sys/linux: add missing descriptions for autofs ioctls

3 files changed, 165 insertions, 1 deletions

diff --git a/sys/linux/fs_ioctl_autofs.txt b/sys/linux/fs_ioctl_autofs.txt
new file mode 100644
index 000000000..0db7c0ca2
--- /dev/null
+++ b/sys/linux/fs_ioctl_autofs.txt
@@ -0,0 +1,125 @@
+# Copyright 2021 syzkaller project authors. All rights reserved.
+# Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.
+
+include <uapi/linux/fs.h>
+include <uapi/linux/auto_fs.h>
+include <uapi/linux/auto_dev-ioctl.h>
+
+# Root directory ioctls.
+
+# TODO: connect this with wait queues, once we have descriptions for them.
+type autofs_wqt_t intptr
+autofs_exp_how = AUTOFS_EXP_NORMAL, AUTOFS_EXP_IMMEDIATE, AUTOFS_EXP_LEAVES, AUTOFS_EXP_FORCED
+
+ioctl$AUTOFS_IOC_READY(fd fd, cmd const[AUTOFS_IOC_READY], arg autofs_wqt_t)
+ioctl$AUTOFS_IOC_FAIL(fd fd, cmd const[AUTOFS_IOC_FAIL], arg autofs_wqt_t)
+ioctl$AUTOFS_IOC_CATATONIC(fd fd, cmd const[AUTOFS_IOC_CATATONIC], arg const[0])
+ioctl$AUTOFS_IOC_PROTOVER(fd fd, cmd const[AUTOFS_IOC_PROTOVER], arg ptr[out, int32])
+ioctl$AUTOFS_IOC_PROTOSUBVER(fd fd, cmd const[AUTOFS_IOC_PROTOSUBVER], arg ptr[out, int32])
+ioctl$AUTOFS_IOC_SETTIMEOUT(fd fd, cmd const[AUTOFS_IOC_PROTOSUBVER], arg ptr[in, int64])
+ioctl$AUTOFS_IOC_ASKUMOUNT(fd fd, cmd const[AUTOFS_IOC_ASKUMOUNT], arg ptr[out, int32])
+ioctl$AUTOFS_IOC_EXPIRE(fd fd, cmd const[AUTOFS_IOC_EXPIRE], arg ptr[in, autofs_packet_expire])
+ioctl$AUTOFS_IOC_EXPIRE_MULTI(fd fd, cmd const[AUTOFS_IOC_EXPIRE_MULTI], arg ptr[in, flags[autofs_exp_how, int32]])
+
+define AUTOFS_NAME_MAX	NAME_MAX + 1
+
+autofs_packet_hdr {
+	proto_version	int32
+	type		int32
+}
+
+autofs_packet_expire {
+	hdr	autofs_packet_hdr
+	len	len[name, int32]
+	name	string[filename, AUTOFS_NAME_MAX]
+}
+
+# Communication via /dev/autofs.
+
+autofs_args_protover {
+	version	int32
+}
+
+autofs_args_protosubver {
+	sub_version	int32
+}
+
+autofs_args_openmount {
+	devid	int32
+}
+
+autofs_args_ready {
+	token	int32
+}
+
+autofs_args_fail {
+	token	int32
+	status	int32
+}
+
+autofs_args_setpipefd {
+	pipefd	fd
+}
+
+autofs_args_timeout {
+	timeout	int64
+}
+
+autofs_args_requester {
+	uid	uid
+	gid	gid
+}
+
+autofs_args_expire {
+	how	flags[autofs_exp_how, int32]
+}
+
+autofs_args_askumount {
+	may_umount	int32
+}
+
+autofs_type = AUTOFS_TYPE_ANY, AUTOFS_TYPE_INDIRECT, AUTOFS_TYPE_DIRECT, AUTOFS_TYPE_OFFSET
+
+autofs_args_ismountpoint_in {
+	type	flags[autofs_type, int32]
+}
+
+autofs_args_ismountpoint_out {
+	devid	int32	(out)
+	magic	int32	(out)
+}
+
+autofs_args_ismountpoint [
+	in_args		autofs_args_ismountpoint_in	(in)
+	out_args	autofs_args_ismountpoint_out	(out)
+]
+
+# autofs_dev_ioctl struct has a union of command-specific structs, so we must pad it to
+# the maximum size.
