aboutsummaryrefslogtreecommitdiffstats
path: root/sys/linux
Commit message (Collapse)AuthorAgeFilesLines
* sys/linux: improve descriptions of bpf tracing (#2076)bobogei811232020-09-097-42/+97
| | | | | | | - Rename bpf_lsm to bpf_trace and put all bpf program types that use BPF_RAW_TRACEPOINT_OPEN here. - Add descriptions for types RAW_TRACEPOINT(_WRITABLE), BPF_TRACING and BPF_EXT. - Add the hook names for RAW_TRACEPOINT(_WRITABLE).
* sys/linux: add descriptions of qat_adf_ctlCheng-Min Chiang2020-08-283-1/+141
| | | | | Add descriptions for qat_adf_ctl. It might need an intel qat device. Update #533.
* Revert "sys/linux: add description for fsinfo"Ioana-Ruxandra Stăncioi2020-08-243-47/+5
| | | | | | | | | The fsinfo() system call is under heavy discussion upstream, and it might be totally changed. As a result it was dropped from linux-next starting in next-20200819, and the pull request for 5.9 (https://lkml.kernel.org/r/1845353.1596469795@warthog.procyon.org.uk/) wasn't accepted. Therefore revert the syscall description (commit 4b0871d) for now.
* sys/linux: make bpf_lsm_btf_id optional (#2054)bobogei811232020-08-241-1/+4
| | | | | | | | | | | Pull request #1971 add the resource bpf_lsm_btf_id and make that a required resource for bpf$BPF_LSM_PROG_LOAD. However, we need #2035 merged to get a bpf_lsm_btf_id, and the pull request is currently blocked by a pahole issue. Thus, bpf$BPF_LSM_PROG_LOAD will be disabled for now. This pull request makes bpf_lsm_btf_id optional for bpf$BPF_LSM_PROG_LOAD, so we can test this syscall before the issue is resolved.
* sys/linux: add descriptions of vga_arbiterCheng-Min Chiang2020-08-203-1/+50
| | | | | Add desciptions for testing /dev/vga_arbiter. Update #533
* sys/linux: add BTRFS specific ioctlsJiaheng Hu2020-08-192-9/+562
| | | | Add the ioctls specific to BTRFS (linux v5.8).
* sys/linux: add lwtunnel_encap_seg6 descriptionIoana-Ruxandra Stăncioi2020-08-192-17/+18
| | | | | Uncommented because the kernel fixed the seg6_iptunnel.h uapi header https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=88fab21c691bb1ff164e540735237a385e3afeaf
* sys/linux/test: add test performing getdents64() on FUSE dirStefano Duo2020-08-141-0/+9
| | | | | | Add syzkaller program which correctly handles a getdents64() syscall on a FUSE directory. Here the related comment/discussion https://github.com/google/syzkaller/pull/2001#issuecomment-671185292.
* executor/common_linux.h: open target dir inside syz_mount_image()Stefano Duo2020-08-143-24/+33
| | | | | | | | | | Refactor syz_mount_image() to support filesystems not requiring a backing device and filesystem image (e.g. FUSE). To do that, we check for the presence of the pointer to the array of struct fs_image_segment: if missingi, there is no need to setup the loop device and we can proceed directly with the mount() syscall. Add syz_mount_image$fuse() (specialization for FUSE) inside sys/linux/fs_fuse.txt.
* sys/linux/fs_fuse.txt: use bytelen instead of lenStefano Duo2020-08-141-2/+2
| | | | | Use the type bytelen instead of len to express the length of the data structure being pointed by the pointer passed to read$FUSE().
* executor/common_linux.h: add syz_fuse_handle_req()Stefano Duo2020-08-142-2/+43
| | | | | | | | | | | | | | | | | | | | | | At the moment syzkaller is able to respond to FUSE with a syntactically correct response using the specific write$FUSE_*() syscalls, but most of the times these responses are not related to the type of request that was received. With this pseudo-syscall we are able to provide the correct response type while still allowing the fuzzer to fuzz its content. This is done by requiring each type of response as an input parameter and then choosing the correct one based on the request opcode. Notice that the fuzzer is still free to mix write$FUSE_*() and syz_fuse_handle_req() syscalls, so it is not losing any degree of freedom. syz_fuse_handle_req() retrieves the FUSE request and resource fuse_unique internally (by performing a read() on the /dev/fuse file descriptor provided as input). For this reason, a new template argument has been added to fuse_out (renamed to _fuse_out) so that the unique field can be both an int64 (used by syz_fuse_handle_req()) and a fuse_unique resource (used by the write$FUSE_*() syscalls) without any code duplication.
