| Commit message (Collapse) | Author | Age | Files | Lines |
| ... | |
| |
|
|
|
|
| |
Regenerate on a VM which supports NTFS, using:
mkntfs libntfs-3g v2022.5.17
kernel v5.19.0
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Regenerate using the following versions:
mkfs.f2fs 1.14.0 (2020-08-24)
mkfs.btrfs btrfs-progs v5.18.1
mkfs.fat 4.2 (2021-01-31)
mkexfatfs 1.3.0
mkfs.bfs util-linux 2.38
mkfs.xfs 5.19.0
mkfs.minix util-linux 2.38
mkfs.reiserfs 3.6.27
mkfs.jfs 1.1.15 (2011-03-04)
mkntfs libntfs-3g v2022.5.17
mke2fs 1.46.5 (2021-12-30)
mkfs.gfs2 3.4.1
mkfs.ocfs2 1.8.7
mkfs.cramfs util-linux 2.38
genromfs 0.5.2
mkfs.erofs 1.5
makefs 20190105-3
mkudffs udftools 2.3
mkfs.jffs2 mtd-utils 2.1.4
mkfs.nilfs2 nilfs-utils 2.2.8
mksquashfs sqaushfs-tools 4.5.1
genisomage 1.1.11
NB: NTFS3 is not included here as my kernel does not seem to be compiled
with it.
No errors appear (except for failure to find NTFS3).
This commit also updates a comment in `imagegen.go` listing dependencies.
|
| |
|
|
|
|
|
|
|
|
| |
XFRM device creation will fail w/o IFLA_XFRM_IF_ID attribute:
https://elixir.bootlin.com/linux/v6.0-rc4/source/net/xfrm/xfrm_interface.c#L648
Add this attribute.
This ID is also present in descriptions in at least 2 places.
In one we got it wrong, it's not ifindex (easy to confuse because of the name).
Fix it as well.
|
| |
|
|
|
| |
Introduced in torvalds/linux@4c8cf31885f69e86be0b5b9e6677a26797365e1d.
See https://elixir.bootlin.com/linux/latest/source/include/uapi/linux/vhost.h.
|
| |
|
|
|
|
| |
Update google#533.
See https://elixir.bootlin.com/linux/latest/source/include/uapi/linux/dma-heap.h.
|
| |
|
|
|
|
| |
`F2FS_IOC_ABORT_VOLATILE_WRITE` was renamed to `F2FS_IOC_ABORT_ATOMIC_WRITE`
in torvalds/linux@23339e5752d01a4b5e122759b002cf896d26f6c1.
This commit updates the corresponding description.
|
| |
|
|
|
| |
Generate very long file names once in a while to provoke bugs like:
https://github.com/google/gvisor/commit/f857f268eceb1cdee0b2bdfa218c969c84033fcd
|
| |
|
|
| |
Regenerate consts on upstream 4e23eeebb2e57f5a28b36221aa776b5a1122dde5.
|
| |
|
|
| |
Signed-off-by: Denis Efremov <denis.e.efremov@oracle.com>
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
sit devices are ipv4 even that it's source is in net/ipv6.
The address length is 4:
https://elixir.bootlin.com/linux/v5.19-rc2/source/net/ipv6/sit.c#L1440
and it accepts ip_tunnel_prl instead of ip6_tnl_parm2 for SIOCADDTUNNEL:
https://elixir.bootlin.com/linux/v5.19-rc2/source/net/ipv6/sit.c#L370
Also SIOC***PRL commands accept ip_tunnel_prl instead of ip6_tnl_parm2:
https://elixir.bootlin.com/linux/v5.19-rc2/source/net/ipv6/sit.c#L457
and SIOC***6RD accept ip_tunnel_6rd struct:
https://elixir.bootlin.com/linux/v5.19-rc2/source/net/ipv6/sit.c#L1169
and both SIOC***PRL and SIOC***6RD are only applicable to sit devices
rather than all tunnel types:
https://elixir.bootlin.com/linux/v5.19-rc2/A/ident/SIOCGET6RD
|
| |
|
|
|
|
|
|
|
|
| |
net/ipv4/ping_group_range sysctl grants access to ICMP sockets
to the specified user groups. But it needs to be set inside
of the net namespace (it's per-namespace).