+type autofs_dev_ioctl_base[NESTED] {
+	ver_major	const[AUTOFS_DEV_IOCTL_VERSION_MAJOR, int32]
+	ver_minor	const[AUTOFS_DEV_IOCTL_VERSION_MINOR, int32]
+	size		len[parent, int32]
+	ioctlfd		fd
+	content		NESTED
+} [size[AUTOFS_DEV_IOCTL_SIZE]]
+
+type autofs_dev_ioctl[NESTED] {
+	base	autofs_dev_ioctl_base[NESTED]
+	path	filename
+}
+
+ioctl$AUTOFS_DEV_IOCTL_VERSION(fd fd_autofs, cmd const[AUTOFS_DEV_IOCTL_VERSION], arg ptr[inout, autofs_dev_ioctl[void]])
+ioctl$AUTOFS_DEV_IOCTL_PROTOVER(fd fd_autofs, cmd const[AUTOFS_DEV_IOCTL_PROTOVER], arg ptr[inout, autofs_dev_ioctl[autofs_args_protover]])
+ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(fd fd_autofs, cmd const[AUTOFS_DEV_IOCTL_PROTOSUBVER], arg ptr[inout, autofs_dev_ioctl[autofs_args_protosubver]])
+ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(fd fd_autofs, cmd const[AUTOFS_DEV_IOCTL_OPENMOUNT], arg ptr[inout, autofs_dev_ioctl[autofs_args_openmount]])
+ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(fd fd_autofs, cmd const[AUTOFS_DEV_IOCTL_CLOSEMOUNT], arg ptr[inout, autofs_dev_ioctl[void]])
+ioctl$AUTOFS_DEV_IOCTL_READY(fd fd_autofs, cmd const[AUTOFS_DEV_IOCTL_READY], arg ptr[inout, autofs_dev_ioctl[autofs_args_ready]])
+ioctl$AUTOFS_DEV_IOCTL_FAIL(fd fd_autofs, cmd const[AUTOFS_DEV_IOCTL_FAIL], arg ptr[inout, autofs_dev_ioctl[autofs_args_fail]])
+ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(fd fd_autofs, cmd const[AUTOFS_DEV_IOCTL_SETPIPEFD], arg ptr[inout, autofs_dev_ioctl[autofs_args_setpipefd]])
+ioctl$AUTOFS_DEV_IOCTL_CATATONIC(fd fd_autofs, cmd const[AUTOFS_DEV_IOCTL_CATATONIC], arg ptr[inout, autofs_dev_ioctl[void]])
+ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(fd fd_autofs, cmd const[AUTOFS_DEV_IOCTL_TIMEOUT], arg ptr[inout, autofs_dev_ioctl[autofs_args_timeout]])
+ioctl$AUTOFS_DEV_IOCTL_REQUESTER(fd fd_autofs, cmd const[AUTOFS_DEV_IOCTL_REQUESTER], arg ptr[inout, autofs_dev_ioctl[autofs_args_requester]])
+ioctl$AUTOFS_DEV_IOCTL_EXPIRE(fd fd_autofs, cmd const[AUTOFS_DEV_IOCTL_EXPIRE], arg ptr[inout, autofs_dev_ioctl[autofs_args_expire]])
+ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(fd fd_autofs, cmd const[AUTOFS_DEV_IOCTL_ASKUMOUNT], arg ptr[inout, autofs_dev_ioctl[autofs_args_askumount]])
+ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(fd fd_autofs, cmd const[AUTOFS_DEV_IOCTL_ISMOUNTPOINT], arg ptr[inout, autofs_dev_ioctl[autofs_args_ismountpoint]])
diff --git a/sys/linux/fs_ioctl_autofs.txt.const b/sys/linux/fs_ioctl_autofs.txt.const
new file mode 100644
index 000000000..1a2598e94
--- /dev/null
+++ b/sys/linux/fs_ioctl_autofs.txt.const
@@ -0,0 +1,37 @@
+# Code generated by syz-sysgen. DO NOT EDIT.
