@@ -1438,3 +1438,175 @@ htc_frame_flags = HTC_FLAGS_RECV_TRAILER
14381438# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
14391439# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
14401440# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
1441+
1442+ # Assorted driver-specific descriptions of generic syz_* calls' variants.
1443+
1444+ # Generic calls such as syz_usb_connect() and syz_usb_control_io() should be enough
1445+ # (in theory) to emulate a proper device and finish driver probes without a hitch.
1446+ # However, there are cases when syzkaller fails to come up with correct inputs to achieve it.
1447+ # Use fixed descriptors to quickly pass through probe() to access select drivers' post-probe functionality.
1448+
1449+ # It is important to note that, one way or another, drivers in question require multiple control requests
1450+ # between a driver and a device processed during probe(). Descriptions below do not deal with specific
1451+ # CTRL requests as such (except for basic information included in vusb_responses_XXX). Instead, rely on
1452+ # seeds, created both manually and with syzkaller's help. For examples, see sys/linux/test/vusb_XXX.
1453+
1454+ # Common constants for endpoint descriptors.
1455+ define USB_ENDPOINT_BULK_ATTR (USB_ENDPOINT_XFER_BULK)
1456+ define USB_ENDPOINT_INT_ATTR (USB_ENDPOINT_XFER_INT)
1457+
1458+ define USB_FIXED_ENDPOINT_BULK_IN_ADDR (1 | USB_DIR_IN)
1459+ define USB_FIXED_ENDPOINT_BULK_OUT_ADDR (2)
1460+ define USB_FIXED_ENDPOINT_INT_IN_ADDR (3 | USB_DIR_IN)
1461+
1462+ define USB_RECIP_DEVICE 0x00
1463+
1464+ # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
1465+
1466+ # rtl8150 driver specific descriptions.
1467+
1468+ resource fd_usb_rtl8150[fd_usb]
1469+
1470+ syz_usb_connect$rtl8150(speed flags[usb_device_speed], dev_len len[dev], dev ptr[in, usb_device_descriptor_rtl8150], conn_descs const[0]) fd_usb_rtl8150 (timeout[3000], prog_timeout[3000], remote_cover)
1471+ syz_usb_control_io$rtl8150(fd fd_usb_rtl8150, descs ptr[in, vusb_descriptors_rtl8150], resps ptr[in, vusb_responses_rtl8150]) (timeout[300], remote_cover)
1472+
1473+ usb_device_descriptor_rtl8150 {
1474+ inner usb_device_descriptor_fixed_t[0x200, USB_CLASS_VENDOR_SPEC, USB_SUBCLASS_VENDOR_SPEC, 0xff, 64, 0xbda, 0x8150, 0, array[usb_config_descriptor_rtl8150, 1]]
1475+ } [packed]
1476+
1477+ usb_config_descriptor_rtl8150 {
1478+ inner usb_config_descriptor_fixed_t[1, 1, USB_CONFIG_ATT_ONE, 250, usb_interface_descriptor_rtl8150]
1479+ } [packed]
1480+
1481+ usb_interface_descriptor_rtl8150 {
1482+ iface usb_interface_descriptor_fixed_t[0, 0, 3, USB_CLASS_VENDOR_SPEC, 0, 0, void, usb_endpoint_descriptors_rtl8150]
1483+ } [packed]
1484+
1485+ usb_endpoint_descriptors_rtl8150 {
1486+ bulk_in usb_endpoint_descriptor_fixed_t[USB_FIXED_ENDPOINT_BULK_IN_ADDR, USB_ENDPOINT_BULK_ATTR, 512, 0, void]
1487+ bulk_out usb_endpoint_descriptor_fixed_t[USB_FIXED_ENDPOINT_BULK_OUT_ADDR, USB_ENDPOINT_BULK_ATTR, 512, 0, void]
1488+ int_in usb_endpoint_descriptor_fixed_t[USB_FIXED_ENDPOINT_INT_IN_ADDR, USB_ENDPOINT_INT_ATTR, 64, 1, void]
1489+ } [packed]
1490+
1491+ vusb_descriptors_rtl8150 {
1492+ len len[parent, int32]
1493+ generic ptr[in, vusb_descriptor_generic]
1494+
1495+ USB_DT_STRING ptr[in, vusb_descriptor_t[USB_TYPE_STANDARD, USB_DT_STRING, usb_string_descriptor]]
1496+ } [packed]
1497+
1498+ vusb_responses_rtl8150 {
1499+ len len[parent, int32]
1500+ generic ptr[in, vusb_response_generic]
1501+
1502+ USB_REQ_GET_INTERFACE ptr[in, vusb_response_t[USB_TYPE_STANDARD, USB_REQ_GET_INTERFACE, int8]]
1503+ USB_REQ_GET_CONFIGURATION ptr[in, vusb_response_t[USB_TYPE_STANDARD, USB_REQ_GET_CONFIGURATION, int8]]
1504+
1505+ RTL8150_REQ_GET_REGS ptr[in, vusb_response_t[RTL8150_REQT_READ, RTL8150_REQ_GET_REGS, array[int8, 0:6]]]
1506+ RTL8150_REQ_SET_REGS ptr[in, vusb_response_t[RTL8150_REQT_WRITE, RTL8150_REQ_SET_REGS, array[int8, 0:6]]]
1507+ } [packed]
1508+
1509+ define RTL8150_REQ_GET_REGS 0x05
1510+ define RTL8150_REQ_SET_REGS 0x05
1511+ define RTL8150_REQT_READ 0xc0
1512+ define RTL8150_REQT_WRITE 0x40
1513+
1514+ # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
1515+
1516+ # sierra_net driver specific descriptions.
