aboutsummaryrefslogtreecommitdiffstats
path: root/sys/linux
Commit message (Collapse)AuthorAgeFilesLines
* sys/linux: update watch queue descriptionsDmitry Vyukov2022-03-166-5/+19
| | | | | | | The interface has significantly changed since the first version. Update to the upstreammed interface. Fixes #3030
* sys/linux: regenerate const filesDmitry Vyukov2022-03-161-1/+1
| | | | | Regenerate on latest upstream commit 56e337f2cf1326323844927a04e9dbce9a244835.
* sys/linux: update USB IDsAndrey Konovalov2022-02-041-35/+125
| | | | Based on v5.17-rc1 and upstream-usb.config.
* sys/linux: add PR_SET_VMA descriptionsDmitry Vyukov2022-01-272-0/+4
|
* sys/linux: update const filesDmitry Vyukov2022-01-272-2/+2
| | | | Regenerate const files on next-20220127.
* sys/linux: neutralize sched_setattrAleksandr Nogikh2022-01-202-0/+69
| | | | | | | | | | Setting itself or another process as a real-time one leads to the starvation of kernel threads and, as a result, to false positive stall bug reports. We have been getting complaints about them for already quite a long time now. Neutralize the policy argument of the syscall as much as possible given the set of possible syzkaller mutations.
* sys/linux: add brk syscallDmitry Vyukov2022-01-202-0/+2
|
* sys/linux: describe sigaltstackDmitry Vyukov2022-01-192-2/+12
| | | | | | It seems we had a bogus signature for sigaltstack for all that time. It accepts 2 sigaltstack structs according to the kernel code: https://elixir.bootlin.com/linux/v5.16/source/kernel/signal.c#L4217
* sys/linux: fix bugs pointed out by syz-checkDmitry Vyukov2022-01-1364-473/+607
| | | | Update #590
* tools/syz-check: ignore structs with out_overlay attributeDmitry Vyukov2022-01-131-1/+0
|
* tools/syz-check: calculate min type size for unionsDmitry Vyukov2022-01-131-2/+0
|
* tools/syz-check: don't check netlink policies as structsDmitry Vyukov2022-01-139-26/+0
| | | | They are not really structs in the kernel even if we describe them as structs.
* sys/linux: update warn filesDmitry Vyukov2022-01-1359-153/+912
| | | | | Regenerate warn files on the latest kernel commit fe8152b38d3 and latest syzkaller commit with fresh kernel config files.
* sys/linux: change netlink policies to the new $ conventionDmitry Vyukov2022-01-1313-404/+404
|
* all: add syz_clone() and syz_clone3() pseudo callsAleksandr Nogikh2022-01-134-8/+14
| | | | | | | | | | | | | | | | | | | | As was pointed out in #2921, the current approach of limiting the number of pids per process does not work on all Linux-based kernels. We could just treat fork, clone and clone3 in a special way (e.g. exit on a zero return). However, in that case we also need to sanitize the arguments for clone and clone3 - if CLONE_VM is passed and stack is 0, the forked child processes (threads) will become nearly unindentifiable and will corrupt syz-executor's memory. While we could sanitize clone's arguments, we cannot do so for clone3 - nothing can guarantee that they will not be changed concurrently. Instead of calling those syscalls directly, introduce a special pseudo syscall syz_clone3. It copies and sanitizes the arguments and then executes clone3 (or fork, if we're on an older kernel) in such a way so as to prevent fork bombs from happening. Also introduce syz_clone() to still be able to fuzz it on older systems.
* sys/linux: prepare dev_infiniband_rdma for stricter resource requirementsDmitry Vyukov2022-01-111-6/+10
| | | | | | | Subsequent changes will require stricter resource constructors and checks start failing for vcontext_handle (doesn't have ctors). I can't wrap my head around how vcontext_handle is supposed to be created, so for now it's downgraded to just int.
* sys/linux: improve dev_msm descriptionsDmitry Vyukov2022-01-111-3/+1
|
* sys/linux: improve dev_dri descriptionsDmitry Vyukov2022-01-112-12/+33
| | | | | | | Add construcor for drm_plane_id resource that returns it outside of an array. Provide more detailed desriptions for DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD/DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE as they accept/return complete different resources.
