Am 04.09.26 um 07:10 schrieb Greg Kroah-Hartman:
The ability to add and remove devices from a driver through the sysfs
"bind" and "unbind" files was created all those decades ago as a way
that kernel developers can iterate faster, and provide a debugging way
for users to attempt to add a new device to a driver without having to
rebuild their kernel.
This api over the years has been abused and recently come under a major
fuzzing "attack" through tools like syzbot which decided that it would
attempt to just randomly bind any driver to any type of device, causing
loads of unneeded errors and pointless kernel patches to be generated by
unsuspecting new developers.
Handle all of this by adding a new taint flag, TAINT_FORCED_BIND, which
will be set on the driver if the bind/unbind sysfs files are ever
written to. This lets kernel developers "know" that a user is
attempting to do something that is not normal, and as such, if the
kernel breaks they get to keep the shiny pieces laying around on the
floor.
The flag is 'Y' which was unused, and can remembered as the user is
"yeeting" the device being operated on here (thrown with force without
regard for the thing being thrown).
Note, the taint flag gets set _BEFORE_ the bind/unbind callback happens,
as many times crashes/oops/warnings/failures happen within the callback,
and the taint flag needs to be there to show what was being attempted.
If it were to be set after the callback happens, the oops report would
not properly reflect what foolishness was being attempted.
Fuzzing tools like syzbot, that doesn't have hand-crafted rules to keep
the tool from hitting bind/unbind, should be run with panic_on_taint
enabled so that they fall over and don't continue on, thinking that they
actually found a real issue.
Userspace operations that rely on the bind/unbind files to work around
the lack of will to upgrade a kernel image to a newer version with
proper support for new devices, or the lack of will to submit valid
device ids to driver authors, will still work properly, but now the
kernel will be flagged in a way that will show that perhaps those users
should reconsider their behavior and work to have the drivers properly
support these devices in a "native" manner.
What about users that use driver_override together with vfio-pci? AFAIK
they still need to write to bind/unbind.
Also i always liked the fact that the bind/unbind attributes make it very
easy in creating generic drivers. In fact, i am intending to use this feature
in order to add netlink support to the ACPI-WMI subsystem in the future.
I am planning to realize this thru a generic WMI driver that has to be manually
bound to a given WMI device to make it available over netlink, so having
users be able to write bind/unbind without potentially triggering a kernel panic
would be very nice.
Additionally, writing into the bind attribute still checks if the driver and the
device match:
/*
* Manually attach a device to a driver.
* Note: the driver must want to bind to the device,
* it is not possible to override the driver's id table.
*/
static ssize_t bind_store(struct device_driver *drv, const char *buf, size_t
count)
Because of this i would suggest that the taint (if at all) be added to the
driver_override attribute instead, because only with this attribute users can
bind
random drivers to truly random devices.
Thanks,
Armin Wolf
Finally, the bind/unbind files can find real use-after-free issues with
some drivers by forcing the process to happen virtually without having
to rely on manual removal processes. Those real bugs should still be
worked on, but by adding this taint flag, developers can more easily
determine bug reports that are actually worth looking at.
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
Changes in v3:
- Fixes based on sashiko review:
- Fix up prototype for when CONFIG_MODULES is disabled so it will
build properly, AGAIN.
- Link to v2:
https://patch.msgid.link/[email protected]
Changes in v2:
- rebase on 7.3-rc1
- Add changelog text to describe panic_on_taint and how it should be set
for tools like syzbot.
- Add changelog text to describe why 'Y' was picked.
- Fixes based on sashiko review:
- Make add_taint_module() handle a NULL for module pointer, fixing a
problem with built-in drivers.
- Fix up prototype for when CONFIG_MODULES is disabled so it will
actually build properly.
- rst table header fixes.