1517+
1518+ resource fd_usb_sierra_net[fd_usb]
1519+
1520+ syz_usb_connect$sierra_net(speed flags[usb_device_speed], dev_len len[dev], dev ptr[in, usb_device_descriptor_sierra_net], conn_descs const[0]) fd_usb_sierra_net (timeout[3000], prog_timeout[3000], remote_cover)
1521+ syz_usb_control_io$sierra_net(fd fd_usb_sierra_net, descs ptr[in, vusb_descriptors_sierra_net], resps ptr[in, vusb_responses_sierra_net]) (timeout[300], remote_cover)
1522+
1523+ usb_device_descriptor_sierra_net {
1524+ inner usb_device_descriptor_fixed_t[0x200, USB_CLASS_VENDOR_SPEC, USB_SUBCLASS_VENDOR_SPEC, 0xff, 64, 0x1199, 0x68a3, 0, array[usb_config_descriptor_sierra_net, 1]]
1525+ } [packed]
1526+
1527+ usb_config_descriptor_sierra_net {
1528+ inner usb_config_descriptor_fixed_t[1, 1, USB_CONFIG_ATT_ONE, 250, usb_interface_descriptor_sierra_net]
1529+ } [packed]
1530+
1531+ usb_interface_descriptor_sierra_net {
1532+ iface usb_interface_descriptor_fixed_t[7, 0, 3, USB_CLASS_VENDOR_SPEC, 0, 0, void, usb_endpoint_descriptors_sierra_net]
1533+ } [packed]
1534+
1535+ # sierra_net driver does not expect fixed ep addresses, so refrain from being too specific here.
1536+ # As long as we ensure there are 3 endpoints, 2 bulk and 1 int, syzkaller should figure it out.
1537+ usb_endpoint_descriptors_sierra_net {
1538+ bulk_in usb_endpoint_descriptor_t[flags[usb_endpoint_addresses, int8], const[USB_ENDPOINT_BULK_ATTR, int8], void]
1539+ bulk_out usb_endpoint_descriptor_t[flags[usb_endpoint_addresses, int8], const[USB_ENDPOINT_BULK_ATTR, int8], void]
1540+ status usb_endpoint_descriptor_t[flags[usb_endpoint_addresses, int8], const[USB_ENDPOINT_INT_ATTR, int8], void]
1541+ } [packed]
1542+
1543+ vusb_descriptors_sierra_net {
1544+ len len[parent, int32]
1545+ generic ptr[in, vusb_descriptor_generic]
1546+
1547+ USB_DT_STRING ptr[in, vusb_descriptor_t[USB_TYPE_STANDARD, USB_DT_STRING, usb_string_descriptor]]
1548+ } [packed]
1549+
1550+ vusb_responses_sierra_net {
1551+ len len[parent, int32]
1552+ generic ptr[in, vusb_response_generic]
1553+
1554+ USB_CDC_GET_ENCAPSULATED_RESPONSE ptr[in, vusb_response_t[SIERRA_CMD_TYPE_IN, USB_CDC_GET_ENCAPSULATED_RESPONSE, array[int8, 1024]]]
1555+ USB_CDC_SEND_ENCAPSULATED_COMMANDT ptr[in, vusb_response_t[SIERRA_CMD_TYPE_OUT, USB_CDC_SEND_ENCAPSULATED_COMMAND, array[int8, 0:4]]]
1556+ } [packed]
1557+
1558+ define SIERRA_CMD_TYPE_IN (USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE)
1559+ define SIERRA_CMD_TYPE_OUT (USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE)
1560+
1561+ # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
1562+
1563+ # lan78xx driver specific descriptions.
