sys/linux: add basic examples of vusb variants

This change is the first step in addressing issue [1].

Despite syzkaller's best efforts, some usb drivers are proving
resistant to attempts to probe them. Specifically, crafted
devices are not accurate enough to bypass checks in probe().
These checks mostly deal with usb interfaces and endpoints.

One way to address this issue is to define syz_connect_* calls
variants to help syzkaller succeed probing by describing in detail
various device attributes.

Start by describing such calls for select drivers, each representing
its own category of sorts. At the moment, code coverage for these
drivers is unimpressive:

- rtl8150
Used to succeed probing until a better usb endpoint check was implemented.

- sierra_net
Same as rtl8150. Depends on usbnet API for bind() and usb ep checks.

- lan78xx
Requires numerous control requests between driver and device DURING probe.
Extra descriptions are helpful but are not enough to fully complete
probing process.

Also, add a seed for each such example.

This is only a stepping stone to improve usb fuzzing results and most
likely will be subject to change in the future.

[1] https://github.com/google/syzkaller/issues/6206

1 files changed, 21 insertions, 0 deletions

diff --git a/sys/linux/test/vusb_sierra_net b/sys/linux/test/vusb_sierra_net
new file mode 100644
index 000000000..482f7619f
--- /dev/null
+++ b/sys/linux/test/vusb_sierra_net
@@ -0,0 +1,21 @@
+# This seed helps syzkaller to reliably pass the probe() checks for sierra_net driver.
+# As some CTRL requests occur during the probe, a few syz_usb_control_io() calls may
+# be in a weird order or even duplicate.
+
+# Ensure that we pass driver-specific basic usb interface and endpoint checks during initial probe() stages.
+
+r0 = syz_usb_connect$sierra_net(0x0, 0x3f, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x1199, 0x68a3, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x0, 0x80, 0xfa, {{0x9, 0x4, 0x7, 0x0, 0x3, 0xff, 0x0, 0x0, 0x0, "", {{0x9, 0x5, 0x43978451d8f6fedb, 0x2, 0x40, 0x2, 0x1b, 0xfe, ""}, {0x9, 0x5, 0x7, 0x2, 0x200, 0xc, 0x77, 0x3, ""}, {0x9, 0x5, 0x81, 0x3, 0x20, 0x0, 0xfd, 0x32, ""}}}}}}]}}, 0x0)
+
+# To pass the probe, at the minumum one has to make the crafted device write to the driver in sierra_net_get_fw_attr(), see:
+# https://elixir.bootlin.com/linux/v6.16/source/drivers/net/usb/sierra_net.c#L636
+# Technically, there are other CTRL requests, such as the ones in sierra_net_dosync() - however, they are allowed to fail, so we can ignore them.
+
+# Seemingly, this call is only here to keep the timing right. 
+# TODO: fix the expected delay with sleep/nanosleep.
+
+syz_usb_control_io$sierra_net(r0, 0x0, 0x0)
+
+# Send a CTRL request to driver concerning firmware data. See:
+# https://elixir.bootlin.com/linux/v6.16/source/drivers/net/usb/sierra_net.c#L743
+
+syz_usb_control_io$sierra_net(r0, &(0x7f0000000100)={0x14, &(0x7f0000000000)={0x20, 0x21, 0x8, {0x8, 0x11, "e4ff14eca81f"}}, 0x0}, 0x0)