- Link to v1:
https://patch.msgid.link/[email protected]
To: Luis Chamberlain <[email protected]>
To: Petr Pavlu <[email protected]>
To: Daniel Gomez <[email protected]>
To: Sami Tolvanen <[email protected]>
To: Aaron Tomlin <[email protected]>
To: Jonathan Corbet <[email protected]>
To: Shuah Khan <[email protected]>
To: Randy Dunlap <[email protected]>
To: Greg Kroah-Hartman <[email protected]>
To: "Rafael J. Wysocki" <[email protected]>
To: Danilo Krummrich <[email protected]>
To: Steven Rostedt <[email protected]>
To: Masami Hiramatsu <[email protected]>
To: Mathieu Desnoyers <[email protected]>
Cc: [email protected]
Cc: [email protected]
Cc: [email protected]
Cc: [email protected]
Cc: [email protected]
---
Greg Kroah-Hartman (2):
module: pull out add_taint_module() to be public
driver core: add TAINT_FORCED_BIND for when userspace manually messes
with devices and drivers
Documentation/admin-guide/tainted-kernels.rst | 52 ++++++++++++++-------------
drivers/base/bus.c | 3 ++
include/linux/module.h | 10 ++++++
include/linux/panic.h | 3 +-
include/trace/events/module.h | 3 +-
kernel/module/main.c | 16 +++++++--
kernel/panic.c | 5 +--
tools/debugging/kernel-chktaint | 8 +++++
8 files changed, 69 insertions(+), 31 deletions(-)
---
base-commit: cee9395acd8043be0644b25c34bfa86623f2b935
change-id: 20260825-bind_taint-d4077b870bc4
Best regards,
--
Greg Kroah-Hartman <[email protected]>
From mboxrd@z Thu Jan 1 00:00:00 1970
Received: from smtp.kernel.org
(aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(No client certificate requested)
by smtp.subspace.kernel.org (Postfix) with ESMTPS id BCB7D415F06;
Fri, 4 Sep 2026 05:12:34 +0000 (UTC)
Authentication-Results: smtp.subspace.kernel.org; arc=none
smtp.client-ip=100.103.45.18
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
t=1788498755; cv=none;
b=YVFqay1IJUVOWRhF5lbF49N9gACjWl/u/wiBGdeV8d9eqXk9mnp+dQ6eyjskPf1vqMRfNXCLudsRqs7s/ptpX2bQJsQ4PyAt97qclTSJBOznKuYqjuVxufSShWBSj6iGoGnZcQw+e2Q9Ly6ixw+Q323AmyXIc+H/caHtjxakuHk=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
s=arc-20240116; t=1788498755; c=relaxed/simple;
bh=pLyyPJCavNnqg1J4ue9yK5PlAmiMR++3Z8v4Ev3jR+4=;
h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References:
In-Reply-To:To:Cc;
b=NoNrP4+kG51E+VUVjTQ7eZBG8DJ4QJdPSX7nXCHR7qNw1HzTheBF+APlqE/yPFE/HDXCloQq6PsRH784NlK0lTDBu81Xo9PlS0QhLQkafpUGps8FcEw2pQZxbhT+91ISzyOG0uOnSka9ty7gwBGsyKlxA8KNYgFLv4Jpuyl3CxU=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit
key) header.d=linuxfoundation.org [email protected]
header.b=ucn4lrR/; arc=none smtp.client-ip=100.103.45.18
Authentication-Results: smtp.subspace.kernel.org;
dkim=pass (1024-bit key) header.d=linuxfoundation.org
[email protected] header.b="ucn4lrR/"
Received: by smtp.kernel.org (Postfix) with ESMTPSA id 003711F00A3E;
Fri, 4 Sep 2026 05:12:33 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org;
s=korg; t=1788498754;
bh=KrAwo9/bReRcHGrb+EIOBXbKoLVbmnWAiqQj4hM9GR4=;
h=From:Date:Subject:References:In-Reply-To:To:Cc;
b=ucn4lrR/Wvs8Hzz+jBIP38JWRP4T8gs3TOfl/opgMz+qXDSpJTTmTld3GSYkHx+b1
pqksgdzktExbEkSrSC3Poy+I6JfuzXpXH199wNaRrrq4ei16vWNsuDsnGyxgiHzh0C
nbHTwZKC7lvKjyIz2vK00XrqIQLoA4eUS5NrG24U=
From: Greg Kroah-Hartman <[email protected]>
Date: Fri, 04 Sep 2026 07:10:41 +0200
Subject: [PATCH v3 1/2] module: pull out add_taint_module() to be public
Precedence: bulk
X-Mailing-List: [email protected]
List-Id: <linux-modules.vger.kernel.org>
List-Subscribe: <mailto:[email protected]>
List-Unsubscribe: <mailto:[email protected]>
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
Message-Id: <[email protected]>
References: <[email protected]>
In-Reply-To: <[email protected]>
