1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
|
# Copyright 2015 syzkaller project authors. All rights reserved.
# Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.
include <asm/ioctls.h>
include <linux/stat.h>
include <uapi/linux/fuse.h>
resource fd_fuse[fd]
syz_fuse_mount(target ptr[in, filename], mode flags[fuse_mode], uid uid, gid gid, maxread intptr, flags flags[mount_flags]) fd_fuse
syz_fuseblk_mount(target ptr[in, filename], blkdev ptr[in, filename], mode flags[fuse_mode], uid uid, gid gid, maxread intptr, blksize intptr, flags flags[mount_flags]) fd_fuse
ioctl$FUSE_DEV_IOC_CLONE(fd fd_fuse, cmd const[FUSE_DEV_IOC_CLONE], arg ptr[in, fd_fuse])
write$fuse(fd fd_fuse, arg ptr[in, fuse_out], len bytesize[arg])
# 1 stands for default_permissions, 2 - allow_other
fuse_mode = 1, 2, S_IFREG, S_IFCHR, S_IFBLK, S_IFIFO, S_IFSOCK, S_IFLNK, S_IFDIR
fuse_out {
len len[parent, int32]
err int32[0:1]
unique int64[0:10]
data fuse_reply
}
fuse_reply [
random array[int8]
fuse_init_out fuse_init_out
fuse_bmap_out fuse_bmap_out
fuse_ioctl_out fuse_ioctl_out
fuse_poll_out fuse_poll_out
fuse_notify_poll_wakeup_out fuse_notify_poll_wakeup_out
fuse_notify_inval_inode_out fuse_notify_inval_inode_out
fuse_notify_inval_entry_out fuse_notify_inval_entry_out
fuse_notify_delete_out fuse_notify_delete_out
fuse_notify_store_out fuse_notify_store_out
fuse_notify_retrieve_out fuse_notify_retrieve_out
] [varlen]
fuse_init_out {
maj const[FUSE_KERNEL_VERSION, int32]
min const[FUSE_KERNEL_MINOR_VERSION, int32]
readah int32
flags int32
backg int16
congest int16
maxwr int32
timegr int32
unused0 array[const[0, int32], 9]
}
fuse_bmap_out {
block int64
}
fuse_ioctl_out {
res int32
flags int32
iniovs int32
outiovs int32
}
fuse_poll_out {
revents int32
}
fuse_notify_poll_wakeup_out {
kh int16
}
fuse_notify_inval_inode_out {
ino int64
off int64
len2 int16
}
fuse_notify_inval_entry_out {
par int64
namelen int32
}
fuse_notify_delete_out {
par int64
child int64
namelen int32
}
fuse_notify_store_out {
nodeid int64
off int64
size int32
}
fuse_notify_retrieve_out {
unique2 int64[0:10]
nodeid int64
off int64
size int32
}
|