* sys/linux: add /dev/media descriptionsDmitry Vyukov2022-01-114-30/+151
| | | | | | | | | Move existing bits of /dev/media descriptions from sys.txt and dev_video4linux.txt and complete the descriptions. Also provide more concrete specialization of VIDIOC_QUERYBUF ioctl. Add ioctl specialization that serves as fd_v4l2_buffer resource constructor (returns it outside of a union).
* sys/linux: add sync_file descriptionsDmitry Vyukov2022-01-113-1/+61
|
* sys/linux: extend udmabuf descriptionsDmitry Vyukov2022-01-112-5/+17
| | | | The ioctls actually return the dmabuf fd that can be used in other APIs.
* sys/linux: remove /dev/ion descriptionsDmitry Vyukov2022-01-112-72/+0
| | | | | | | The comment says: // ION support was removed from kernel. // We plan to leave the descriptions for some time as is and later remove them.
* sys/linux: regenerate constsDmitry Vyukov2022-01-112-6/+6
| | | | | NL802154_IFTYPE_UNSPEC value was changed in kernel commit 451dc48c806a7ce9fbec5e7a24ccf4b2c936e834. dev_msr consts were not generated for non-x86 arches.
* sys/linux: don't use len/flags/const/proc types in out fieldsDmitry Vyukov2022-01-1110-24/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | Remove all uses of len/flags/const/proc types in explicitly marked out fields. Use of these types for out fields does not make sense: a len[b, int32] (out) b flags[foo, int32] (out) Since kernel fills these fields, that's unnecessary details or bugs in descriptions. In particular all of these are actually bugs: ioctl$TUNSETQUEUE(fd fd_tun, cmd const[TUNSETQUEUE], arg ptr[in, ifreq_t[flags[tun_queue_flags, int16]]]) ioctl$TUNSETIFF(fd fd_tun, cmd const[TUNSETIFF], arg ptr[in, ifreq_t[flags[tun_setiff_flags, int16]]]) ioctl$SIOCSIFHWADDR(fd fd_tun, cmd const[SIOCSIFHWADDR], arg ptr[in, ifreq_t[mac_addr]]) ioctl$sock_inet_SIOCSIFADDR(fd sock, cmd const[SIOCSIFADDR], arg ptr[inout, ifreq_t[sockaddr_in]]) ioctl$sock_inet_SIOCSIFBRDADDR(fd sock, cmd const[SIOCSIFBRDADDR], arg ptr[inout, ifreq_t[sockaddr_in]]) ioctl$sock_inet_SIOCSIFNETMASK(fd sock, cmd const[SIOCSIFNETMASK], arg ptr[inout, ifreq_t[sockaddr_in]]) ioctl$sock_inet_SIOCSIFDSTADDR(fd sock, cmd const[SIOCSIFDSTADDR], arg ptr[inout, ifreq_t[sockaddr_in]]) ioctl$sock_inet_SIOCSIFPFLAGS(fd sock, cmd const[SIOCSIFPFLAGS], arg ptr[inout, ifreq_t[int32]]) ioctl$SIOCSIFMTU(fd sock_pppl2tp, cmd const[SIOCSIFMTU], arg ptr[in, ifreq_t[int32]]) ioctl$sock_SIOCETHTOOL(fd sock, cmd const[SIOCETHTOOL], arg ptr[inout, ifreq_t[ptr[inout, ethtool_cmd_u]]]) We pretend that we pass in some flags or addresses, but the ifreq field was marked as (out), so we actually did not pass anything in.
* sys/linux: use out_overlay attributeDmitry Vyukov2022-01-114-88/+26
| | | | | | | Remove all uses of direction attributes on union fields and use out_overlay attribute instead. The attribute actually does what was the intention behind use of direction attribute on unions.
