ok github.com/google/syzkaller/dashboard/app 0.228s
? github.com/google/syzkaller/dashboard/dashapi [no test files]
? github.com/google/syzkaller/executor [no test files]
ok github.com/google/syzkaller/pkg/ast 1.852s
ok github.com/google/syzkaller/pkg/bisect 11.808s
ok github.com/google/syzkaller/pkg/build 6.331s
? github.com/google/syzkaller/pkg/cmdprof [no test files]
ok github.com/google/syzkaller/pkg/compiler 4.096s
ok github.com/google/syzkaller/pkg/config (cached)
? github.com/google/syzkaller/pkg/cover [no test files]
--- FAIL: TestGenerate (1.67s)
--- FAIL: TestGenerate/netbsd/amd64 (0.09s)
csource_test.go:67: seed=1590025326657750258
--- FAIL: TestGenerate/netbsd/amd64/0 (0.76s)
csource_test.go:123: opts: {Threaded:false Collide:false Repeat:true RepeatTimes:0 Procs:0 Sandbox:none Fault:false FaultCall:0 FaultNth:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false USB:false UseTmpDir:true HandleSegv:false Repro:false Trace:false}
program:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
writev(r0, &(0x7f00000002c0)=[{&(0x7f0000000000)="25c5f6768692f16a6b02337bc5f24e95c2e574f7bd23da78ff2241439caced122e33ab16d377843415781fa508cd635f2fd04113204ed9bda7396e99a38a2f10e9c7398b5a64c49d98664bd14975be7076a83638a7da3095f0e027bd161ccd5c994f8b31d535a3ce4c57812d9682f3ebb10e05a7142210515b668d1357d91aaabb6ad88aed6b9f2143d062e0b5", 0x8d}, {&(0x7f00000000c0)="e8987e8f864e9d38b55615b659d14cae9e91a9532213ffb465b61b", 0x1b}, {&(0x7f0000000100)="3f97992c940fba8936a6b4", 0xb}, {&(0x7f0000000140)="c99ab604eb2e44ebf7bfb7b04c084321a30f4351aeb0676bb21aefc3bc2322d99a5b034f880aa25d61ae4076397c30357b22ccb779ebd3206ac648fab90836dd4d9e73dc3c077270b57dc3222284dd3cae4737957d947d765a5e0e919cbd3ef2d3d9522a827f3fe60ddc", 0x6a}, {&(0x7f00000001c0)="2bc5a9fd6cc3450082405ab607a0f5627b40589a690ac59158acf10f2a1cc46152fa5f493a8599cc6eaab5d96968bef1a27f62dacf64d06c80cfb5b320b977c9432c446fa6f6551444ee4c5998853260d65d2cb3c778f44fe270363b4eb309e24fc47797b5bd454bf4d3d4656fa078ff56b30f4f0e9d5e6e8943830ad6d342968c224f7c35af01a61d10e155fee7e0227cd79a7977b3f40351ca01834840abba557d36bc8a4208f90dc5f51e3f3d445c5feea79368164edef05d24748ce9f0a58451b43d9891902bc45ec67d00df1deb74e65b29c0d095dbdd5b9a7c", 0xdc}], 0x5)
getgroups(0x3, &(0x7f0000000340)=[0x0, 0xffffffffffffffff, <r1=>0x0])
getsockopt$sock_cred(0xffffffffffffffff, 0xffff, 0x11, &(0x7f0000000380)={0x0, 0x0, <r2=>0x0}, &(0x7f00000003c0)=0xc)
setregid(r1, r2)
r3 = semget(0x1, 0x0, 0xb2603d964b180ce8)
stat(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, <r4=>0x0})
r5 = getgid()
semctl$IPC_SET(r3, 0x0, 0x1, &(0x7f0000000500)={{0xfffff834, r4, r5, 0xffffffffffffffff, 0x0, 0x3, 0x9}, 0xfffffffffffffffd, 0x4535, 0x2})
seteuid(0x0)
syz_emit_ethernet(0x88, &(0x7f0000000000)="bf5bc2c4ddcd9baa7f7c66f91726a8c490f69185140b5b4251e86701c6c5a60d84802d382a0c38df4a28fd840d7e1406a5c2eb5d3b6bc323bd49386c4a924950314fe617f8cd3437a4aa6d1c6d62640309f9de2393999b114768d510d734fd72d198b261bd618114bf3fa3e2fe84ffe65c80e47212c49e47bb3aaa8689462f21d51880d97cb445d3")
syz_execute_func(&(0x7f00000000c0)="c4a184582caa26440fae04c4410f74ab00000100c423f5784ce99d4044df345926410fae4101646466440fe5b94e9ab0c4c4227d470f410f457f56660fdde8")
syz_extract_tcp_res(&(0x7f0000000100), 0x6, 0x1)
