executor/common_linux.h: add syz_fuse_handle_req()

At the moment syzkaller is able to respond to FUSE with a syntactically
correct response using the specific write$FUSE_*() syscalls, but most of
the times these responses are not related to the type of request that
was received.
With this pseudo-syscall we are able to provide the correct response
type while still allowing the fuzzer to fuzz its content. This is done
by requiring each type of response as an input parameter and then
choosing the correct one based on the request opcode.
Notice that the fuzzer is still free to mix write$FUSE_*() and
syz_fuse_handle_req() syscalls, so it is not losing any degree of
freedom.

syz_fuse_handle_req() retrieves the FUSE request and resource
fuse_unique internally (by performing a read() on the /dev/fuse file
descriptor provided as input). For this reason, a new template argument has
been added to fuse_out (renamed to _fuse_out) so that the unique field
can be both an int64 (used by syz_fuse_handle_req()) and a fuse_unique
resource (used by the write$FUSE_*() syscalls) without any code
duplication.

1 files changed, 13 insertions, 2 deletions

diff --git a/pkg/host/syscalls_linux.go b/pkg/host/syscalls_linux.go
index 06e9a261f..192e88100 100644
--- a/pkg/host/syscalls_linux.go
+++ b/pkg/host/syscalls_linux.go
@@ -250,6 +250,16 @@ func isBtfVmlinuxSupported(c *prog.Syscall, target *prog.Target, sandbox string)
 	return onlySandboxNone(sandbox)
 }
 
+func isSyzFuseSupported(c *prog.Syscall, target *prog.Target, sandbox string) (bool, string) {
+	if ok, reason := isSupportedFilesystem("fuse"); !ok {
+		return ok, reason
+	}
+	if ok, reason := onlySandboxNoneOrNamespace(sandbox); !ok {
+		return false, reason
+	}
+	return true, ""
+}
+
 var syzkallSupport = map[string]func(*prog.Syscall, *prog.Target, string) (bool, string){
 	"syz_open_dev":                isSyzOpenDevSupported,
 	"syz_open_procfs":             alwaysSupported,
@@ -274,8 +284,9 @@ var syzkallSupport = map[string]func(*prog.Syscall, *prog.Target, string) (bool,
 	"syz_io_uring_setup":          isSyzIoUringSupported,
 	// syz_memcpy_off is only used for io_uring descriptions, thus, enable it
 	// only if io_uring syscalls are enabled.
-	"syz_memcpy_off":     isSyzIoUringSupported,
-	"syz_btf_id_by_name": isBtfVmlinuxSupported,
+	"syz_memcpy_off":      isSyzIoUringSupported,
+	"syz_btf_id_by_name":  isBtfVmlinuxSupported,
+	"syz_fuse_handle_req": isSyzFuseSupported,
 }
 
 func isSupportedSyzkall(c *prog.Syscall, target *prog.Target, sandbox string) (bool, string) {