* sys/linux/fs_fuse.txt: use expected flags for fuse_attr.modeStefano Duo2020-08-141-1/+1
| | | | | Instead of using a generic int32 for fuse_attr.mode, use the expected file mode flags.
* sys/linux/fs_fuse.txt: define FUSE request id as a resourceStefano Duo2020-08-144-8/+21
| | | | | | | | | | Currently fuse_in.unique and fuse_out.unique are not linked by any dependency chain. This causes the majority of the replies to the kernel to be dropped because not referring to a previously sent request. By defining them as a resource, we push the fuzzer in the right direction (i.e., try to respond using a previously issued unique value). The read syscall has been updated accordingly, it now expects and parses a fuse_in header and some additional data.
* sys/linux: switch to the new .const formatDmitry Vyukov2020-08-131336-83508/+4039
| | | | | | | This reduces number of const files/lines from 1288/96599 to 158/11603. Const files are generated on next-20200813. Update #1983
* sys/linux: use per-field directions in descriptionsNecip Fazil Yildiran2020-08-139-103/+129
|
* sys/linux: add tca_flower_key_mpls_opts descritpionIoana-Ruxandra Stăncioi2020-08-109-1/+94
| | | | | | | mpls_opts: https://elixir.bootlin.com/linux/v5.8-rc4/source/net/sched/cls_flower.c#L670 mpls_opts_lse: https://elixir.bootlin.com/linux/v5.8-rc4/source/net/sched/cls_flower.c#L731
* sys/linux: fix make extract on latest linux-nextzizizi2020-08-101-1/+1
| | | | VIRTIO_F_IOMMU_PLATFORM was renamed to VIRTIO_F_ACCESS_PLATFORM
* sys/linux: add missing flags to rtnexthopAlbert van der Linde2020-08-081-3/+3
|
* sys/linux: add descriptions for RTM_(NEW|DEL|GET)NEXTHOPAlbert van der Linde2020-08-089-0/+225
| | | | https://elixir.bootlin.com/linux/v5.8-rc4/source/net/ipv4/nexthop.c#L1961
* sys/linux/test: fix io_uring testCheng-Min Chiang2020-08-071-0/+6
| | | | | Fix the io_uring test by adding some blank lines after comments. This commit changes nothing beside that.
* sys/linux: add descriptions for BPF LSMCheng-Min Chiang2020-08-0711-6/+95
| | | | | | | | | | | | | | This commit includes the following changes: * executor: add a new syz_btf_id_by_name psuedo-syscall * sys/linux: add descriptions for BPF LSM subsystem * sys/linux: add instructions on how to dump vmlinux and install bpftool * sys/linux/test: add tests for the new psuedo-syscall * pkg/host: add support detection for the new psuedo-syscall * pkg/runtest: skip the coverage test when invoking the new psuedo-syscall Update #533.
* sys/linux: add HCI_COMMAND_PKT descriptionsAndy Nguyen2020-08-0510-12/+1103
|
* pkg/compiler: check for unused resourcesDmitry Vyukov2020-08-045-16/+11
| | | | | | | | | | If a resource is never used as an input, it is not useful. It's effectively the same as using an integer. Detect such cases, they are quite confusing. Fix all existing errors in descriptions. This uncovered some interesting bugs as well, e.g. use of a completely unrelated fd subtype after copy-paste (while the resource that was supposed to be used there is completely unused).
* sys/linux/l2cap.txt: no array for l2cap_cid_le_signalingAndy Nguyen2020-08-021-1/+1
|
* all: fake hci le conn using handle 201Andy Nguyen2020-08-021-11/+17
|
* sys/linux: add more HCI_EV_CMD_COMPLETE typesDmitry Vyukov2020-08-029-2/+382
|
* sys/linux: refine some l2cap flagsDmitry Vyukov2020-08-029-3/+89
|
* sys/linux: add l2cap_conf_opt optionsAndy Nguyen2020-08-029-5/+80
|
* sys/linux: assorted improvements for vhciDmitry Vyukov2020-07-3027-127/+297
| | | | | | | | | | | | | | | | Regenerate const files on next-20200729. Change conn handle to 200 because it also seems to be matches against phy_handle fields which are int8 (current 256 does not fit into int8). Use 200 for all handle's and all phy_handle's. Remove hci_evt_le_cis_req, it does not seem to be used in the kernel. Restrict some event types and statuses. Add rssi field to hci_ev_le_advertising_info. Use bytesize for some of the data length fields.
