Skip to content

Conversation

@fellair
Copy link
Contributor

@fellair fellair commented Jun 19, 2025

BSG is a block layer version of SG driver with its own devices, which can be found in /dev/bsg/*. Currently, syzkaller barely touches related code in block/ and drivers/scsi/ source directories, so update the descriptions to nudge the fuzzer in the right direction.

Specifically,

  • create a separate description file dev_bsg.txt;
  • move openat$bsg from sys.txt and fix the way devices in question are accessed;
  • describe necessary syscalls and structs, most importantly, sg_io_v4.
  • add a few TODOs to address later.

P.S. No descriptions were removed, only expanded. Coverage is slightly improved compared to syzbot one in block/bsg.c and drivers/scsi/scsi_bsg.c among some others.
P.P.S. I plan to fix TODOs at a later date in a separate PR, once I understand more about SCSI and BSG.

pad const[0, int32]
}

# TODO: Format for bsg devices' names: "/dev/bsg/a:b:c:d". Figure out if a more sensible option exists
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Depends on whether these need to already exist (in which case it's better to hard-code them here) or they can be arbitrary. If they can be arbitrary, something like this could be an option:

smack_ipv6 {
d1 fmt[hex, int8]
sp1 const[':', int8]
d2 fmt[hex, int8]
sp2 const[':', int8]
d3 fmt[hex, int8]
sp3 const[':', int8]
d4 fmt[hex, int8]
sp4 const[':', int8]
d5 fmt[hex, int8]
sp5 const[':', int8]
d6 fmt[hex, int8]
sp6 const[':', int8]
d7 fmt[hex, int8]
sp7 const[':', int8]
d8 fmt[hex, int8]
} [packed]

But AFAIK syzkaller could be validating open inputs, so it may require the path to be an explicit string rather than a struct.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Provided necessary config options are enabled (and they are in according syzbot instances), necessary devices are created automatically. The names described in .txt file seem to be consistent enough that I opted to hard-code them. I am looking into ways to spawn more of them (via config options and similar to null_blk) but this solution is stable enough.

Technically, they could be of a:b:c:d format, so it makes sense to look into other options, like the one you suggested. For now though it may fine, till I come up with a more elegant solution.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For now a list of string consts is definitely OK.

BSG is a block layer version of SG driver with its own devices,
which can be found in /dev/bsg/*. Currently, syzkaller barely touches
related code in block/ and drivers/scsi/ source directories,
so update the descriptions to nudge the fuzzer in the right direction.

Specifically,
- create a separate description file dev_bsg.txt;
- move openat$bsg from sys.txt and fix the way devices
  in question are accessed;
- describe necessary syscalls and structs, most importantly, sg_io_v4.
- add a few TODOs to address later.

A few words about flaws in sq_io_v4 description:
Some fields were left more ambigious than desired. Once more research
into the way bsg operates is done, as well as related coverage is
gathered, those flaws will be corrected.
Copy link
Collaborator

@a-nogikh a-nogikh left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks!

@a-nogikh a-nogikh enabled auto-merge June 23, 2025 20:21
@a-nogikh a-nogikh added this pull request to the merge queue Jun 23, 2025
Merged via the queue into google:master with commit e2f27c3 Jun 23, 2025
17 checks passed
@fellair fellair deleted the fellair_dev_bsg branch July 1, 2025 21:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants