aboutsummaryrefslogtreecommitdiffstats
path: root/sys/linux
Commit message (Collapse)AuthorAgeFilesLines
* sys/linux: update unix socket syscall descriptionsChristian Resell2021-07-291-4/+26
| | | | | | | Add recvmsg$unix() and recvmmsg$unix(). Update sendmmsg$unix to use the correct type, the old description was using an array of struct msghdr instead of struct mmsghdr. Set addr field of msghdr structs to optional.
* sys/linux: update constsZi Fan Tan2021-07-286-131/+24
| | | | | | | Update dev_vhci consts as they were updated to use inclusive language in commit 3d4f9c00492b and 6397729bb74d. Remove caif_hsi consts as they were removed in commit ca75bcf0a83b. Remove raw driver ioctls as they were removed in commit 603e4922f1c8.
* sys/linux: minor fix of random dev syscall descriptionCongyu Liu2021-07-261-1/+1
| | | | Syscall `openat$random` should open /dev/random device.
* executor/common_kvm_ppc64: run with enabled MMUAlexey Kardashevskiy2021-07-192-1/+13
| | | | | | | | | | | | | | | | | | | | | This sets up a page table to map the text in order to exercise more code paths in the KVM. This defines flags to control the MMU state. When enabled, this creates a simple page table at the 64K offset and maps all the RAM. The fuzzer code is placed right after the table. The flags are: IR - enables MMU for instruction fetches DR - enables MMU for data loads/stores PR - "problem state", i.e. userspace (implies DR and IR) PID1 - initializes a process table for PID>0 (PID#0 is used by the VM OS normally) This adds a simple "syz_kvm_setup_cpu_ppc64" syz-test with MSR=IR|DR|LE which is a typical Linux kernel mode. Signed-off-by: Alexey Kardashevskiy <aik@linux.ibm.com>
* executor/common_kvm_ppc64: fix KVM supportAlexey Kardashevskiy2021-07-191-1/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | Turns out the ifuzz on powerpc did not ever properly work. This fixes syz_kvm_setup_cpu$ppc64: Enable the PAPR KVM capability (otherwise KVM_RUN fails right away). Finish generated sequences with the software debug breakpoint as there is no x86's "hlt" variant on POWER and otherwise KVM won't exit. Add exception handlers, use the software debug breakpoint instruction to trigger immediate exit from KVM with the only exception of the decrementer interrupt handler (timer) to recharge the timer and continue. Define and use endianness selection flag (Big vs. Little endian). Define the code generator similar to kvm_gen.cc which for now contains 2 simple tests and the decrementer interrupt handler code. Add test cases to the executor so "bin/linux_ppc64le/syz-executor test" can run some sensible tests. The tests copy 0xbadc0de around similar to x86 and uses gpr[3] is a return value register (similar to EAX). Signed-off-by: Alexey Kardashevskiy <aik@linux.ibm.com>
* pkg: update generated files to go 1.17Alexey Kardashevskiy2021-07-071-0/+1
| | | | | | | | | | | "make generate" produces this diff when go 1.17 (go1.17-c95464f0ea3f==upstream) is used. Seems compatible with >=1.16. https://github.com/golang/go/commit/4d2d89ff42ca documents the syntax. https://github.com/golang/go/commit/eeadce2d8713 enforces "ignore" for unsatisfiable tags hence the pkg/csource/gen.go change. Signed-off-by: Alexey Kardashevskiy <aik@linux.ibm.com>
* all: support exclude globs in descriptorJoey Jiao2021-06-021-1/+2
|
* pkg/compiler: add glob typeJoey Jiaojg2021-05-261-0/+2
| | | | | | | | | | | | | | | | | | | | * all: add new typename dirname The current way to check files under sysfs or proc is: - define a string to represent each file - open the file - pass the fd to write / read / close The issues above are: - Need to know what file present on target device - Need to write openat for each file With dirname added, which will open one file in the directory randomly and then pass the fd to write/read/close. * all: use typename glob to match filename Fixes #481
* sys/linux: add fq_pie description for netlink_route_schedMara Mihali2021-05-263-1/+29
|
* sys/linux: support syncobjs in dev_msm (#2552)Stephen Boyd2021-04-263-30/+99
| | | | | * sys/linux: support syncobjs in dev_msm * sys/linux: describe syncpoints and dma fences for dev_dri
* sys/linux: update perf_event_attr based on latest linux-nextMarco Elver2021-04-231-1/+13
| | | | | Updates perf_event_attr (perf events subsystem) to be in sync with latest linux-next.