* all: initialize vhci in linuxTheOfficialFloW2020-07-303-13/+48
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * all: initialize vhci in linux * executor/common_linux.h: improve vhci initialization * pkg/repro/repro.go: add missing vhci options * executor/common_linux.h: fix type and add missing header * executor, pkg: do it like NetInjection * pkg/csource/csource.go: do not emit syz_emit_vhci if vhci is not enabled * executor/common_linux.h: fix format string * executor/common_linux.h: initialize with memset For som reason {0} gets complains about missing braces... * executor/common_linux.h: simplify vhci init * executor/common_linux.h: try to bring all available hci devices up * executor/common_linux.h: find which hci device has been registered * executor/common_linux.h: use HCI_VENDOR_PKT response to retrieve device id * sys/linux/dev_vhci.txt: fix structs of inquiry and report packets * executor/common_linux.h: remove unnecessary return statement and check vendor_pkt read size * executor/common_linux.h: remove unnecessary return statement and check vendor_pkt read size * sys/linux/dev_vhci.txt: pack extended_inquiry_info_t * sys/linux/l2cap.txt: add l2cap_conf_opt struct * executor/common_linux.h: just fill bd addr will 0xaa * executor/common_linux.h: just fill bd addr will 0xaa
* sys/linux: descriptions for /dev/snd/hw*Nazime Hande Harputluoglu2020-07-299-1/+201
|
* executor: added syz_io_uring_setup to wrap both setup and mmapNecip Fazil Yildiran2020-07-292-5/+6
| | | | | | It is hard for the fuzzer to generate correct programs using mmap calls with fuzzer-provided mmap length. This wrapper ensures correct length computation.
* all: fix marking of auto-generated filesDmitry Vyukov2020-07-291-1/+1
| | | | | Update the copyright checking script and more files for the standard convention of marking auto-generated files.
* sys/linux: descriptions for /dev/sequencerNazime Hande Harputluoglu2020-07-2910-2/+846
|
* sys/linux: add description for copy_file_rangeAlbert van der Linde2020-07-259-0/+10
|
* sys/linux: enhanced descs for io_uringNecip Fazil Yildiran2020-07-2410-26/+857
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * sys/linux: enhanced descs for io_uring Introduced pseudo-call "syz_io_uring_put_sqes_on_ring()" for writing submission queue entries (sqes) on sq_ring, which was obtained by mmap'ping the offsets obtained from io_uring_setup(). Added descriptions for io_ring_register operations that were missing earlier. Did misc changes to adapt the descriptions for the updates on the io_uring subsystem. * pkg/host: add io_uring pseudo-syscall * executor/common_linux.h: fix issues with io_uring pseudo-syscall * executor: fixed io_uring offset computation * executor: fixes and refactorings in syz_io_uring_submit() * executor: added syz_io_uring_complete() pseudo-syscall for io_uring * sys/linux: added descriptions for io_uring operations Each operation requires a different struct io_uring_sqe set up. Those are described to be submitted to the sq ring. * executor: use uint32 instead of uint32_t * executor: remove nonfailing from pseudo-calls * sys/linux: fix io_uring epoll_ctl sqe * prog: fix TestTransitivelyEnabledCallsLinux() The newly introduced syscall, syz_io_uring_submit$IORING_OP_EPOLL_CTL, uses fd_epoll. Adapt TestTransitivelyEnabledCallsLinux() to account for this. * sys/linux: add IORING_OP_PROVIDE_BUFFERS and IORING_OP_REMOVE_BUFFERS * sys/linux: fix IORING_OP_WRITE_FIXED and IORING_OP_READ_FIXED addr and len are for the buffer located at buf_index * sys/linux: io_uring: use reg. bufs for READ, READV, RECV, RECVMSG As a result, IOSQE_BUFFER_SELECT_BIT is included in the iosqe_flags. * sys/linux: io_uring: misc fixes * sys/linux: io_uring: add IORING_SETUP_ATTACH_WQ * executor: refactorings on io_uring pseudo syscalls * sys/linux: io_uring: fix desc for params.cq_entries * executor: fix SQ_ARRAY_OFFSET computation This is required with the fix in io_uring kernel code. https://lore.kernel.org/io-uring/CACT4Y+bgTCMXi3eU7xV+W0ZZNceZFUWRTkngojdr0G_yuY8w9w@mail.gmail.com/T/#t * executor: added pseudosyscall syz_io_uring_cq_eventfd_toggle() The usage of