| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| | |
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
This patch extends the USB audio fuzzing support by adding syzlang
descriptions for:
- UAC2 (USB Audio Class 2.0) devices with clock management units,
interface association descriptors, and extended format types.
- UAC3 (USB Audio Class 3.0) devices including power domain
descriptors and cluster information segments.
- USB MIDI devices with jack descriptors and streaming endpoints.
A new generateAudioDeviceDescriptor function patches in both
auto-extracted USB IDs from the kernel driver matching rules and
hardcoded quirk IDs from the USB audio driver sources (sound/usb/).
This approach follows the pattern established for the HID and printer
classes, allowing exercising driver quirks that cannot be automatically
extracted.
The config descriptor template now includes an EXTRA field to support
Interface Association Descriptors required by UAC2/UAC3. This also
requires adjusting the interface field index in patchUsbDeviceID.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
This change is the first step in addressing issue [1].
Despite syzkaller's best efforts, some usb drivers are proving
resistant to attempts to probe them. Specifically, crafted
devices are not accurate enough to bypass checks in probe().
These checks mostly deal with usb interfaces and endpoints.
One way to address this issue is to define syz_connect_* calls
variants to help syzkaller succeed probing by describing in detail
various device attributes.
Start by describing such calls for select drivers, each representing
its own category of sorts. At the moment, code coverage for these
drivers is unimpressive:
- rtl8150
Used to succeed probing until a better usb endpoint check was implemented.
- sierra_net
Same as rtl8150. Depends on usbnet API for bind() and usb ep checks.
- lan78xx
Requires numerous control requests between driver and device DURING probe.
Extra descriptions are helpful but are not enough to fully complete
probing process.
Also, add a seed for each such example.
This is only a stepping stone to improve usb fuzzing results and most
likely will be subject to change in the future.
[1] https://github.com/google/syzkaller/issues/6206
|
|
|
This reduces number of const files/lines from 1288/96599 to 158/11603.
Const files are generated on next-20200813.
Update #1983
|
