Re: [PATCH v3 2/2] driver core: add TAINT_FORCED_BIND for when userspace manually messes with devices and drivers

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Tainting the kernel unconditionally on any sysfs bind/unbind operation marks legitimate, standard virtualization and networking setups as tainted.
--

commit 5047195fb07d09f62b1e24672350bc622948fa9e
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

driver core: add TAINT_FORCED_BIND for when userspace manually messes with devices and drivers

This commit adds a new TAINT_FORCED_BIND flag to track when userspace binds
or unbinds devices via sysfs, aiming to flag potentially unstable fuzzing or
unsupported states. It sets this taint flag unconditionally in the sysfs bind
and unbind store callbacks.

> diff --git a/drivers/base/bus.c b/drivers/base/bus.c
> index d17bd91490ee4..c51ad96d4de4b 100644
> --- a/drivers/base/bus.c
> +++ b/drivers/base/bus.c
[ ... ]
> @@ -241,6 +242,7 @@ static ssize_t unbind_store(struct device_driver *drv, const char *buf,
>  
>  	dev = bus_find_device_by_name(bus, NULL, buf);
>  	if (dev && dev->driver == drv) {
> +		add_taint_module(drv->owner, TAINT_FORCED_BIND, LOCKDEP_STILL_OK);

[Severity: High]
Will this unconditionally taint the kernel during officially supported unbind
operations? The sysfs unbind file is the documented UAPI for legitimate
subsystems and setups like VFIO PCI passthrough, DPDK, and USB over IP. 

Applying this taint for standard operations might cause normal enterprise
environments to be permanently marked as tainted, causing valid bug reports
to be ignored, and could trigger panics on systems running with panic_on_taint
enabled.

>  		device_driver_detach(dev);
>  		err = count;
>  	}
[ ... ]
> @@ -264,6 +266,7 @@ static ssize_t bind_store(struct device_driver *drv, const char *buf,
>  
>  	dev = bus_find_device_by_name(bus, NULL, buf);
>  	if (dev && driver_match_device(drv, dev)) {
> +		add_taint_module(drv->owner, TAINT_FORCED_BIND, LOCKDEP_STILL_OK);

[Severity: High]
Similarly, will this mark the kernel as tainted when standard virtualization
daemons or userspace networking tools write to the bind file? Is there a way
to distinguish between abusive fuzzing attempts and normal administrative
actions so we do not invalidate valid bug reports from these common setups?

>  		err = device_driver_attach(drv, dev);
>  		if (!err) {
>  			/* success */

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260904-bind_taint-v3-0-30025465f38a@linuxfoundation.org?part=2