cq_ring->flags is only for manipulating IORING_CQ_EVENTFD_DISABLED bit. This is achieved by a pseudo-syscall, which toggles the bit. * executor: added pseudocall syz_io_uring_put_ring_metadata Removed syz_io_uring_cq_eventfd_toggle() and introduced syz_io_uring_put_ring_metadata() instead. We have many pieces of metadata for both sq_ring and cq_ring, for which we are given the offsets, and some of are not supposed to be manipulated by the application. Among them, both sq and cq flags can be changed. Both valid and invalid cases might cause interesting outcomes. Use the newly introduced pseudo syscall to manipulate them randomly while also manipulating the flags to their special values. * executor: added pseudo-syscall syz_memcpy_off Removed syz_io_uring_put_ring_metadata() and instead added a much more generic pseudo systemcall to achieve the task. This should benefit other subsystems as well. * sys/linux: refactored io_uring descriptions syz_io_uring_submit() is called with a union of sqes to reduce duplication of other parameters of the function. io_uring_sqe is templated with io_uring_sqe_t, and this template type is used to describe sqes for different ops. The organization of io_uring.txt is changed. * sys/linux: io_uring: improved descs to utilize registered files The files are registered using io_uring_register$IORING_REGISTER_FILES(). When IOSQE_FIXED_FILE_BIT is enabled in iosqe_flags in sqe, a variety of operations can use those registered files using the index of the file instead of fd. Changed the sqe descriptions for the eligible operations to utilize this. * sys/linux: io_uring: improved the descs to utilize personality_id in sqes A personality_id can be registered for a io_uring fd using io_uring_register$IORING_REGISTER_PERSONALITY(). This id can be utilized within sqes. This commit improves the descs for io_uring to utilize it. In addition, the descriptions for the misc field in io_uring_sqe_t is refactored as most are shared among sqes. * sys/linux: io_uring: utilized cqe.res io_uring_cqe.res is used to carry the return value of operations achieved through io_uring. The only operations with meaningful return values (in terms of their possible usage) are openat and openat2. The pseudo-syscall syz_io_uring_complete() is modified to account for this and return those fds. The description for sqe_user_data is splitted into two to identify openat and non-openat io_uring ops. IORING_OP_IOCTL was suggested but never supported in io_uring. Thus, the note on this is removed in the descriptions. tee() expects pipefds, thus, IORING_OP_TEE. The descriptions for the pipe r/w fds are written as ordinary fd. Thus, in the description for IORING_OP_TEE, which is io_uring_sqe_tee, fd is used in the place where pipefds are expected. The note on this is removed in the descriptions. * sys/linux/test: added test for io_uring This is not tested yet. * sys/linux/test: fixed the test for io_uring The changes successfully pass the sys/linux/test/io_uring test. sys/linux/io_uring.txt: sq_ring_ptr and cq_ring_ptr are really the same. Thus, they are replaced with ring_ptr. executor/common_linux.h: thanks to io_uring test, a bug is found in where the sq_array's address is computed in syz_io_uring_submit(). Fixed. In addition, similar to the descriptions, the naming for the ring_ptr is changed from {sq,cq}_ring_ptr to ring_ptr. * sys/linux: io_uring: misc fixes * sys/linux: io_uring: changed the sqe_user_data enum Used a smaller range to ease the collisions. Used comperatively unique and magic numbers for openat user_data to avoid thinking as if the cqe belongs to openat while the user_data is coming from some random location. * pkg/host: added checks for io_uring syscall * pkg/host: fixed checks for io_uring syscall * sys/linux: fixed io_uring test
* sys/linux: fixed p{read,write}{v,v2} descriptionsNecip Fazil Yildiran2020-07-241-4/+4
| | | | | | | The raw system calls have call signatures that differ slightly from that of the corresponding GNU C library wrapper functions. The descriptions are fixed to reflect the raw system calls, which unpacks the offset into two args, off_l and off_h.