To: Luis Chamberlain <[email protected]>, Petr Pavlu <[email protected]>,
Daniel Gomez <[email protected]>, Sami Tolvanen <[email protected]>,
Aaron Tomlin <[email protected]>, Jonathan Corbet <[email protected]>,
Shuah Khan <[email protected]>,
Randy Dunlap <[email protected]>,
"Rafael J. Wysocki" <[email protected]>, Danilo Krummrich <[email protected]>,
Steven Rostedt <[email protected]>,
Masami Hiramatsu <[email protected]>,
Mathieu Desnoyers <[email protected]>
Cc: Bradley Morgan <[email protected]>,
Aleksandr Nogikh <[email protected]>, [email protected],
[email protected], [email protected],
[email protected], [email protected],
[email protected],
Greg Kroah-Hartman <[email protected]>,
Johan Hovold <[email protected]>
X-Mailer: b4 0.17-dev-362b8
X-Developer-Signature: v=1; a=openpgp-sha256; l=2682;
[email protected]; h=from:subject:message-id;
bh=pLyyPJCavNnqg1J4ue9yK5PlAmiMR++3Z8v4Ev3jR+4=;
b=owGbwMvMwCRo6H6F97bub03G02pJDFmzgq4fWPbWcV/uvHnfg/ZMrU9bv71xatg7tVk7novmL
1mmFli4riOWhUGQiUFWTJHlyzaeo/srDil6GdqehpnDygQyhIGLUwAmosTDMIdTKWjC6aIHLY+P
emcEXORcfPbdG0mGuULdv/erqSxsnFs4z/HElrKuTU5rdAE=
X-Developer-Key: [email protected]; a=openpgp;
fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29
Other kernel code might want to call add_taint_module() so pull it out
and make it global. If modules are not enabled, this defaults to a call
to add_taint(), so all is fine.
Reviewed-by: Johan Hovold <[email protected]>
Tested-by: Johan Hovold <[email protected]>
Reviewed-by: Bradley Morgan <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
include/linux/module.h | 10 ++++++++++
kernel/module/main.c | 16 +++++++++++++---
2 files changed, 23 insertions(+), 3 deletions(-)
diff --git a/include/linux/module.h b/include/linux/module.h
index 96cc98568eea..f6f90cd88f15 100644
--- a/include/linux/module.h
+++ b/include/linux/module.h
@@ -29,6 +29,7 @@
#include <linux/srcu.h>
#include <linux/static_call_types.h>
#include <linux/dynamic_debug.h>
+#include <linux/panic.h>
#include <linux/percpu.h>
#include <asm/module.h>
@@ -770,6 +771,9 @@ static inline bool is_livepatch_module(struct module *mod)
void module_for_each_mod(int(*func)(struct module *mod, void *data), void *data);
+void add_taint_module(struct module *mod, unsigned flag,
+ enum lockdep_ok lockdep_ok);
+
#else /* !CONFIG_MODULES... */
static inline struct module *__module_address(unsigned long addr)
@@ -877,6 +881,12 @@ static inline bool module_is_coming(struct module *mod)
static inline void module_for_each_mod(int(*func)(struct module *mod, void
*data), void *data)
{
}
+
+static inline void add_taint_module(struct module *mod, unsigned flag,
+ enum lockdep_ok lockdep_ok)
+{
+ add_taint(flag, lockdep_ok);
+}
#endif /* CONFIG_MODULES */
#ifdef CONFIG_SYSFS
diff --git a/kernel/module/main.c b/kernel/module/main.c
index d0e1e0bd2ad0..444d990c9983 100644
--- a/kernel/module/main.c
+++ b/kernel/module/main.c
@@ -191,11 +191,21 @@ static inline int strong_try_module_get(struct module
*mod)
return -ENOENT;
}
-static inline void add_taint_module(struct module *mod, unsigned flag,
- enum lockdep_ok lockdep_ok)
+/**
+ * add_taint_module: add a taint flag if not already set for a specific module
+ * @mod: pointer to the module that caused the problem
+ * @flag: one of the TAINT_* constants.
+ * @lockdep_ok: whether lock debugging is still OK.
+ *
+ * If something bad has gone wrong, you'll want @lockdebug_ok = false, but for
+ * some noteworthy-but-not-corrupting cases, it can be set to true.
+ */
+void add_taint_module(struct module *mod, unsigned flag,
+ enum lockdep_ok lockdep_ok)
{
add_taint(flag, lockdep_ok);
- set_bit(flag, &mod->taints);
+ if (mod)
+ set_bit(flag, &mod->taints);
}
/*