syz_usb_connect(0x0, 0xc9, &(0x7f0000000140)="64d32f16ebd817d004dcb801718205bca1d86dad3cb132a286609214b7395a97a0e8feda5fad02cce9deea94d55a750c17b234075002b9df629fa68e3f7da97e9c2a2e0a95d15d359561b1477440342cd79c7cebd6bf008acd1c7ff146a6fe22013661d8c8ce8eb17f5cf3892ae08bba46545b2b690ab7e0368aec4d32b76d7fc15dd7c2aba184d41a5e5abb8d716f5e645e1767138ed738f315795ac99e22fd44db06096313f4729ce0d3bd938f5b6520ef9376fa909df6b205c2d3f52ee43e3f59ea441b7c4e4d5c", &(0x7f0000000240)="c1b01d40739935b1217d0e393cdd4fa4ef8bbd9957ee996877e4ca155c195dc166f9486ac4db17f754c48938a43419f082a8c30effbef064f6c8b87bc930e439c719ec0a1199040b86286d271f25af26ebed3f55c32e68ac70330df76931bf55fae880256b74a923f8a3022c310f94cc0c623302a5d14b3f8e18f41599882866ea0242864b37d5ae87fbcb745c3e26423d05c5483833dfcdd43dc0c6507329037273de282e3a16ac00c5539c309463984b153ec6250a781975a277017280db1e9c18ce664df5947c6c18bef2367e6163b46b9503f700705fd0e89eae6df0884bf27c00e05fc5efc64907")
r6 = syz_usb_connect(0x4, 0xbf, &(0x7f0000000340)="364fb1a417263de22797ec760861f3852cf24f79e2b7a5c62afad7d6d4d09d862f8eccd02e1bb989e0f8a8ad915442016404c9826a5c0a284fc7a840304759b684f357b2e6fecfb3cc8157c008ff0dcff2108984548a2ad695fad9512f06fd12d66bc443047512ab4ef3058ae6c0c6ec3fd627e370a151ae719b8e3a77d682dc06a93be9c2aa8018b58a9492cb39031bb5abf3124eaab85330f181fccca7597b4ec0879fcbcf51143f98c443c16720a6e01b7e07df4727e288e13dcc0b7e11", &(0x7f0000000400)="5903923c7a1b2838f3c12156785a11c81b2e82d9a1190e1b9c45976a917c00294dc94d5354e8c5d6a4e8986da074eb461ed0736bcbede2cef1f19e0216c09eb794d8b9754fea26f110c83248c286eaa05a69844eb1292f594f59f6c9beca47d894d44dfd15ff81b76b4635392eb5ed431ca3092230")
syz_usb_disconnect(r6)
csource_test.go:124: failed to build program:
// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <dev/usb/usb.h>
#include <dev/usb/usbhid.h>
#include <dev/usb/vhci.h>
#include <dirent.h>
#include <endian.h>
#include <fcntl.h>
#include <pwd.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ioctl.h>
#include <sys/resource.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>
static unsigned long long procid;
static void kill_and_wait(int pid, int* status)
{
kill(pid, SIGKILL);
while (waitpid(-1, status, 0) != pid) {
}
}
static void sleep_ms(uint64_t ms)
{
usleep(ms * 1000);
}
static uint64_t current_time_ms(void)
{
struct timespec ts;
if (clock_gettime(CLOCK_MONOTONIC, &ts))
exit(1);
return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}
static void use_temporary_dir(void)
{
char tmpdir_template[] = "./syzkaller.XXXXXX";
char* tmpdir = mkdtemp(tmpdir_template);
if (!tmpdir)
exit(1);
if (chmod(tmpdir, 0777))
exit(1);
if (chdir(tmpdir))
exit(1);
}
static void remove_dir(const char* dir)
{
DIR* dp;
struct dirent* ep;
dp = opendir(dir);
if (dp == NULL)
exit(1);
while ((ep = readdir(dp))) {
if (strcmp(ep->d_name, ".") == 0 || strcmp(ep->d_name, "..") == 0)
continue;
char filename[FILENAME_MAX];
snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name);
struct stat st;
if (lstat(filename, &st))
exit(1);
if (S_ISDIR(st.st_mode)) {
remove_dir(filename);
continue;
}
if (unlink(filename))
exit(1);
}
closedir(dp);
if (rmdir(dir))
exit(1);
}
/* -------------------------------------------------------------------------- */
/*
* Redefinitions to match the linux types used in common_usb.h.