* sys/linux: add descriptions for MSM freedreno GPU driverStephen Boyd2021-04-222-0/+221
|
* pkg/compiler: optimize array[const] representationDmitry Vyukov2021-04-2113-21/+21
| | | | | | | | | | | | | | Represent array[const[X, int8], N] as string["XX...X"]. This replaces potentially huge number of: NONFAILING(*(uint8_t*)0x2000126c = 0); NONFAILING(*(uint8_t*)0x2000126d = 0); NONFAILING(*(uint8_t*)0x2000126e = 0); with a single memcpy. In one reproducer we had 3991 such lines. Also replace memcpy's with memset's when possible. Update #1070
* sys: commit empty source filesDmitry Vyukov2021-04-211-0/+6
| | | | | | Commit empty files into generated packages, so that the tree is buildable even w/o generated files and Go tools continue to work.
* sys/linux: add file_handle descriptionsDmitry Vyukov2021-04-134-5/+246
|
* sys/linux: add more amd64/riscv64 special addressesDmitry Vyukov2021-03-211-1/+7
| | | | Add VSYSCALL_ADDR, PAGE_OFFSET, VMEMMAP addresses.
* sys/linux: update crypto algorithms listDmitry Vyukov2021-03-212-16/+76
| | | | Add some arm/arm64 algs + some missing x86 algs.
* sys/linux/test: add landlock_fs_forbiddenMickaël Salaün2021-03-191-0/+39
| | | | | | | This test covers mount namespace manipulation forbidden in security/landlock/fs.c Signed-off-by: Mickaël Salaün <mic@linux.microsoft.com>
* sys/linux/test: add landlock_fs_accessesMickaël Salaün2021-03-191-0/+105
| | | | | | | This test helps cover most types of access checks in security/landlock/fs.c Signed-off-by: Mickaël Salaün <mic@linux.microsoft.com>
* sys/linux/test: add landlock_ptraceMickaël Salaün2021-03-191-0/+40
| | | | | | This test helps cover security/landlock/ptrace.c Signed-off-by: Mickaël Salaün <mic@linux.microsoft.com>
* sys/linux/test: add landlock_layersMickaël Salaün2021-03-191-0/+49
| | | | | | This test helps cover security/landlock/fs.c:check_access_path() Signed-off-by: Mickaël Salaün <mic@linux.microsoft.com>
* sys/linux/test: add landlock_sb_deleteMickaël Salaün2021-03-191-0/+50
| | | | | | This test helps cover security/landlock/fs.c:hook_sb_delete() Signed-off-by: Mickaël Salaün <mic@linux.microsoft.com>
* sys/linux: add Landlock syscallsMickaël Salaün2021-03-192-0/+40
| | | | | | | | | Based on Linux next-20210319: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=f00397ee41c79b6155b9b44abd0055b2c0621349 Co-developed-by: Vincent Dagonneau <vincent.dagonneau@ssi.gouv.fr> Signed-off-by: Vincent Dagonneau <vincent.dagonneau@ssi.gouv.fr> Signed-off-by: Mickaël Salaün <mic@linux.microsoft.com>
* sys/linux: fix TIOCSTI signatureDmitry Vyukov2021-03-111-1/+1
|
* sys/linux: add new prctl'sDmitry Vyukov2021-03-102-1/+34
|
* sys/linux: fix prctl variantsMickaël Salaün2021-03-051-0/+6
| | | | | | | | | | | | | | | | | | | | Because there is not a proper prctl syscall but only variants, it happens that the logic to infer the number of syscall argument doesn't work (cf. callArgSizes in pkg/compiler/gen.go). As a result, the kernel rejects multiple prctl calls by returning -EINVAL because the fifth argument is not zero: * PR_MCE_KILL * PR_MCE_KILL_GET * PR_SET_MM * PR_SET_NO_NEW_PRIVS * PR_GET_NO_NEW_PRIVS * PR_GET_THP_DISABLE * PR_SET_THP_DISABLE * PR_GET_SPECULATION_CTRL * PR_SET_SPECULATION_CTRL Fix this by adding a new dummy prctl variant with all 5 arguments. Signed-off-by: Mickaël Salaün <mic@linux.microsoft.com>
* executor: disable rfkill during setupDmitry Vyukov2021-03-041-0/+2
| | | | | If rfkill is enabled by the fuzzer, wifi setup will fail. Disable rfkill to initial state during setup.
* sys/linux: describe FS_IOC_READ_VERITY_METADATAEric Biggers2021-03-032-0/+17
| | | | | | Add a description for the FS_IOC_READ_VERITY_METADATA ioctl, which is new in Linux v5.12-rc1. See https://www.kernel.org/doc/html/latest/filesystems/fsverity.html#fs-ioc-read-verity-metadata
* sys/linux: update constsDmitry Vyukov2021-03-025-21/+5
| | | | | Update consts on upstream 7a7fd0de4a9804299793e564a555a49c1fc924cb. Remove termiox ioctls, they were removed in commit e0efb3168d34.