* sys/linux: added descs for preadv2, pwritev2Necip Fazil Yildiran2020-07-249-0/+60
|
* sys/linux: add lwtunnel_encap_seg6_localRuxandra Stăncioi2020-07-249-1/+111
| | | | | https://elixir.bootlin.com/linux/latest/source/include/uapi/linux/seg6_local.h#L21 https://elixir.bootlin.com/linux/latest/source/net/ipv6/seg6_local.c#L649
* sys/linux: add lwtunnel_encap_bpf descriptionRuxandra Stăncioi2020-07-249-0/+66
| | | | | https://elixir.bootlin.com/linux/latest/source/include/uapi/linux/lwtunnel.h#L102 https://elixir.bootlin.com/linux/latest/source/net/core/lwt_bpf.c#L364
* sys/linux: add lwtunnel_encap_seg6 descriptionRuxandra Stăncioi2020-07-241-0/+18
| | | | | https://elixir.bootlin.com/linux/latest/source/include/uapi/linux/seg6_iptunnel.h#L22 TODO: uncomment after the kernel fixes the seg6_iptunnel.h uapi header
* sys/linux: add lwtunnel_encap_ip6 descriptionRuxandra Stăncioi2020-07-249-0/+64
| | | | https://elixir.bootlin.com/linux/latest/source/net/ipv4/ip_tunnel_core.c#L713
* sys/linux: add lwtunnel_encap_ila descriptionRuxandra Stăncioi2020-07-249-0/+117
| | | | | | https://elixir.bootlin.com/linux/latest/source/net/ipv6/ila/ila_lwt.c#L121 The comment is about their statement in the kernel file: https://elixir.bootlin.com/linux/latest/source/net/ipv6/ila/ila_lwt.c#L196
* sys/linux: add lwtunnel_encap_ip descriptionRuxandra Stăncioi2020-07-249-0/+201
| | | | | | | | | https://elixir.bootlin.com/linux/latest/source/include/uapi/linux/lwtunnel.h#L102 https://elixir.bootlin.com/linux/latest/source/net/ipv4/ip_tunnel_core.c#L219 The policies added have a suffix (_lwt), because they already exist in syzkaller with the kernel name. An example of a union with the same name described in sys/linux/socket_netlink_route_sched.txt: https://elixir.bootlin.com/linux/latest/source/net/sched/cls_flower.c#L709
* sys/linux: add lwtunnel_encap_mpls descriptionRuxandra Stăncioi2020-07-249-0/+20
| | | | https://elixir.bootlin.com/linux/latest/source/net/mpls/mpls_iptunnel.c#L25
* sys/linux: add ipv6_rpl_sr_hdr descriptionRuxandra Stăncioi2020-07-2417-12/+41
| | | | | https://elixir.bootlin.com/linux/latest/source/include/uapi/linux/rpl.h#L19 update google#533
* sys/linux: add netlink encap type LWTUNNEL_ENCAP_RPLRuxandra Stăncioi2020-07-241-1/+1
| | | | | | | Added a new encap type, from the lwtunnel_encap_types struct, defined in the include/uapi/linux/lwtunnel.h file. https://elixir.bootlin.com/linux/latest/source/include/uapi/linux/lwtunnel.h#L16 Update #533.
* sys/linux: remove ioctl$EXT4_IOC_SETFLAGSDenis Efremov2020-07-229-123/+0
| | | | | | | It duplicates ioctl$FS_IOC_SETFLAGS. There is no need in a separate definition. Signed-off-by: Denis Efremov <efremov@linux.com>
* sys/linux: make fs flags explicit in ioctl$FS_IOC_SETFLAGSDenis Efremov2020-07-229-2/+245
| | | | | | | Make fs flags explicit in FS_IOC_SETFLAGS, FS_IOC_GETFLAGS ioctls. Signed-off-by: Denis Efremov <efremov@linux.com>
* sys/linux: change argument type in FS_IOC_[GS]ETFLAGS ioctlDenis Efremov2020-07-222-3/+3
| | | | | | FS_IOC_GETFLAGS, FS_IOC_SETFLAGS ioctls use pointer to int32. Signed-off-by: Denis Efremov <efremov@linux.com>
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-21 20:46:17 +0000