From c7a4fb9986eefae356612610b595244c8e49bb2a Mon Sep 17 00:00:00 2001 From: Eric Biggers Date: Fri, 27 Sep 2019 11:08:31 -0700 Subject: sys/linux/dev_binder.txt: also support real-world binder device names It was reported that binder isn't covered when using syzkaller on a real Android device, since the binder device names are different. Update the descriptions to know about the real-world device names too. --- sys/linux/dev_binder.txt | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) (limited to 'sys/linux/dev_binder.txt') diff --git a/sys/linux/dev_binder.txt b/sys/linux/dev_binder.txt index df9423505..f9fb3d7f5 100644 --- a/sys/linux/dev_binder.txt +++ b/sys/linux/dev_binder.txt @@ -3,6 +3,8 @@ # Description uses binder device per test process, they are expected to be configured with # CONFIG_ANDROID_BINDER_DEVICES="binder0,...,binder31". +# "binder,hwbinder,vndbinder" is also supported; this is the kconfig default and +# it's what's used on real Android devices (the main user of binder). # Description assumes CONFIG_ANDROID_BINDER_IPC_32BIT is not set. include @@ -17,7 +19,10 @@ type binder_handle int32[0:3] # It seems that cookies are only checked for inequality and non-matching cookies only cover error paths. type binder_cookie const[0, int64] -syz_open_dev$binder(dev ptr[in, string["/dev/binder#"]], id proc[0, 1], flags flags[binder_open_flags]) fd_binder +syz_open_dev$binderN(dev ptr[in, string["/dev/binder#"]], id proc[0, 1], flags flags[binder_open_flags]) fd_binder +syz_open_dev$binder(dev ptr[in, string["/dev/binder"]], id intptr, flags flags[binder_open_flags]) fd_binder +syz_open_dev$hwbinder(dev ptr[in, string["/dev/hwbinder"]], id intptr, flags flags[binder_open_flags]) fd_binder +syz_open_dev$vndbinder(dev ptr[in, string["/dev/vndbinder"]], id intptr, flags flags[binder_open_flags]) fd_binder mmap$binder(addr vma, len len[addr], prot const[PROT_READ], flags const[MAP_SHARED], fd fd_binder, offset fileoff) binder_ptr -- cgit mrf-deployment