From d545e945ce3761556e10fd6b4c20a952c0e821a1 Mon Sep 17 00:00:00 2001 From: Andrey Konovalov Date: Wed, 7 Aug 2019 18:03:59 +0200 Subject: sys/linux: add syz_open_dev$char_usb descriptions syz_open_dev$char_usb opens char devices with major = USB_MAJOR. Sanitize its values to make sure it doesn't open other char/block devices. --- sys/linux/dev_char_usb.txt | 11 +++++++++++ sys/linux/dev_char_usb_386.const | 4 ++++ sys/linux/dev_char_usb_amd64.const | 4 ++++ sys/linux/dev_char_usb_arm.const | 4 ++++ sys/linux/dev_char_usb_arm64.const | 4 ++++ sys/linux/dev_char_usb_ppc64le.const | 4 ++++ sys/linux/gen/386.go | 19 ++++++++++++++++++- sys/linux/gen/amd64.go | 19 ++++++++++++++++++- sys/linux/gen/arm.go | 19 ++++++++++++++++++- sys/linux/gen/arm64.go | 19 ++++++++++++++++++- sys/linux/gen/ppc64le.go | 19 ++++++++++++++++++- sys/linux/init.go | 6 ++++++ 12 files changed, 127 insertions(+), 5 deletions(-) create mode 100644 sys/linux/dev_char_usb.txt create mode 100644 sys/linux/dev_char_usb_386.const create mode 100644 sys/linux/dev_char_usb_amd64.const create mode 100644 sys/linux/dev_char_usb_arm.const create mode 100644 sys/linux/dev_char_usb_arm64.const create mode 100644 sys/linux/dev_char_usb_ppc64le.const (limited to 'sys/linux') diff --git a/sys/linux/dev_char_usb.txt b/sys/linux/dev_char_usb.txt new file mode 100644 index 000000000..f75196b7e --- /dev/null +++ b/sys/linux/dev_char_usb.txt @@ -0,0 +1,11 @@ +# Copyright 2019 syzkaller project authors. All rights reserved. +# Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file. + +include + +resource fd_char_usb[fd] + +syz_open_dev$char_usb(dev const[0xc], major const[USB_MAJOR], minor intptr) fd_char_usb + +read$char_usb(fd fd_char_usb, buf buffer[out], count len[buf]) +write$char_usb(fd fd_char_usb, buf buffer[in], count len[buf]) diff --git a/sys/linux/dev_char_usb_386.const b/sys/linux/dev_char_usb_386.const new file mode 100644 index 000000000..cdb26013d --- /dev/null +++ b/sys/linux/dev_char_usb_386.const @@ -0,0 +1,4 @@ +# AUTOGENERATED FILE +USB_MAJOR = 180 +__NR_read = 3 +__NR_write = 4 diff --git a/sys/linux/dev_char_usb_amd64.const b/sys/linux/dev_char_usb_amd64.const new file mode 100644 index 000000000..cc03c76c0 --- /dev/null +++ b/sys/linux/dev_char_usb_amd64.const @@ -0,0 +1,4 @@ +# AUTOGENERATED FILE +USB_MAJOR = 180 +__NR_read = 0 +__NR_write = 1 diff --git a/sys/linux/dev_char_usb_arm.const b/sys/linux/dev_char_usb_arm.const new file mode 100644 index 000000000..cdb26013d --- /dev/null +++ b/sys/linux/dev_char_usb_arm.const @@ -0,0 +1,4 @@ +# AUTOGENERATED FILE +USB_MAJOR = 180 +__NR_read = 3 +__NR_write = 4 diff --git a/sys/linux/dev_char_usb_arm64.const b/sys/linux/dev_char_usb_arm64.const new file mode 100644 index 000000000..aa7f809eb --- /dev/null +++ b/sys/linux/dev_char_usb_arm64.const @@ -0,0 +1,4 @@ +# AUTOGENERATED FILE +USB_MAJOR = 180 +__NR_read = 63 +__NR_write = 64 diff --git a/sys/linux/dev_char_usb_ppc64le.const b/sys/linux/dev_char_usb_ppc64le.const new file mode 100644 index 000000000..cdb26013d --- /dev/null +++ b/sys/linux/dev_char_usb_ppc64le.const @@ -0,0 +1,4 @@ +# AUTOGENERATED FILE +USB_MAJOR = 180 +__NR_read = 3 +__NR_write = 4 diff --git a/sys/linux/gen/386.go b/sys/linux/gen/386.go index 8ed776167..79d474cbc 100644 --- a/sys/linux/gen/386.go +++ b/sys/linux/gen/386.go @@ -40,6 +40,7 @@ var resources_386 = []*ResourceDesc{ {Name: "fd_cgroup_pid", Type: &IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "int32", TypeSize: 4}}}, Kind: []string{"fd", "fd_cgroup_pid"}, Values: []uint64{18446744073709551615}}, {Name: "fd_cgroup_subtree", Type: &IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "int32", TypeSize: 4}}}, Kind: []string{"fd", "fd_cgroup_subtree"}, Values: []uint64{18446744073709551615}}, {Name: "fd_cgroup_type", Type: &IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "int32", TypeSize: 4}}}, Kind: []string{"fd", "fd_cgroup_type"}, Values: []uint64{18446744073709551615}}, + {Name: "fd_char_usb", Type: &IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "int32", TypeSize: 4}}}, Kind: []string{"fd", "fd_char_usb"}, Values: []uint64{18446744073709551615}}, {Name: "fd_dir", Type: &IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "int32", TypeSize: 4}}}, Kind: []string{"fd", "fd_dir"}, Values: []uint64{18446744073709551615, 18446744073709551516}}, {Name: "fd_dma_buf", Type: &IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "int32", TypeSize: 4}}}, Kind: []string{"fd", "fd_dma_buf"}, Values: []uint64{18446744073709551615}}, {Name: "fd_dmabuf", Type: &IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "int32", TypeSize: 4}}}, Kind: []string{"fd", "fd_dmabuf"}, Values: []uint64{18446744073709551615}}, @@ -39241,6 +39242,11 @@ var syscalls_386 = []*Syscall{ &PtrType{TypeCommon: TypeCommon{TypeName: "ptr", FldName: "buf", TypeSize: 4}, Type: &BufferType{TypeCommon: TypeCommon{TypeName: "array", ArgDir: 1, IsVarlen: true}}}, &LenType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "len", FldName: "size", TypeSize: 4}}, Path: []string{"buf"}}, }}, + {NR: 3, Name: "read$char_usb", CallName: "read", Args: []Type{ + &ResourceType{TypeCommon: TypeCommon{TypeName: "fd_char_usb", FldName: "fd", TypeSize: 4}}, + &PtrType{TypeCommon: TypeCommon{TypeName: "ptr", FldName: "buf", TypeSize: 4}, Type: &BufferType{TypeCommon: TypeCommon{TypeName: "array", ArgDir: 1, IsVarlen: true}}}, + &LenType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "len", FldName: "count", TypeSize: 4}}, Path: []string{"buf"}}, + }}, {NR: 3, Name: "read$eventfd", CallName: "read", Args: []Type{ &ResourceType{TypeCommon: TypeCommon{TypeName: "fd_event", FldName: "fd", TypeSize: 4}}, &PtrType{TypeCommon: TypeCommon{TypeName: "ptr", FldName: "val", TypeSize: 4}, Type: &IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "int64", TypeSize: 8, ArgDir: 1}}}}, @@ -43089,6 +43095,11 @@ var syscalls_386 = []*Syscall{ &ProcType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "proc", FldName: "id", TypeSize: 4}}, ValuesPerProc: 4}, &ConstType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "const", FldName: "flags", TypeSize: 4}}, Val: 2}, }, Ret: &ResourceType{TypeCommon: TypeCommon{TypeName: "fd", FldName: "ret", TypeSize: 4, ArgDir: 1}}}, + {Name: "syz_open_dev$char_usb", CallName: "syz_open_dev", Args: []Type{ + &ConstType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "const", FldName: "dev", TypeSize: 4}}, Val: 12}, + &ConstType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "const", FldName: "major", TypeSize: 4}}, Val: 180}, + &IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "intptr", FldName: "minor", TypeSize: 4}}}, + }, Ret: &ResourceType{TypeCommon: TypeCommon{TypeName: "fd_char_usb", FldName: "ret", TypeSize: 4, ArgDir: 1}}}, {Name: "syz_open_dev$dmmidi", CallName: "syz_open_dev", Args: []Type{ &PtrType{TypeCommon: TypeCommon{TypeName: "ptr", FldName: "dev", TypeSize: 4}, Type: &BufferType{TypeCommon: TypeCommon{TypeName: "string", TypeSize: 13}, Kind: 2, Values: []string{"/dev/dmmidi#\x00"}}}, &IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "intptr", FldName: "id", TypeSize: 4}}}, @@ -44215,6 +44226,11 @@ var syscalls_386 = []*Syscall{ &PtrType{TypeCommon: TypeCommon{TypeName: "ptr", FldName: "buf", TypeSize: 4}, Type: &BufferType{TypeCommon: TypeCommon{TypeName: "string", TypeSize: 9}, Kind: 2, Values: []string{"threaded\x00"}}}, &LenType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "bytesize", FldName: "len", TypeSize: 4}}, BitSize: 8, Path: []string{"buf"}}, }}, + {NR: 4, Name: "write$char_usb", CallName: "write", Args: []Type{ + &ResourceType{TypeCommon: TypeCommon{TypeName: "fd_char_usb", FldName: "fd", TypeSize: 4}}, + &PtrType{TypeCommon: TypeCommon{TypeName: "ptr", FldName: "buf", TypeSize: 4}, Type: &BufferType{TypeCommon: TypeCommon{TypeName: "array", IsVarlen: true}}}, + &LenType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "len", FldName: "count", TypeSize: 4}}, Path: []string{"buf"}}, + }}, {NR: 4, Name: "write$evdev", CallName: "write", Args: []Type{ &ResourceType{TypeCommon: TypeCommon{TypeName: "fd_evdev", FldName: "fd", TypeSize: 4}}, &PtrType{TypeCommon: TypeCommon{TypeName: "ptr", FldName: "data", TypeSize: 4}, Type: &ArrayType{TypeCommon: TypeCommon{TypeName: "array", IsVarlen: true}, Type: &StructType{Key: StructKey{Name: "input_event"}}}}, @@ -50397,6 +50413,7 @@ var consts_386 = []ConstValue{ {Name: "USB_LOW_SPEED_OPERATION", Value: 1}, {Name: "USB_LPM_SUPPORT", Value: 2}, {Name: "USB_LTM_SUPPORT", Value: 2}, + {Name: "USB_MAJOR", Value: 180}, {Name: "USB_PORT_STAT_CONNECTION", Value: 1}, {Name: "USB_PORT_STAT_C_BH_RESET", Value: 32}, {Name: "USB_PORT_STAT_C_CONFIG_ERROR", Value: 128}, @@ -52223,4 +52240,4 @@ var consts_386 = []ConstValue{ {Name: "bpf_insn_load_imm_dw", Value: 24}, } -const revision_386 = "eb22b8a389910e3ec878475738f280bd61b00a09" +const revision_386 = "38f83eeb8eb860a70e47d58558925a433b2db80c" diff --git a/sys/linux/gen/amd64.go b/sys/linux/gen/amd64.go index 8db199c8e..22d03a381 100644 --- a/sys/linux/gen/amd64.go +++ b/sys/linux/gen/amd64.go @@ -40,6 +40,7 @@ var resources_amd64 = []*ResourceDesc{ {Name: "fd_cgroup_pid", Type: &IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "int32", TypeSize: 4}}}, Kind: []string{"fd", "fd_cgroup_pid"}, Values: []uint64{18446744073709551615}}, {Name: "fd_cgroup_subtree", Type: &IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "int32", TypeSize: 4}}}, Kind: []string{"fd", "fd_cgroup_subtree"}, Values: []uint64{18446744073709551615}}, {Name: "fd_cgroup_type", Type: &IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "int32", TypeSize: 4}}}, Kind: []string{"fd", "fd_cgroup_type"}, Values: []uint64{18446744073709551615}}, + {Name: "fd_char_usb", Type: &IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "int32", TypeSize: 4}}}, Kind: []string{"fd", "fd_char_usb"}, Values: []uint64{18446744073709551615}}, {Name: "fd_dir", Type: &IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "int32", TypeSize: 4}}}, Kind: []string{"fd", "fd_dir"}, Values: []uint64{18446744073709551615, 18446744073709551516}}, {Name: "fd_dma_buf", Type: &IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "int32", TypeSize: 4}}}, Kind: []string{"fd", "fd_dma_buf"}, Values: []uint64{18446744073709551615}}, {Name: "fd_dmabuf", Type: &IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "int32", TypeSize: 4}}}, Kind: []string{"fd", "fd_dmabuf"}, Values: []uint64{18446744073709551615}}, @@ -39758,6 +39759,11 @@ var syscalls_amd64 = []*Syscall{ &PtrType{TypeCommon: TypeCommon{TypeName: "ptr", FldName: "buf", TypeSize: 8}, Type: &BufferType{TypeCommon: TypeCommon{TypeName: "array", ArgDir: 1, IsVarlen: true}}}, &LenType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "len", FldName: "size", TypeSize: 8}}, Path: []string{"buf"}}, }}, + {Name: "read$char_usb", CallName: "read", Args: []Type{ + &ResourceType{TypeCommon: TypeCommon{TypeName: "fd_char_usb", FldName: "fd", TypeSize: 4}}, + &PtrType{TypeCommon: TypeCommon{TypeName: "ptr", FldName: "buf", TypeSize: 8}, Type: &BufferType{TypeCommon: TypeCommon{TypeName: "array", ArgDir: 1, IsVarlen: true}}}, + &LenType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "len", FldName: "count", TypeSize: 8}}, Path: []string{"buf"}}, + }}, {Name: "read$eventfd", CallName: "read", Args: []Type{ &ResourceType{TypeCommon: TypeCommon{TypeName: "fd_event", FldName: "fd", TypeSize: 4}}, &PtrType{TypeCommon: TypeCommon{TypeName: "ptr", FldName: "val", TypeSize: 8}, Type: &IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "int64", TypeSize: 8, ArgDir: 1}}}}, @@ -43611,6 +43617,11 @@ var syscalls_amd64 = []*Syscall{ &ProcType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "proc", FldName: "id", TypeSize: 8}}, ValuesPerProc: 4}, &ConstType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "const", FldName: "flags", TypeSize: 8}}, Val: 2}, }, Ret: &ResourceType{TypeCommon: TypeCommon{TypeName: "fd", FldName: "ret", TypeSize: 4, ArgDir: 1}}}, + {Name: "syz_open_dev$char_usb", CallName: "syz_open_dev", Args: []Type{ + &ConstType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "const", FldName: "dev", TypeSize: 8}}, Val: 12}, + &ConstType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "const", FldName: "major", TypeSize: 8}}, Val: 180}, + &IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "intptr", FldName: "minor", TypeSize: 8}}}, + }, Ret: &ResourceType{TypeCommon: TypeCommon{TypeName: "fd_char_usb", FldName: "ret", TypeSize: 4, ArgDir: 1}}}, {Name: "syz_open_dev$dmmidi", CallName: "syz_open_dev", Args: []Type{ &PtrType{TypeCommon: TypeCommon{TypeName: "ptr", FldName: "dev", TypeSize: 8}, Type: &BufferType{TypeCommon: TypeCommon{TypeName: "string", TypeSize: 13}, Kind: 2, Values: []string{"/dev/dmmidi#\x00"}}}, &IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "intptr", FldName: "id", TypeSize: 8}}}, @@ -44737,6 +44748,11 @@ var syscalls_amd64 = []*Syscall{ &PtrType{TypeCommon: TypeCommon{TypeName: "ptr", FldName: "buf", TypeSize: 8}, Type: &BufferType{TypeCommon: TypeCommon{TypeName: "string", TypeSize: 9}, Kind: 2, Values: []string{"threaded\x00"}}}, &LenType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "bytesize", FldName: "len", TypeSize: 8}}, BitSize: 8, Path: []string{"buf"}}, }}, + {NR: 1, Name: "write$char_usb", CallName: "write", Args: []Type{ + &ResourceType{TypeCommon: TypeCommon{TypeName: "fd_char_usb", FldName: "fd", TypeSize: 4}}, + &PtrType{TypeCommon: TypeCommon{TypeName: "ptr", FldName: "buf", TypeSize: 8}, Type: &BufferType{TypeCommon: TypeCommon{TypeName: "array", IsVarlen: true}}}, + &LenType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "len", FldName: "count", TypeSize: 8}}, Path: []string{"buf"}}, + }}, {NR: 1, Name: "write$evdev", CallName: "write", Args: []Type{ &ResourceType{TypeCommon: TypeCommon{TypeName: "fd_evdev", FldName: "fd", TypeSize: 4}}, &PtrType{TypeCommon: TypeCommon{TypeName: "ptr", FldName: "data", TypeSize: 8}, Type: &ArrayType{TypeCommon: TypeCommon{TypeName: "array", IsVarlen: true}, Type: &StructType{Key: StructKey{Name: "input_event"}}}}, @@ -50933,6 +50949,7 @@ var consts_amd64 = []ConstValue{ {Name: "USB_LOW_SPEED_OPERATION", Value: 1}, {Name: "USB_LPM_SUPPORT", Value: 2}, {Name: "USB_LTM_SUPPORT", Value: 2}, + {Name: "USB_MAJOR", Value: 180}, {Name: "USB_PORT_STAT_CONNECTION", Value: 1}, {Name: "USB_PORT_STAT_C_BH_RESET", Value: 32}, {Name: "USB_PORT_STAT_C_CONFIG_ERROR", Value: 128}, @@ -52760,4 +52777,4 @@ var consts_amd64 = []ConstValue{ {Name: "bpf_insn_load_imm_dw", Value: 24}, } -const revision_amd64 = "b025d70b7713cc48e9ab783fc35e2410b69a5736" +const revision_amd64 = "35a61e3d9f82704660ae851088b5cab4dd788688" diff --git a/sys/linux/gen/arm.go b/sys/linux/gen/arm.go index 929a5af9d..2caa90b01 100644 --- a/sys/linux/gen/arm.go +++ b/sys/linux/gen/arm.go @@ -40,6 +40,7 @@ var resources_arm = []*ResourceDesc{ {Name: "fd_cgroup_pid", Type: &IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "int32", TypeSize: 4}}}, Kind: []string{"fd", "fd_cgroup_pid"}, Values: []uint64{18446744073709551615}}, {Name: "fd_cgroup_subtree", Type: &IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "int32", TypeSize: 4}}}, Kind: []string{"fd", "fd_cgroup_subtree"}, Values: []uint64{18446744073709551615}}, {Name: "fd_cgroup_type", Type: &IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "int32", TypeSize: 4}}}, Kind: []string{"fd", "fd_cgroup_type"}, Values: []uint64{18446744073709551615}}, + {Name: "fd_char_usb", Type: &IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "int32", TypeSize: 4}}}, Kind: []string{"fd", "fd_char_usb"}, Values: []uint64{18446744073709551615}}, {Name: "fd_dir", Type: &IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "int32", TypeSize: 4}}}, Kind: []string{"fd", "fd_dir"}, Values: []uint64{18446744073709551615, 18446744073709551516}}, {Name: "fd_dma_buf", Type: &IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "int32", TypeSize: 4}}}, Kind: []string{"fd", "fd_dma_buf"}, Values: []uint64{18446744073709551615}}, {Name: "fd_dmabuf", Type: &IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "int32", TypeSize: 4}}}, Kind: []string{"fd", "fd_dmabuf"}, Values: []uint64{18446744073709551615}}, @@ -38902,6 +38903,11 @@ var syscalls_arm = []*Syscall{ &PtrType{TypeCommon: TypeCommon{TypeName: "ptr", FldName: "buf", TypeSize: 4}, Type: &BufferType{TypeCommon: TypeCommon{TypeName: "array", ArgDir: 1, IsVarlen: true}}}, &LenType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "len", FldName: "size", TypeSize: 4}}, Path: []string{"buf"}}, }}, + {NR: 3, Name: "read$char_usb", CallName: "read", Args: []Type{ + &ResourceType{TypeCommon: TypeCommon{TypeName: "fd_char_usb", FldName: "fd", TypeSize: 4}}, + &PtrType{TypeCommon: TypeCommon{TypeName: "ptr", FldName: "buf", TypeSize: 4}, Type: &BufferType{TypeCommon: TypeCommon{TypeName: "array", ArgDir: 1, IsVarlen: true}}}, + &LenType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "len", FldName: "count", TypeSize: 4}}, Path: []string{"buf"}}, + }}, {NR: 3, Name: "read$eventfd", CallName: "read", Args: []Type{ &ResourceType{TypeCommon: TypeCommon{TypeName: "fd_event", FldName: "fd", TypeSize: 4}}, &PtrType{TypeCommon: TypeCommon{TypeName: "ptr", FldName: "val", TypeSize: 4}, Type: &IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "int64", TypeSize: 8, ArgDir: 1}}}}, @@ -42745,6 +42751,11 @@ var syscalls_arm = []*Syscall{ &ProcType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "proc", FldName: "id", TypeSize: 4}}, ValuesPerProc: 4}, &ConstType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "const", FldName: "flags", TypeSize: 4}}, Val: 2}, }, Ret: &ResourceType{TypeCommon: TypeCommon{TypeName: "fd", FldName: "ret", TypeSize: 4, ArgDir: 1}}}, + {Name: "syz_open_dev$char_usb", CallName: "syz_open_dev", Args: []Type{ + &ConstType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "const", FldName: "dev", TypeSize: 4}}, Val: 12}, + &ConstType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "const", FldName: "major", TypeSize: 4}}, Val: 180}, + &IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "intptr", FldName: "minor", TypeSize: 4}}}, + }, Ret: &ResourceType{TypeCommon: TypeCommon{TypeName: "fd_char_usb", FldName: "ret", TypeSize: 4, ArgDir: 1}}}, {Name: "syz_open_dev$dmmidi", CallName: "syz_open_dev", Args: []Type{ &PtrType{TypeCommon: TypeCommon{TypeName: "ptr", FldName: "dev", TypeSize: 4}, Type: &BufferType{TypeCommon: TypeCommon{TypeName: "string", TypeSize: 13}, Kind: 2, Values: []string{"/dev/dmmidi#\x00"}}}, &IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "intptr", FldName: "id", TypeSize: 4}}}, @@ -43864,6 +43875,11 @@ var syscalls_arm = []*Syscall{ &PtrType{TypeCommon: TypeCommon{TypeName: "ptr", FldName: "buf", TypeSize: 4}, Type: &BufferType{TypeCommon: TypeCommon{TypeName: "string", TypeSize: 9}, Kind: 2, Values: []string{"threaded\x00"}}}, &LenType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "bytesize", FldName: "len", TypeSize: 4}}, BitSize: 8, Path: []string{"buf"}}, }}, + {NR: 4, Name: "write$char_usb", CallName: "write", Args: []Type{ + &ResourceType{TypeCommon: TypeCommon{TypeName: "fd_char_usb", FldName: "fd", TypeSize: 4}}, + &PtrType{TypeCommon: TypeCommon{TypeName: "ptr", FldName: "buf", TypeSize: 4}, Type: &BufferType{TypeCommon: TypeCommon{TypeName: "array", IsVarlen: true}}}, + &LenType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "len", FldName: "count", TypeSize: 4}}, Path: []string{"buf"}}, + }}, {NR: 4, Name: "write$evdev", CallName: "write", Args: []Type{ &ResourceType{TypeCommon: TypeCommon{TypeName: "fd_evdev", FldName: "fd", TypeSize: 4}}, &PtrType{TypeCommon: TypeCommon{TypeName: "ptr", FldName: "data", TypeSize: 4}, Type: &ArrayType{TypeCommon: TypeCommon{TypeName: "array", IsVarlen: true}, Type: &StructType{Key: StructKey{Name: "input_event"}}}}, @@ -49984,6 +50000,7 @@ var consts_arm = []ConstValue{ {Name: "USB_LOW_SPEED_OPERATION", Value: 1}, {Name: "USB_LPM_SUPPORT", Value: 2}, {Name: "USB_LTM_SUPPORT", Value: 2}, + {Name: "USB_MAJOR", Value: 180}, {Name: "USB_PORT_STAT_CONNECTION", Value: 1}, {Name: "USB_PORT_STAT_C_BH_RESET", Value: 32}, {Name: "USB_PORT_STAT_C_CONFIG_ERROR", Value: 128}, @@ -51800,4 +51817,4 @@ var consts_arm = []ConstValue{ {Name: "bpf_insn_load_imm_dw", Value: 24}, } -const revision_arm = "fdb9cb5b71481f79ff86d824721def50b72fafa5" +const revision_arm = "aa728964114f9bdcdb61227af7a3592558e9a3ab" diff --git a/sys/linux/gen/arm64.go b/sys/linux/gen/arm64.go index 9796420cb..66a717719 100644 --- a/sys/linux/gen/arm64.go +++ b/sys/linux/gen/arm64.go @@ -40,6 +40,7 @@ var resources_arm64 = []*ResourceDesc{ {Name: "fd_cgroup_pid", Type: &IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "int32", TypeSize: 4}}}, Kind: []string{"fd", "fd_cgroup_pid"}, Values: []uint64{18446744073709551615}}, {Name: "fd_cgroup_subtree", Type: &IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "int32", TypeSize: 4}}}, Kind: []string{"fd", "fd_cgroup_subtree"}, Values: []uint64{18446744073709551615}}, {Name: "fd_cgroup_type", Type: &IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "int32", TypeSize: 4}}}, Kind: []string{"fd", "fd_cgroup_type"}, Values: []uint64{18446744073709551615}}, + {Name: "fd_char_usb", Type: &IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "int32", TypeSize: 4}}}, Kind: []string{"fd", "fd_char_usb"}, Values: []uint64{18446744073709551615}}, {Name: "fd_dir", Type: &IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "int32", TypeSize: 4}}}, Kind: []string{"fd", "fd_dir"}, Values: []uint64{18446744073709551615, 18446744073709551516}}, {Name: "fd_dma_buf", Type: &IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "int32", TypeSize: 4}}}, Kind: []string{"fd", "fd_dma_buf"}, Values: []uint64{18446744073709551615}}, {Name: "fd_dmabuf", Type: &IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "int32", TypeSize: 4}}}, Kind: []string{"fd", "fd_dmabuf"}, Values: []uint64{18446744073709551615}}, @@ -39281,6 +39282,11 @@ var syscalls_arm64 = []*Syscall{ &PtrType{TypeCommon: TypeCommon{TypeName: "ptr", FldName: "buf", TypeSize: 8}, Type: &BufferType{TypeCommon: TypeCommon{TypeName: "array", ArgDir: 1, IsVarlen: true}}}, &LenType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "len", FldName: "size", TypeSize: 8}}, Path: []string{"buf"}}, }}, + {NR: 63, Name: "read$char_usb", CallName: "read", Args: []Type{ + &ResourceType{TypeCommon: TypeCommon{TypeName: "fd_char_usb", FldName: "fd", TypeSize: 4}}, + &PtrType{TypeCommon: TypeCommon{TypeName: "ptr", FldName: "buf", TypeSize: 8}, Type: &BufferType{TypeCommon: TypeCommon{TypeName: "array", ArgDir: 1, IsVarlen: true}}}, + &LenType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "len", FldName: "count", TypeSize: 8}}, Path: []string{"buf"}}, + }}, {NR: 63, Name: "read$eventfd", CallName: "read", Args: []Type{ &ResourceType{TypeCommon: TypeCommon{TypeName: "fd_event", FldName: "fd", TypeSize: 4}}, &PtrType{TypeCommon: TypeCommon{TypeName: "ptr", FldName: "val", TypeSize: 8}, Type: &IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "int64", TypeSize: 8, ArgDir: 1}}}}, @@ -43087,6 +43093,11 @@ var syscalls_arm64 = []*Syscall{ &ProcType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "proc", FldName: "id", TypeSize: 8}}, ValuesPerProc: 4}, &ConstType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "const", FldName: "flags", TypeSize: 8}}, Val: 2}, }, Ret: &ResourceType{TypeCommon: TypeCommon{TypeName: "fd", FldName: "ret", TypeSize: 4, ArgDir: 1}}}, + {Name: "syz_open_dev$char_usb", CallName: "syz_open_dev", Args: []Type{ + &ConstType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "const", FldName: "dev", TypeSize: 8}}, Val: 12}, + &ConstType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "const", FldName: "major", TypeSize: 8}}, Val: 180}, + &IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "intptr", FldName: "minor", TypeSize: 8}}}, + }, Ret: &ResourceType{TypeCommon: TypeCommon{TypeName: "fd_char_usb", FldName: "ret", TypeSize: 4, ArgDir: 1}}}, {Name: "syz_open_dev$dmmidi", CallName: "syz_open_dev", Args: []Type{ &PtrType{TypeCommon: TypeCommon{TypeName: "ptr", FldName: "dev", TypeSize: 8}, Type: &BufferType{TypeCommon: TypeCommon{TypeName: "string", TypeSize: 13}, Kind: 2, Values: []string{"/dev/dmmidi#\x00"}}}, &IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "intptr", FldName: "id", TypeSize: 8}}}, @@ -44192,6 +44203,11 @@ var syscalls_arm64 = []*Syscall{ &PtrType{TypeCommon: TypeCommon{TypeName: "ptr", FldName: "buf", TypeSize: 8}, Type: &BufferType{TypeCommon: TypeCommon{TypeName: "string", TypeSize: 9}, Kind: 2, Values: []string{"threaded\x00"}}}, &LenType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "bytesize", FldName: "len", TypeSize: 8}}, BitSize: 8, Path: []string{"buf"}}, }}, + {NR: 64, Name: "write$char_usb", CallName: "write", Args: []Type{ + &ResourceType{TypeCommon: TypeCommon{TypeName: "fd_char_usb", FldName: "fd", TypeSize: 4}}, + &PtrType{TypeCommon: TypeCommon{TypeName: "ptr", FldName: "buf", TypeSize: 8}, Type: &BufferType{TypeCommon: TypeCommon{TypeName: "array", IsVarlen: true}}}, + &LenType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "len", FldName: "count", TypeSize: 8}}, Path: []string{"buf"}}, + }}, {NR: 64, Name: "write$evdev", CallName: "write", Args: []Type{ &ResourceType{TypeCommon: TypeCommon{TypeName: "fd_evdev", FldName: "fd", TypeSize: 4}}, &PtrType{TypeCommon: TypeCommon{TypeName: "ptr", FldName: "data", TypeSize: 8}, Type: &ArrayType{TypeCommon: TypeCommon{TypeName: "array", IsVarlen: true}, Type: &StructType{Key: StructKey{Name: "input_event"}}}}, @@ -50326,6 +50342,7 @@ var consts_arm64 = []ConstValue{ {Name: "USB_LOW_SPEED_OPERATION", Value: 1}, {Name: "USB_LPM_SUPPORT", Value: 2}, {Name: "USB_LTM_SUPPORT", Value: 2}, + {Name: "USB_MAJOR", Value: 180}, {Name: "USB_PORT_STAT_CONNECTION", Value: 1}, {Name: "USB_PORT_STAT_C_BH_RESET", Value: 32}, {Name: "USB_PORT_STAT_C_CONFIG_ERROR", Value: 128}, @@ -52112,4 +52129,4 @@ var consts_arm64 = []ConstValue{ {Name: "bpf_insn_load_imm_dw", Value: 24}, } -const revision_arm64 = "26a51558327902a8e8951bd6afdcdae046006802" +const revision_arm64 = "2436d280e9b215f342b807b6e7d340e8de10d2d0" diff --git a/sys/linux/gen/ppc64le.go b/sys/linux/gen/ppc64le.go index 7788c1eee..be0386cdd 100644 --- a/sys/linux/gen/ppc64le.go +++ b/sys/linux/gen/ppc64le.go @@ -40,6 +40,7 @@ var resources_ppc64le = []*ResourceDesc{ {Name: "fd_cgroup_pid", Type: &IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "int32", TypeSize: 4}}}, Kind: []string{"fd", "fd_cgroup_pid"}, Values: []uint64{18446744073709551615}}, {Name: "fd_cgroup_subtree", Type: &IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "int32", TypeSize: 4}}}, Kind: []string{"fd", "fd_cgroup_subtree"}, Values: []uint64{18446744073709551615}}, {Name: "fd_cgroup_type", Type: &IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "int32", TypeSize: 4}}}, Kind: []string{"fd", "fd_cgroup_type"}, Values: []uint64{18446744073709551615}}, + {Name: "fd_char_usb", Type: &IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "int32", TypeSize: 4}}}, Kind: []string{"fd", "fd_char_usb"}, Values: []uint64{18446744073709551615}}, {Name: "fd_dir", Type: &IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "int32", TypeSize: 4}}}, Kind: []string{"fd", "fd_dir"}, Values: []uint64{18446744073709551615, 18446744073709551516}}, {Name: "fd_dma_buf", Type: &IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "int32", TypeSize: 4}}}, Kind: []string{"fd", "fd_dma_buf"}, Values: []uint64{18446744073709551615}}, {Name: "fd_dmabuf", Type: &IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "int32", TypeSize: 4}}}, Kind: []string{"fd", "fd_dmabuf"}, Values: []uint64{18446744073709551615}}, @@ -39221,6 +39222,11 @@ var syscalls_ppc64le = []*Syscall{ &PtrType{TypeCommon: TypeCommon{TypeName: "ptr", FldName: "buf", TypeSize: 8}, Type: &BufferType{TypeCommon: TypeCommon{TypeName: "array", ArgDir: 1, IsVarlen: true}}}, &LenType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "len", FldName: "size", TypeSize: 8}}, Path: []string{"buf"}}, }}, + {NR: 3, Name: "read$char_usb", CallName: "read", Args: []Type{ + &ResourceType{TypeCommon: TypeCommon{TypeName: "fd_char_usb", FldName: "fd", TypeSize: 4}}, + &PtrType{TypeCommon: TypeCommon{TypeName: "ptr", FldName: "buf", TypeSize: 8}, Type: &BufferType{TypeCommon: TypeCommon{TypeName: "array", ArgDir: 1, IsVarlen: true}}}, + &LenType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "len", FldName: "count", TypeSize: 8}}, Path: []string{"buf"}}, + }}, {NR: 3, Name: "read$eventfd", CallName: "read", Args: []Type{ &ResourceType{TypeCommon: TypeCommon{TypeName: "fd_event", FldName: "fd", TypeSize: 4}}, &PtrType{TypeCommon: TypeCommon{TypeName: "ptr", FldName: "val", TypeSize: 8}, Type: &IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "int64", TypeSize: 