* sys/linux: support sticky fdb entriesPaul Chaignon2022-01-032-1/+2
| | | | | | | The new neighbour flag NTF_STICKY was added upstream in commit v4.20-rc1~14^2~392. Signed-off-by: Paul Chaignon <paul@isovalent.com>
* sys/linux: describe NDA_FLAGS_EXT netlink attributePaul Chaignon2022-01-032-0/+4
| | | | | | | | The NDA_FLAGS_EXT netlink attribute was added upstream in commit v5.16-rc1~159^2~222^2~1, to allow for new neighbor flags. The only such flag currently supported is NTF_EXT_MANAGED. Signed-off-by: Paul Chaignon <paul@isovalent.com>
* sys/linux: support per-map-type extra fields for MAP_CREATEPaul Chaignon2021-12-211-1/+24
| | | | | | | | | | | The structure used for BPF map creation now has an additional field, map_extra, introduced in [1] upstream. The definition of that field depends on the map type being created and is only used by bloom filter maps for now. For bloom filter maps, the 4 lower bits define the number of hash functions to use. 1 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9330986c03006 Signed-off-by: Paul Chaignon <paul@isovalent.com>
* sys/linux: support BPF calls to kernel functionsPaul Chaignon2021-12-212-0/+10
| | | | | | | | | | | | | | | Commit [1] upstream introduced support for BPF calls to kernel functions, via a new call instruction BPF_PSEUDO_KFUNC_CALL. In this new instruction, the immediate value is the BTF ID of the function to call in the kernel. This commit introduces basic support for this new instruction in syzkaller. The immediate value will point to a BTF ID, but a fair amount of additional work would be required to ensure that BTF ID is actually pointing to a kernel function. 1 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e6ac2450d6dee Signed-off-by: Paul Chaignon <paul@isovalent.com>
* sys/linux: support callback BPF functionsPaul Chaignon2021-12-212-0/+15
| | | | | | | | | | | | | | | | | | Commit [1] upstream introduced a new BPF helper, bpf_for_each_map_elem, which comes with callback functions (BPF programs). The callback function's address is provided via a 64-bit IMM load instruction where the first 32-bit of the immediate value are the offset from the current instruction to the start of the callback function. The 64-bit value is then rewritten into the address of the callback function. Callback BPF functions are similar to BPF_PSEUDO_CALL functions, except the offset to the function is converted into an address to be passed to a BPF helper. The same workaround is thus used to encode the offset in syzkaller, given we can't currently limit the offset to the program size. 1 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=69c087ba6225b Signed-off-by: Paul Chaignon <paul@isovalent.com>
* sys/linux: support map fd arraysPaul Chaignon2021-12-214-15/+48
| | | | | | | | | | | | | | | Commit [1] upstream introduced a new way to reference BPF maps in eBPF instructions. An array of BPF map fds is passed at program load time. Instructions can then reference fds in this array instead of carrying the fds directly. The goal is to allow BPF instructions to be immutable after compilation. Since we don't yet have a good way to reference indexes in an array, we define a new type map_fd_id for that purpose, with indexes between 0 and 16 only. 1 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=387544bfa291 Signed-off-by: Paul Chaignon <paul@isovalent.com>
* sys/linux: update BPF constantsPaul Chaignon2021-12-212-4/+10
| | | | Signed-off-by: Paul Chaignon <paul@isovalent.com>
* sys/linux: add Damon descriptionshatoboar2021-12-202-0/+82
| | | | | | | | | | | | | | | | | | | | | | | | | | * sys/linux/damon.txt: initial description description of DAMON's interface mounted in debugfs: target_ids, attrs, init_regions, monitor_on * sys/linux/damon.txt: additional damon interface description added added DAMON interface descriptions for schemes, kdamond_pid, mk_contexts, rm_contexts prefix of all the files with damon to avoid colliding naming * sys/linux/damon.txt: standard copyright statement added * sys/linux/damon.txt.const: const file of sys/linux/damon.txt added * sys/linux/damon.txt: type fix of pid to fmt * dashboard/config/linux/bits/subsystems.yml: damon configs added for Syzbot * dashboard/config/linux: generated kernel configs with added damon config * sys/linux/damon.txt: fmt type fix * sys/linux/damon.txt: read and close syscalls removed write and read mk_contexts summarized into one syscall some refining of syscall interfaces
* sys/linux: add new futex_waitv syscallMuhammad Usama Anjum2021-11-292-0/+20
| | | | | | Add description of the new syscall futex_waitv. Signed-off-by: Muhammad Usama Anjum <usama.anjum@collabora.com>
* sys/linux: neutralize ioctl for /dev/msrVikram Narayanan2021-11-182-2/+25
|
* sys/linux: add /dev/cpu/X/msr to dev_msr.txtVikram Narayanan2021-11-182-0/+22
|
* sys: remove confusing comments that fake directivesDmitry Vyukov2021-11-122-21/+19
| | | | | | | | | It's a somewhat common mistake to write comments instead of directives: #include <foo> #define FOO BAR because that's how it's done in C. In preparation for warning about such cases remove all existing comments that fake directives.
