diff options
Diffstat (limited to 'executor/common_usb_linux.h')
| -rw-r--r-- | executor/common_usb_linux.h | 57 |
1 files changed, 47 insertions, 10 deletions
diff --git a/executor/common_usb_linux.h b/executor/common_usb_linux.h index ff549b2d4..935b30df2 100644 --- a/executor/common_usb_linux.h +++ b/executor/common_usb_linux.h @@ -170,6 +170,24 @@ static int lookup_interface(int fd, uint8 bInterfaceNumber, uint8 bAlternateSett } #endif // SYZ_EXECUTOR || __NR_syz_usb_control_io +#if SYZ_EXECUTOR || __NR_syz_usb_ep_write || __NR_syz_usb_ep_read +static int lookup_endpoint(int fd, uint8 bEndpointAddress) +{ + struct usb_device_index* index = lookup_usb_index(fd); + int ep; + + if (!index) + return -1; + if (index->iface_cur < 0) + return -1; + + for (ep = 0; index->ifaces[index->iface_cur].eps_num; ep++) + if (index->ifaces[index->iface_cur].eps[ep].desc.bEndpointAddress == bEndpointAddress) + return index->ifaces[index->iface_cur].eps[ep].handle; + return -1; +} +#endif // SYZ_EXECUTOR || __NR_syz_usb_ep_write || __NR_syz_usb_ep_read + static void set_interface(int fd, int n) { struct usb_device_index* index = lookup_usb_index(fd); @@ -180,21 +198,26 @@ static void set_interface(int fd, int n) if (index->iface_cur >= 0 && index->iface_cur < index->ifaces_num) { for (ep = 0; ep < index->ifaces[index->iface_cur].eps_num; ep++) { - int rv = usb_raw_ep_disable(fd, ep); + int rv = usb_raw_ep_disable(fd, index->ifaces[index->iface_cur].eps[ep].handle); if (rv < 0) { - debug("set_interface: failed to disable endpoint %d\n", ep); + debug("set_interface: failed to disable endpoint 0x%02x\n", + index->ifaces[index->iface_cur].eps[ep].desc.bEndpointAddress); } else { - debug("set_interface: endpoint %d disabled\n", ep); + debug("set_interface: endpoint 0x%02x disabled\n", + index->ifaces[index->iface_cur].eps[ep].desc.bEndpointAddress); } } } if (n >= 0 && n < index->ifaces_num) { for (ep = 0; ep < index->ifaces[n].eps_num; ep++) { - int rv = usb_raw_ep_enable(fd, &index->ifaces[n].eps[ep]); + int rv = usb_raw_ep_enable(fd, &index->ifaces[n].eps[ep].desc); if (rv < 0) { - debug("set_interface: failed to enable endpoint %d\n", ep); + debug("set_interface: failed to enable endpoint 0x%02x\n", + index->ifaces[n].eps[ep].desc.bEndpointAddress); } else { - debug("set_interface: endpoint %d enabled as %d\n", ep, rv); + debug("set_interface: endpoint 0x%02x enabled as %d\n", + index->ifaces[n].eps[ep].desc.bEndpointAddress, rv); + index->ifaces[n].eps[ep].handle = rv; } } index->iface_cur = n; @@ -496,12 +519,19 @@ static volatile long syz_usb_control_io(volatile long a0, volatile long a1, vola static volatile long syz_usb_ep_write(volatile long a0, volatile long a1, volatile long a2, volatile long a3) { int fd = a0; - uint16 ep = a1; + uint8 ep = a1; uint32 len = a2; char* data = (char*)a3; + int ep_handle = lookup_endpoint(fd, ep); + if (ep_handle < 0) { + debug("syz_usb_ep_write: endpoint not found\n"); + return -1; + } + debug("syz_usb_ep_write: endpoint handle: %d\n", ep_handle); + struct usb_raw_ep_io_data io_data; - io_data.inner.ep = ep; + io_data.inner.ep = ep_handle; io_data.inner.flags = 0; if (len > sizeof(io_data.data)) len = sizeof(io_data.data); @@ -524,12 +554,19 @@ static volatile long syz_usb_ep_write(volatile long a0, volatile long a1, volati static volatile long syz_usb_ep_read(volatile long a0, volatile long a1, volatile long a2, volatile long a3) { int fd = a0; - uint16 ep = a1; + uint8 ep = a1; uint32 len = a2; char* data = (char*)a3; + int ep_handle = lookup_endpoint(fd, ep); + if (ep_handle < 0) { + debug("syz_usb_ep_read: endpoint not found\n"); + return -1; + } + debug("syz_usb_ep_read: endpoint handle: %d\n", ep_handle); + struct usb_raw_ep_io_data io_data; - io_data.inner.ep = ep; + io_data.inner.ep = ep_handle; io_data.inner.flags = 0; if (len > sizeof(io_data.data)) len = sizeof(io_data.data); |