* sys/linux: add description for IMG PowerVR Rogue driverPi-Hsun Shih2021-03-022-0/+2166
|
* sys/linux/filesystem: add mount_setattr() coverageChristian Brauner2021-03-013-0/+17
| | | | | | | | | I've moved the idmapped mount patchset into my for-next branch and plan to send it for the v5.12 merge window in ~2.5 weeks. It comes with a large xfstest but I would also like to get some syzkaller coverage. With-help-from: Dmitry Vyukov <dvyukov@google.com> Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
* executor: don't fail in syz_genetlink_get_family_idDmitry Vyukov2021-02-191-0/+17
| | | | | | | | | | We used to use our own netlink socket and then fail on any errors. But commit "sys/linux: add ieee802154 descriptions" made it possible to use fuzzer-provided socket, and fuzzer can pass any invalid fd. So don't fail on errors now. Fixes #2444
* sys/linux: add mknodat$loop variantMickaël Salaün2021-02-171-0/+1
| | | | | | Duplicate mknod$loop() for architectures without mknod(). Signed-off-by: Mickaël Salaün <mic@linux.microsoft.com>
* sys/linux: add mknodat$null variantMickaël Salaün2021-02-171-0/+1
| | | | | | Add a variant to create a /dev/null character device. Signed-off-by: Mickaël Salaün <mic@linux.microsoft.com>
* sys/linux: add ieee802154 descriptionsDmitry Vyukov2021-02-1227-58/+853
|
* sys/linux: update constsDmitry Vyukov2021-02-125-4/+5
| | | | Update consts on upstream 825b5991a46ef28a05a4646c8fe1ae5cef7c7828.
* sys/linux: simplify mount$tmpfsMickaël Salaün2021-02-081-1/+1
| | | | | | Simplify and align mount$tmpfs() with other mount variants. Signed-off-by: Mickaël Salaün <mic@linux.microsoft.com>
* sys/linux: add mount$tmpfs variantMickaël Salaün2021-02-041-0/+1
| | | | | | mount$tmpfs() is useful for Landlock fuzzing. Signed-off-by: Mickaël Salaün <mic@linux.microsoft.com>
* sys/linux: add mount$bind variantMickaël Salaün2021-02-041-0/+6
| | | | | | mount$bind() is useful for Landlock fuzzing. Signed-off-by: Mickaël Salaün <mic@linux.microsoft.com>
* sys/linux: add fork syscallMickaël Salaün2021-02-042-0/+2
| | | | | | fork() is useful for Landlock fuzzing. Signed-off-by: Mickaël Salaün <mic@linux.microsoft.com>
* sys/linux: add description for Mali Bifrost driver (#2394)Peter Shih2021-02-023-0/+513
| | | | | | | | | * sys/linux: add description for mali bifrost driver * sys/linux: regenerate dev_bifrost.txt.const * sys/linux/dev_bifrost: separate BASE_*_GROUP_ID_* to individual bits * sys/linux/dev_bifrost: format code
* sys/linux: update USB IDsAndrey Konovalov2021-01-061-98/+78
| | | | Based on 5.11-rc1 and upstream-usb.config.
* sys/linux: update BPF constantsPaul Chaignon2021-01-052-2/+3
| | | | Signed-off-by: Paul Chaignon <paul@cilium.io>
* all: make timeouts configurableDmitry Vyukov2020-12-281-0/+1
| | | | | | Add sys/targets.Timeouts struct that parametrizes timeouts throughout the system. The struct allows to control syscall/program/no output timeouts for OS/arch/VM/etc. See comment on the struct for more details.
* sys/linux: remove FUTEX_WAIT_MULTIPLE operationAndré Almeida2020-12-118-98/+15
| | | | | | | | FUTEX_WAIT_MULTIPLE was added before it was merged, and nowadays we have other plans for futex. Remove all WAIT_MULTIPLE references so futex fuzzing can be re-enabled. Signed-off-by: André Almeida <andrealmeid@collabora.com>
* sys/linux: add esdfsDmitry Vyukov2020-12-101-1/+27
|
* sys/linux: add incremental-fsDmitry Vyukov2020-12-104-2/+141
|
* sys/linux: add /proc/self/{totmaps,reclaim}Dmitry Vyukov2020-12-101-1/+10
| | | | Both are ChromeOS-specific.
* sys/linux: flip more tcp sysctl'sDmitry Vyukov2020-12-071-2/+18
| | | | | | | | | | Also flip these: /proc/sys/net/ipv4/tcp_dsack /proc/sys/net/ipv4/tcp_recovery /proc/sys/net/ipv4/tcp_mtu_probing /proc/sys/net/ipv4/tcp_rfc1337 /proc/sys/net/ipv4/tcp_rmem /proc/sys/net/ipv4/tcp_wmem
* sys/linux/test: add a test for bpf_cgroup_sysctlCheng-Min Chiang2020-12-072-9/+25
| | | | | | - Add a test for BPF_PROG_TYPE_CGROUP_SYSCTL. This could be used as a corpus. - Remove an unnecessary file sys/linux/bpf_lsm.txt.const.
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-04-03 00:53:17 +0000