From c3b8db6b7e7a9a4c77cd28b9ad53b899f017df00 Mon Sep 17 00:00:00 2001 From: fellair Date: Wed, 13 Aug 2025 14:28:15 +0300 Subject: sys/linux: add basic examples of vusb variants This change is the first step in addressing issue [1]. Despite syzkaller's best efforts, some usb drivers are proving resistant to attempts to probe them. Specifically, crafted devices are not accurate enough to bypass checks in probe(). These checks mostly deal with usb interfaces and endpoints. One way to address this issue is to define syz_connect_* calls variants to help syzkaller succeed probing by describing in detail various device attributes. Start by describing such calls for select drivers, each representing its own category of sorts. At the moment, code coverage for these drivers is unimpressive: - rtl8150 Used to succeed probing until a better usb endpoint check was implemented. - sierra_net Same as rtl8150. Depends on usbnet API for bind() and usb ep checks. - lan78xx Requires numerous control requests between driver and device DURING probe. Extra descriptions are helpful but are not enough to fully complete probing process. Also, add a seed for each such example. This is only a stepping stone to improve usb fuzzing results and most likely will be subject to change in the future. [1] https://github.com/google/syzkaller/issues/6206 --- sys/linux/vusb.txt.const | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) (limited to 'sys/linux/vusb.txt.const') diff --git a/sys/linux/vusb.txt.const b/sys/linux/vusb.txt.const index 5eb8cfe6f..b707e8dc4 100644 --- a/sys/linux/vusb.txt.const +++ b/sys/linux/vusb.txt.const @@ -73,6 +73,14 @@ HUB_CHAR_PORTIND = 128 HUB_CHAR_TTTT = 96 HUB_STATUS_LOCAL_POWER = 1 HUB_STATUS_OVERCURRENT = 2 +LAN78XX_REG_TYPE_IN = 192 +LAN78XX_REG_TYPE_OUT = 64 +RTL8150_REQT_READ = 192 +RTL8150_REQT_WRITE = 64 +RTL8150_REQ_GET_REGS = 5 +RTL8150_REQ_SET_REGS = 5 +SIERRA_CMD_TYPE_IN = 161 +SIERRA_CMD_TYPE_OUT = 33 UAC1_EXTENSION_UNIT = 8 UAC1_PROCESSING_UNIT = 7 UAC_AS_GENERAL = 1 @@ -162,6 +170,7 @@ USB_CDC_COUNTRY_TYPE = 7 USB_CDC_DMM_TYPE = 20 USB_CDC_ETHERNET_TYPE = 15 USB_CDC_GET_CRC_MODE = 137 +USB_CDC_GET_ENCAPSULATED_RESPONSE = 1 USB_CDC_GET_MAX_DATAGRAM_SIZE = 135 USB_CDC_GET_NTB_FORMAT = 131 USB_CDC_GET_NTB_INPUT_SIZE = 133 @@ -181,6 +190,7 @@ USB_CDC_NCM_TYPE = 26 USB_CDC_NETWORK_TERMINAL_TYPE = 10 USB_CDC_OBEX_TYPE = 21 USB_CDC_PROTO_NONE = 0 +USB_CDC_SEND_ENCAPSULATED_COMMAND = 0 USB_CDC_SUBCLASS_ETHERNET = 6 USB_CDC_SUBCLASS_NCM = 13 USB_CDC_UNION_TYPE = 6 @@ -235,6 +245,7 @@ USB_ENDPOINT_ATH9K_BULK_OUT_ADDRESS = 1 USB_ENDPOINT_ATH9K_INT_ATTRIBUTES = 3 USB_ENDPOINT_ATH9K_INT_IN_ADDRESS = 131 USB_ENDPOINT_ATH9K_INT_OUT_ADDRESS = 4 +USB_ENDPOINT_BULK_ATTR = 2 USB_ENDPOINT_CDC_ECM_DATA_ATTRIBUTES = 2 USB_ENDPOINT_CDC_ECM_IN_ADDRESS = 130 USB_ENDPOINT_CDC_ECM_NOTIFY_ADDRESS = 129 @@ -245,6 +256,7 @@ USB_ENDPOINT_HID_IN_ADDRESS = 129 USB_ENDPOINT_HID_OUT_ADDRESS = 2 USB_ENDPOINT_INTR_NOTIFICATION = 16 USB_ENDPOINT_INTR_PERIODIC = 0 +USB_ENDPOINT_INT_ATTR = 3 USB_ENDPOINT_PRINTER_ATTRIBUTES = 2 USB_ENDPOINT_PRINTER_IN_ADDRESS = 130 USB_ENDPOINT_PRINTER_OUT_ADDRESS = 1 @@ -265,6 +277,9 @@ USB_EXT_PORT_STAT_RX_LANES = 3840 USB_EXT_PORT_STAT_RX_SPEED_ID = 15 USB_EXT_PORT_STAT_TX_LANES = 61440 USB_EXT_PORT_STAT_TX_SPEED_ID = 240 +USB_FIXED_ENDPOINT_BULK_IN_ADDR = 129 +USB_FIXED_ENDPOINT_BULK_OUT_ADDR = 2 +USB_FIXED_ENDPOINT_INT_IN_ADDR = 131 USB_FULL_SPEED_OPERATION = 2 USB_HIGH_SPEED_OPERATION = 4 USB_HUB_PORTS_BITS = 4 @@ -297,6 +312,7 @@ USB_PORT_STAT_SPEED_5GBPS = 0 USB_PORT_STAT_SUSPEND = 4 USB_PORT_STAT_TEST = 2048 USB_PTM_CAP_TYPE = 11 +USB_RECIP_DEVICE = 0 USB_REQ_CLEAR_FEATURE = 1 USB_REQ_GET_BATTERY_STATUS = 21 USB_REQ_GET_CONFIGURATION = 8 @@ -366,6 +382,9 @@ USB_SUBCLASS_VENDOR_SPEC = 255 USB_TYPE_CLASS = 32 USB_TYPE_STANDARD = 0 USB_TYPE_VENDOR = 64 +USB_VENDOR_REQUEST_GET_STATS = 162 +USB_VENDOR_REQUEST_READ_REGISTER = 161 +USB_VENDOR_REQUEST_WRITE_REGISTER = 160 USB_WIRELESS_BEACON_DIRECTED = 8 USB_WIRELESS_BEACON_MASK = 12 USB_WIRELESS_BEACON_NONE = 12 -- cgit mrf-deployment