1564+ # While these syz_* variants noticably help with the probe() process, they are not enough.
1565+ # This is due to a high number of control requests expected between the driver and the device.
1566+
1567+ include <drivers/net/usb/smsc95xx.h>
1568+
1569+ resource fd_usb_lan78xx[fd_usb]
1570+
1571+ syz_usb_connect$lan78xx(speed flags[usb_device_speed], dev_len len[dev], dev ptr[in, usb_device_descriptor_lan78xx], conn_descs const[0]) fd_usb_lan78xx (timeout[3000], prog_timeout[3000], remote_cover)
1572+ syz_usb_control_io$lan78xx(fd fd_usb_lan78xx, descs ptr[in, vusb_descriptors_lan78xx], resps ptr[in, vusb_responses_lan78xx]) (timeout[300], remote_cover)
1573+
1574+ usb_device_descriptor_lan78xx {
1575+ inner usb_device_descriptor_fixed_t[0x200, USB_CLASS_VENDOR_SPEC, USB_SUBCLASS_VENDOR_SPEC, 0xff, 64, 0x424, 0x7850, 0, array[usb_config_descriptor_lan78xx, 1]]
1576+ } [packed]
1577+
1578+ usb_config_descriptor_lan78xx {
1579+ inner usb_config_descriptor_fixed_t[1, 1, USB_CONFIG_ATT_ONE, 250, usb_interface_descriptor_lan78xx]
1580+ } [packed]
1581+
1582+ usb_interface_descriptor_lan78xx {
1583+ iface usb_interface_descriptor_fixed_t[0, 0, 3, USB_CLASS_VENDOR_SPEC, 0, 0, void, usb_endpoint_descriptors_lan78xx]
1584+ } [packed]
1585+
1586+ usb_endpoint_descriptors_lan78xx {
1587+ bulk_in usb_endpoint_descriptor_fixed_t[USB_FIXED_ENDPOINT_BULK_IN_ADDR, USB_ENDPOINT_BULK_ATTR, 512, 0, void]
1588+ bulk_out usb_endpoint_descriptor_fixed_t[USB_FIXED_ENDPOINT_BULK_OUT_ADDR, USB_ENDPOINT_BULK_ATTR, 512, 0, void]
1589+ int_in usb_endpoint_descriptor_fixed_t[USB_FIXED_ENDPOINT_INT_IN_ADDR, USB_ENDPOINT_INT_ATTR, 64, 1, void]
1590+ } [packed]
1591+
1592+ vusb_descriptors_lan78xx {
1593+ len len[parent, int32]
1594+ generic ptr[in, vusb_descriptor_generic]
1595+
1596+ USB_DT_STRING ptr[in, vusb_descriptor_t[USB_TYPE_STANDARD, USB_DT_STRING, usb_string_descriptor]]
1597+ } [packed]
1598+
1599+ vusb_responses_lan78xx {
1600+ len len[parent, int32]
1601+ generic ptr[in, vusb_response_generic]
1602+
1603+ USB_REQ_GET_INTERFACE ptr[in, vusb_response_t[USB_TYPE_STANDARD, USB_REQ_GET_INTERFACE, int8]]
1604+ USB_REQ_GET_CONFIGURATION ptr[in, vusb_response_t[USB_TYPE_STANDARD, USB_REQ_GET_CONFIGURATION, int8]]
1605+
1606+ USB_VENDOR_REQUEST_READ_REGISTER ptr[in, vusb_response_t[LAN78XX_REG_TYPE_IN, USB_VENDOR_REQUEST_READ_REGISTER, int32]]
1607+ USB_VENDOR_REQUEST_WRITE_REGISTER ptr[in, vusb_response_t[LAN78XX_REG_TYPE_OUT, USB_VENDOR_REQUEST_WRITE_REGISTER, int32]]
1608+ USB_VENDOR_REQUEST_GET_STATS ptr[in, vusb_response_t[LAN78XX_REG_TYPE_IN, USB_VENDOR_REQUEST_GET_STATS, array[int8, 47]]]
1609+ } [packed]
1610+
1611+ define LAN78XX_REG_TYPE_IN (USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE)
1612+ define LAN78XX_REG_TYPE_OUT (USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE)
0 commit comments