Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [High] Tainting the kernel unconditionally on any sysfs bind/unbind operation marks legitimate, standard virtualization and networking setups as tainted. --
commit 5047195fb07d09f62b1e24672350bc622948fa9e Author: Greg Kroah-Hartman <[email protected]> driver core: add TAINT_FORCED_BIND for when userspace manually messes with devices and drivers This commit adds a new TAINT_FORCED_BIND flag to track when userspace binds or unbinds devices via sysfs, aiming to flag potentially unstable fuzzing or unsupported states. It sets this taint flag unconditionally in the sysfs bind and unbind store callbacks. > diff --git a/drivers/base/bus.c b/drivers/base/bus.c > index d17bd91490ee4..c51ad96d4de4b 100644 > --- a/drivers/base/bus.c > +++ b/drivers/base/bus.c [ ... ] > @@ -241,6 +242,7 @@ static ssize_t unbind_store(struct device_driver *drv, > const char *buf, > > dev = bus_find_device_by_name(bus, NULL, buf); > if (dev && dev->driver == drv) { > + add_taint_module(drv->owner, TAINT_FORCED_BIND, > LOCKDEP_STILL_OK); [Severity: High] Will this unconditionally taint the kernel during officially supported unbind operations? The sysfs unbind file is the documented UAPI for legitimate subsystems and setups like VFIO PCI passthrough, DPDK, and USB over IP. Applying this taint for standard operations might cause normal enterprise environments to be permanently marked as tainted, causing valid bug reports to be ignored, and could trigger panics on systems running with panic_on_taint enabled. > device_driver_detach(dev); > err = count; > } [ ... ] > @@ -264,6 +266,7 @@ static ssize_t bind_store(struct device_driver *drv, > const char *buf, > > dev = bus_find_device_by_name(bus, NULL, buf); > if (dev && driver_match_device(drv, dev)) { > + add_taint_module(drv->owner, TAINT_FORCED_BIND, > LOCKDEP_STILL_OK); [Severity: High] Similarly, will this mark the kernel as tainted when standard virtualization daemons or userspace networking tools write to the bind file? Is there a way to distinguish between abusive fuzzing attempts and normal administrative actions so we do not invalidate valid bug reports from these common setups? > err = device_driver_attach(drv, dev); > if (!err) { > /* success */ -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=2