+arches = 386, amd64, arm, arm64, mips64le, ppc64le, riscv64, s390x
+AUTOFS_DEV_IOCTL_ASKUMOUNT = 3222836093
+AUTOFS_DEV_IOCTL_CATATONIC = 3222836089
+AUTOFS_DEV_IOCTL_CLOSEMOUNT = 3222836085
+AUTOFS_DEV_IOCTL_EXPIRE = 3222836092
+AUTOFS_DEV_IOCTL_FAIL = 3222836087
+AUTOFS_DEV_IOCTL_ISMOUNTPOINT = 3222836094
+AUTOFS_DEV_IOCTL_OPENMOUNT = 3222836084
+AUTOFS_DEV_IOCTL_PROTOSUBVER = 3222836083
+AUTOFS_DEV_IOCTL_PROTOVER = 3222836082
+AUTOFS_DEV_IOCTL_READY = 3222836086
+AUTOFS_DEV_IOCTL_REQUESTER = 3222836091
+AUTOFS_DEV_IOCTL_SETPIPEFD = 3222836088
+AUTOFS_DEV_IOCTL_SIZE = 24
+AUTOFS_DEV_IOCTL_TIMEOUT = 3222836090
+AUTOFS_DEV_IOCTL_VERSION = 3222836081
+AUTOFS_DEV_IOCTL_VERSION_MAJOR = 1
+AUTOFS_DEV_IOCTL_VERSION_MINOR = 1
+AUTOFS_EXP_FORCED = 4
+AUTOFS_EXP_IMMEDIATE = 1
+AUTOFS_EXP_LEAVES = 2
+AUTOFS_EXP_NORMAL = 0
+AUTOFS_IOC_ASKUMOUNT = 2147783536, mips64le:ppc64le:1074041712
+AUTOFS_IOC_CATATONIC = 37730, mips64le:ppc64le:536908642
+AUTOFS_IOC_EXPIRE = 2165085029, mips64le:ppc64le:1091343205
+AUTOFS_IOC_EXPIRE_MULTI = 1074041702, mips64le:ppc64le:2147783526
+AUTOFS_IOC_FAIL = 37729, mips64le:ppc64le:536908641
+AUTOFS_IOC_PROTOSUBVER = 2147783527, mips64le:ppc64le:1074041703
+AUTOFS_IOC_PROTOVER = 2147783523, mips64le:ppc64le:1074041699
+AUTOFS_IOC_READY = 37728, mips64le:ppc64le:536908640
+AUTOFS_NAME_MAX = 256
+AUTOFS_TYPE_ANY = 0
+AUTOFS_TYPE_DIRECT = 2
+AUTOFS_TYPE_INDIRECT = 1
+AUTOFS_TYPE_OFFSET = 4
+__NR_ioctl = 54, amd64:16, arm64:riscv64:29, mips64le:5015
diff --git a/sys/linux/sys.txt b/sys/linux/sys.txt
index bf82645ee..39ae0501c 100644
--- a/sys/linux/sys.txt
+++ b/sys/linux/sys.txt
@@ -596,6 +596,8 @@ close_range(fd fd, max_fd fd, flags flags[close_range_flags])
 # Disable it for now.
 #syz_open_dev$console(dev ptr[in, string["/dev/console"]], id const[0], flags flags[open_flags]) fd
 
+resource fd_autofs[fd]
+
 # These devices are relatively safe (don't reboot and don't corrupt kernel memory).
 # They need a more comprehensive support. But let at least open them for now,
 # maybe fuzzer will be able to skrew them in a useful way.
@@ -616,7 +618,7 @@ openat$full(fd const[AT_FDCWD], file ptr[in, string["/dev/full"]], flags flags[o
 openat$irnet(fd const[AT_FDCWD], file ptr[in, string["/dev/irnet"]], flags flags[open_flags], mode const[0]) fd
 openat$hwrng(fd const[AT_FDCWD], file ptr[in, string["/dev/hwrng"]], flags flags[open_flags], mode const[0]) fd
 openat$hpet(fd const[AT_FDCWD], file ptr[in, string["/dev/hpet"]], flags flags[open_flags], mode const[0]) fd
-openat$autofs(fd const[AT_FDCWD], file ptr[in, string["/dev/autofs"]], flags flags[open_flags], mode const[0]) fd
+openat$autofs(fd const[AT_FDCWD], file ptr[in, string["/dev/autofs"]], flags flags[open_flags], mode const[0]) fd_autofs
 openat$keychord(fd const[AT_FDCWD], file ptr[in, string["/dev/keychord"]], flags flags[open_flags], mode const[0]) fd
 openat$zygote(fd const[AT_FDCWD], file ptr[in, string["/dev/socket/zygote"]], flags flags[open_flags], mode const[0]) fd
 openat$sw_sync(fd const[AT_FDCWD], file ptr[in, string["/dev/sw_sync"]], flags flags[open_flags], mode const[0]) fd