* sys/linux: fix and regenerate consts on the latest kenrelDmitry Vyukov2021-11-126-5/+6
| | | | Fix missed includes and renamed constants and regenerate const files on 89d714ab60.
* executor/common_linux: fuzz kvm_runAlexey Kardashevskiy2021-11-092-0/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | Syzkaller runs KVM until it exits and this is considered the end of the KVM_RUN syscall. We can do a bit more with a VM if the exit was legit (for example MMIO access or a hypercall). In such cases the userspace emulates the request and stores the result in the kvm_run struct (mmaped from vcpu_fd) which the next KVM_RUN checks. This defines specialized mmap and syz_memcpy_off to allow Syzkaller fuzz the kvm_run struct with focus on the part where the huge union is. Signed-off-by: Alexey Kardashevskiy <aik@linux.ibm.com> --- Changes: v4: * defined offset/size constants * re-autogenerated dev_kvm.txt.const v3: * fixed syz_memcpy_off's src size v2: * limited changes to dev_kvm.txt instead of defining all new syz_kvm_run.
* sys/linux: add CDROM_MEDIA_CHANGED ioctlDenis Efremov2021-11-082-0/+9
| | | | | | | Add description for: 67f1e027c270 drivers/cdrom: improved ioctl for media change detection Signed-off-by: Denis Efremov <efremov@linux.com>
* sys/linux: add O_ACCMODE to floppy's open flagsDenis Efremov2021-11-082-1/+19
| | | | | | | | | O_ACCMODE is used for ioctl-only opens in the floppy driver. Drop O_CREAT, O_DIRECTORY, O_EXCL, O_LARGEFILE, O_NOCTTY, O_NOFOLLOW, O_PATH and __O_TMPFILE flags. They aren't affecting /dev/fd0. Signed-off-by: Denis Efremov <efremov@linux.com>
* all: add binderfs fuzzing supportAleksandr Nogikh2021-10-294-7/+57
| | | | | | | | Create one instance of binderfs per process and add descriptions to enable syzkaller to create binderfs mounts and binder devices itself. Keep descriptions compatible with the legacy mode (when devices are created at boot time).
* sys/linux: add devlink rate management descriptionsAleksandr Nogikh2021-10-272-0/+33
|
* sys/linux: extend userfaultfd descriptionsDmitry Vyukov2021-10-212-4/+33
| | | | | 2 new ioctl's were added + some new flags: https://elixir.bootlin.com/linux/v5.15-rc6/source/include/uapi/linux/userfaultfd.h#L82
* sys/linux: extend tcp_zerocopy_receive structDmitry Vyukov2021-10-212-1/+13
| | | | | It has been extended in the kernel, see: https://elixir.bootlin.com/linux/v5.15-rc6/source/include/uapi/linux/tcp.h#L348
* sys/linux: add new futex/seccomp operationsDmitry Vyukov2021-10-214-6/+14
| | | | | See https://elixir.bootlin.com/linux/v5.15-rc6/source/include/uapi/linux/futex.h#L11 And https://elixir.bootlin.com/linux/v5.15-rc6/source/include/uapi/linux/seccomp.h#L118
* sys/linux: describe creation of batadv devicesDmitry Vyukov2021-10-212-0/+10
| | | | See: https://elixir.bootlin.com/linux/v5.15-rc6/source/include/uapi/linux/batman_adv.h#L692
* sys/linux: describe missing FAT ioctlsAleksandr Nogikh2021-10-212-0/+35
|
* sys/linux: add missing descriptions for autofs ioctlsAleksandr Nogikh2021-10-213-1/+165
|
* sys/linux: add descriptions of memfd_secret syscallDmitry Vyukov2021-10-212-0/+4
| | | | See: https://elixir.bootlin.com/linux/v5.15-rc6/source/mm/secretmem.c#L194
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-12 08:13:54 +0000