We were setting it but in the init namespace only (which we don't use).
Set it after CLONE_NEWNET. This repairs testing of ICMP sockets.
Note: don't set it for setuid sandbox since it's "low privilege".
|
| |
|
|
|
|
| |
Add descriptions for:
https://elixir.bootlin.com/linux/v5.19-rc1/source/include/uapi/linux/mroute.h
https://elixir.bootlin.com/linux/v5.19-rc1/source/include/uapi/linux/mroute6.h
|
| | |
|
| |
|
|
|
| |
It leads to immidiate machine hang with no diagnostics.
Remove it from the list.
|
| |
|
|
|
| |
Regenerate the list on upstream commit d1dc87763f406d.
Also sort tracepoints for determinism.
|
| |
|
|
|
| |
Update const files on the latest upstream commit
d1dc87763f406d4e67caf16dbe438a5647692395
|
| |
|
|
|
|
|
|
| |
This reverts commit 7d6ce61334a1437f59d058959ef93071446706f8.
Ashmem is removed upstream, but it's still present in LTS 5.4/10 kernels.
Add "meta noextract" to the file instead to prevent extract errors.
|
| |
|
|
|
|
|
| |
This test covers linking, renaming and exchanging (RENAME_EXCHANGE) checks
handled in security/landlock/fs.c .
Signed-off-by: Mickaël Salaün <mic@linux.microsoft.com>
|
| |
|
|
|
|
|
| |
Add the new LANDLOCK_ACCESS_FS_REFER flag for the full link and rename
handling.
Signed-off-by: Mickaël Salaün <mic@linux.microsoft.com>
|
| |
|
|
|
|
|
|
|
| |
* sys/linux: fix errors in dev_loop.txt
* docs: add research paper (ICSE 22)
* sys/linux: fix errors in dev_loop.txt
* sys/linux: fix errors in dev_loop.txt
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
We have a bunch of hacks in syz-extract, syz-sysgen and syz-check
with respect to description files unsupported on some arches,
or that must not be part of make extract.
Add 2 meta attribtues to files:
meta noextract
Tells `make extract` to not extract constants for this file.
Though, `syz-extract` can still be invoked manually on this file.
meta arches["arch1", "arch2"]
Restricts this file only to the given set of architectures.
`make extract` and ``make generate` will not use it on other architectures.
Later we can potentially use meta attributes to specify git tree/commit
that must be used for extraction. Maybe something else.
Fixes #2754
|
| |
|
|
|
|
| |
Make bpf_link_create_arg a template so that it's possible to create more specialized versions.
Add a specialized version for XDP links. First, they need a special program type,
plus a special attach type and target fd is not an fd, but rather ifindex.
|
| | |
|
| |
|
|
|
| |
Regenerated on the current upstream HEAD:
22da5264abf497a10a4ed629f07f4ba28a7ed5eb
|
| |
|
|
|
| |
It was deprecated and removed from the kernel:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=721412ed3d819e767cac2b06646bf03aa158aaec
|
| |
|
|
|
|
|
|
|
|
| |
Currently mkdirat requires fd_dir as an input resource,
which means it cannot be enabled in "enable_syscalls" on its own
as it requires some other syscall that creates fd_dir
(a syscall cannot create input resources for itself).
Mark fd_dir as opt so that mkdirat can be enabled on it's own.
The default value for fd_dir is AT_FDCWD, which is a good value that works.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Randomly changing MSRs can have unpredictable results.
We tried to protect from writes on descriptions level,
but it does not work well, the fuzzer has figured out:
03:37:28 executing program 3:
syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000180)='fd/3\x00')
pwritev(r0, ...)