8, ArgDir: 1}}}}, @@ -43060,6 +43066,11 @@ var syscalls_ppc64le = []*Syscall{ &ProcType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "proc", FldName: "id", TypeSize: 8}}, ValuesPerProc: 4}, &ConstType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "const", FldName: "flags", TypeSize: 8}}, Val: 2}, }, Ret: &ResourceType{TypeCommon: TypeCommon{TypeName: "fd", FldName: "ret", TypeSize: 4, ArgDir: 1}}}, + {Name: "syz_open_dev$char_usb", CallName: "syz_open_dev", Args: []Type{ + &ConstType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "const", FldName: "dev", TypeSize: 8}}, Val: 12}, + &ConstType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "const", FldName: "major", TypeSize: 8}}, Val: 180}, + &IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "intptr", FldName: "minor", TypeSize: 8}}}, + }, Ret: &ResourceType{TypeCommon: TypeCommon{TypeName: "fd_char_usb", FldName: "ret", TypeSize: 4, ArgDir: 1}}}, {Name: "syz_open_dev$dmmidi", CallName: "syz_open_dev", Args: []Type{ &PtrType{TypeCommon: TypeCommon{TypeName: "ptr", FldName: "dev", TypeSize: 8}, Type: &BufferType{TypeCommon: TypeCommon{TypeName: "string", TypeSize: 13}, Kind: 2, Values: []string{"/dev/dmmidi#\x00"}}}, &IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "intptr", FldName: "id", TypeSize: 8}}}, @@ -44186,6 +44197,11 @@ var syscalls_ppc64le = []*Syscall{ &PtrType{TypeCommon: TypeCommon{TypeName: "ptr", FldName: "buf", TypeSize: 8}, Type: &BufferType{TypeCommon: TypeCommon{TypeName: "string", TypeSize: 9}, Kind: 2, Values: []string{"threaded\x00"}}}, &LenType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "bytesize", FldName: "len", TypeSize: 8}}, BitSize: 8, Path: []string{"buf"}}, }}, + {NR: 4, Name: "write$char_usb", CallName: "write", Args: []Type{ + &ResourceType{TypeCommon: TypeCommon{TypeName: "fd_char_usb", FldName: "fd", TypeSize: 4}}, + &PtrType{TypeCommon: TypeCommon{TypeName: "ptr", FldName: "buf", TypeSize: 8}, Type: &BufferType{TypeCommon: TypeCommon{TypeName: "array", IsVarlen: true}}}, + &LenType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "len", FldName: "count", TypeSize: 8}}, Path: []string{"buf"}}, + }}, {NR: 4, Name: "write$evdev", CallName: "write", Args: []Type{ &ResourceType{TypeCommon: TypeCommon{TypeName: "fd_evdev", FldName: "fd", TypeSize: 4}}, &PtrType{TypeCommon: TypeCommon{TypeName: "ptr", FldName: "data", TypeSize: 8}, Type: &ArrayType{TypeCommon: TypeCommon{TypeName: "array", IsVarlen: true}, Type: &StructType{Key: StructKey{Name: "input_event"}}}}, @@ -50299,6 +50315,7 @@ var consts_ppc64le = []ConstValue{ {Name: "USB_LOW_SPEED_OPERATION", Value: 1}, {Name: "USB_LPM_SUPPORT", Value: 2}, {Name: "USB_LTM_SUPPORT", Value: 2}, + {Name: "USB_MAJOR", Value: 180}, {Name: "USB_PORT_STAT_CONNECTION", Value: 1}, {Name: "USB_PORT_STAT_C_BH_RESET", Value: 32}, {Name: "USB_PORT_STAT_C_CONFIG_ERROR", Value: 128}, @@ -52077,4 +52094,4 @@ var consts_ppc64le = []ConstValue{ {Name: "bpf_insn_load_imm_dw", Value: 24}, } -const revision_ppc64le = "d118414cc10f2c07b6a9e1fae0e14db998375343" +const revision_ppc64le = "c87d0e37e231bd4df8bbd35f06200017b89567a1" diff --git a/sys/linux/init.go b/sys/linux/init.go index e24e7eb77..5ae9f001d 100644 --- a/sys/linux/init.go +++ b/sys/linux/init.go @@ -41,6 +41,7 @@ func InitTarget(target *prog.Target) { AF_AX25: target.GetConst("AF_AX25"), AF_NETROM: target.GetConst("AF_NETROM"), AF_ROSE: target.GetConst("AF_ROSE"), + USB_MAJOR: target.GetConst("USB_MAJOR"), // These are not present on all arches. ARCH_SET_FS: target.ConstMap["ARCH_SET_FS"], ARCH_SET_GS: target.ConstMap["ARCH_SET_GS"], @@ -138,6 +139,7 @@ type arch struct { AF_AX25 uint64 AF_NETROM uint64 AF_ROSE uint64 + USB_MAJOR uint64 } func (arch *arch) sanitizeCall(c *prog.Call) { @@ -206,6 +208,10 @@ func (arch *arch) sanitizeCall(c *prog.Call) { switch c.Meta.Name { case "setsockopt$EBT_SO_SET_ENTRIES": arch.sanitizeEbtables(c) + case "syz_open_dev$char_usb": + // Don't allow opening various char and block devices. + c.Args[0].(*prog.ConstArg).Val = 0xc + c.Args[1].(*prog.ConstArg).Val = arch.USB_MAJOR } } -- cgit mrf-deployment