIND, LOCKDEP_STILL_OK); err =3D device_driver_attach(drv, dev); if (!err) { /* success */ diff --git a/include/linux/panic.h b/include/linux/panic.h index f1dd417e54b2..8e7250b0e913 100644 --- a/include/linux/panic.h +++ b/include/linux/panic.h @@ -88,7 +88,8 @@ static inline void set_arch_panic_timeout(int timeout, in= t arch_default_timeout) #define TAINT_RANDSTRUCT 17 #define TAINT_TEST 18 #define TAINT_FWCTL 19 -#define TAINT_FLAGS_COUNT 20 +#define TAINT_FORCED_BIND 20 +#define TAINT_FLAGS_COUNT 21 #define TAINT_FLAGS_MAX ((1UL << TAINT_FLAGS_COUNT) - 1) =20 struct taint_flag { diff --git a/include/trace/events/module.h b/include/trace/events/module.h index e5a006be9dc6..19df3e39bba4 100644 --- a/include/trace/events/module.h +++ b/include/trace/events/module.h @@ -26,7 +26,8 @@ struct module; { (1UL << TAINT_OOT_MODULE), "O" }, \ { (1UL << TAINT_FORCED_MODULE), "F" }, \ { (1UL << TAINT_CRAP), "C" }, \ - { (1UL << TAINT_UNSIGNED_MODULE), "E" }) + { (1UL << TAINT_UNSIGNED_MODULE), "E" }, \ + { (1UL << TAINT_FORCED_BIND), "Y" }) =20 TRACE_EVENT(module_load, =20 diff --git a/kernel/panic.c b/kernel/panic.c index 892045d8409e..a4dbb6b8cd2b 100644 --- a/kernel/panic.c +++ b/kernel/panic.c @@ -826,6 +826,7 @@ const struct taint_flag taint_flags[TAINT_FLAGS_COUNT] = =3D { TAINT_FLAG(RANDSTRUCT, 'T', ' '), TAINT_FLAG(TEST, 'N', ' '), TAINT_FLAG(FWCTL, 'J', ' '), + TAINT_FLAG(FORCED_BIND, 'Y', ' '), }; =20 #undef TAINT_FLAG @@ -862,9 +863,9 @@ static void print_tainted_seq(struct seq_buf *s, bool v= erbose) * exact size is allocated dynamically; the initial buffer remains * as a fallback if allocation fails. * - * The verbose taint string currently requires up to 327 characters. + * The verbose taint string currently requires up to 344 characters. */ -#define INIT_TAINT_BUF_MAX 350 +#define INIT_TAINT_BUF_MAX 370 =20 static char init_taint_buf[INIT_TAINT_BUF_MAX] __initdata; static char *taint_buf __refdata =3D init_taint_buf; diff --git a/tools/debugging/kernel-chktaint b/tools/debugging/kernel-chkta= int index e1571c04afb5..d8628be37214 100755 --- a/tools/debugging/kernel-chktaint +++ b/tools/debugging/kernel-chktaint @@ -211,6 +211,14 @@ else addout "J" echo " * fwctl's mutating debug interface was used (#19)" fi + +T=3D`expr $T / 2` +if [ `expr $T % 2` -eq 0 ]; then + addout " " +else + addout "Y" + echo " * device was manually bound or unbound from a driver (#20)" +fi echo "Raw taint value as int/string: $taint/'$out'" =20 # report on any tainted loadable modules --=20 2.55.0