Fortunately there is a command line argument that disables all writes.
Use it instead.
Note: older kernels will need:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a7e1f67ed29f
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=02a16aa13574
|
| |
|
|
|
|
|
|
|
|
| |
5.15 kernel get new filesystem driver for ntfs called ntfs3. Old driver
is still in use so we do not delete it yet.
Generated test images are made with mkntfs v2021.8.22 (libntfs-3g) and
ntfs3 version from 5.17-rc7. For some reason I did not manage to
generate images with "-s 256" due some ntfs3 error. We can add those
later when we work out what is going on with those.
|
| |
|
|
|
|
|
| |
The interface has significantly changed since the first version.
Update to the upstreammed interface.
Fixes #3030
|
| |
|
|
|
| |
Regenerate on latest upstream commit
56e337f2cf1326323844927a04e9dbce9a244835.
|
| |
|
|
| |
Based on v5.17-rc1 and upstream-usb.config.
|
| | |
|
| |
|
|
| |
Regenerate const files on next-20220127.
|
| |
|
|
|
|
|
|
|
|
| |
Setting itself or another process as a real-time one leads to the
starvation of kernel threads and, as a result, to false positive stall
bug reports. We have been getting complaints about them for already
quite a long time now.
Neutralize the policy argument of the syscall as much as possible given
the set of possible syzkaller mutations.
|
| | |
|
| |
|
|
|
|
| |
It seems we had a bogus signature for sigaltstack for all that time.
It accepts 2 sigaltstack structs according to the kernel code:
https://elixir.bootlin.com/linux/v5.16/source/kernel/signal.c#L4217
|
| |
|
|
| |
Update #590
|
| | |
|
| | |
|
| |
|
|
| |
They are not really structs in the kernel even if we describe them as structs.
|
| |
|
|
|
| |
Regenerate warn files on the latest kernel commit fe8152b38d3
and latest syzkaller commit with fresh kernel config files.
|
| | |
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
As was pointed out in #2921, the current approach of limiting the number
of pids per process does not work on all Linux-based kernels.
We could just treat fork, clone and clone3 in a special way (e.g. exit
on a zero return). However, in that case we also need to sanitize the
arguments for clone and clone3 - if CLONE_VM is passed and stack is 0,
the forked child processes (threads) will become nearly unindentifiable
and will corrupt syz-executor's memory. While we could sanitize clone's
arguments, we cannot do so for clone3 - nothing can guarantee that they
will not be changed concurrently.
Instead of calling those syscalls directly, introduce a special pseudo
syscall syz_clone3. It copies and sanitizes the arguments and then
executes clone3 (or fork, if we're on an older kernel) in such a way so
as to prevent fork bombs from happening.
Also introduce syz_clone() to still be able to fuzz it on older systems.
|
| |
|
|
|
|
|
| |
Subsequent changes will require stricter resource constructors
and checks start failing for vcontext_handle (doesn't have ctors).
I can't wrap my head around how vcontext_handle is supposed to be created,
so for now it's downgraded to just int.
|
| | |
|
| |
|
|
|
|
|
| |
Add construcor for drm_plane_id resource that returns it outside of an array.
Provide more detailed desriptions for DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD/DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE
as they accept/return complete different resources.
|
| |
|
|
|
|
|
|
|
| |
Move existing bits of /dev/media descriptions from sys.txt and dev_video4linux.txt
and complete the descriptions.
Also provide more concrete specialization of VIDIOC_QUERYBUF ioctl.
Add ioctl specialization that serves as fd_v4l2_buffer resource constructor
(returns it outside of a union).
|
| | |
|
| |
|
|
| |
The ioctls actually return the dmabuf fd that can be used in other APIs.
|
| |
|
|
|
|
|
| |
The comment says:
// ION support was removed from kernel.
// We plan to leave the descriptions for some time as is and later remove them.
|