*/
struct usb_endpoint_descriptor {
uint8_t_t bLength;
uint8_t_t bDescriptorType;
uint8_t_t bEndpointAddress;
uint8_t_t bmAttributes;
uint16_t_t wMaxPacketSize;
uint8_t_t bInterval;
uint8_t_t bRefresh;
uint8_t_t bSynchAddress;
} __attribute__((packed));
struct usb_device_descriptor {
uint8_t_t bLength;
uint8_t_t bDescriptorType;
uint16_t_t bcdUSB;
uint8_t_t bDeviceClass;
uint8_t_t bDeviceSubClass;
uint8_t_t bDeviceProtocol;
uint8_t_t bMaxPacketSize0;
uint16_t_t idVendor;
uint16_t_t idProduct;
uint16_t_t bcdDevice;
uint8_t_t iManufacturer;
uint8_t_t iProduct;
uint8_t_t iSerialNumber;
uint8_t_t bNumConfigurations;
} __attribute__((packed));
struct usb_config_descriptor {
uint8_t_t bLength;
uint8_t_t bDescriptorType;
uint16_t_t wTotalLength;
uint8_t_t bNumInterfaces;
uint8_t_t bConfigurationValue;
uint8_t_t iConfiguration;
uint8_t_t bmAttributes;
uint8_t_t bMaxPower;
} __attribute__((packed));
struct usb_interface_descriptor {
uint8_t_t bLength;
uint8_t_t bDescriptorType;
uint8_t_t bInterfaceNumber;
uint8_t_t bAlternateSetting;
uint8_t_t bNumEndpoints;
uint8_t_t bInterfaceClass;
uint8_t_t bInterfaceSubClass;
uint8_t_t bInterfaceProtocol;
uint8_t_t iInterface;
} __attribute__((packed));
struct usb_ctrlrequest {
uint8_t_t bRequestType;
uint8_t_t bRequest;
uint16_t_t wValue;
uint16_t_t wIndex;
uint16_t_t wLength;
} __attribute__((packed));
struct usb_qualifier_descriptor {
uint8_t_t bLength;
uint8_t_t bDescriptorType;
uint16_t_t bcdUSB;
uint8_t_t bDeviceClass;
uint8_t_t bDeviceSubClass;
uint8_t_t bDeviceProtocol;
uint8_t_t bMaxPacketSize0;
uint8_t_t bNumConfigurations;
uint8_t_t bRESERVED;
} __attribute__((packed));
#define USB_TYPE_MASK (0x03 << 5)
#define USB_TYPE_STANDARD (0x00 << 5)
#define USB_TYPE_CLASS (0x01 << 5)
#define USB_TYPE_VENDOR (0x02 << 5)
#define USB_TYPE_RESERVED (0x03 << 5)
#define USB_DT_DEVICE 0x01
#define USB_DT_CONFIG 0x02
#define USB_DT_STRING 0x03
#define USB_DT_INTERFACE 0x04
#define USB_DT_ENDPOINT 0x05
#define USB_DT_DEVICE_QUALIFIER 0x06
#define USB_DT_OTHER_SPEED_CONFIG 0x07
#define USB_DT_INTERFACE_POWER 0x08
#define USB_DT_OTG 0x09
#define USB_DT_DEBUG 0x0a
#define USB_DT_INTERFACE_ASSOCIATION 0x0b
#define USB_DT_SECURITY 0x0c
#define USB_DT_KEY 0x0d
#define USB_DT_ENCRYPTION_TYPE 0x0e
#define USB_DT_BOS 0x0f
#define USB_DT_DEVICE_CAPABILITY 0x10
#define USB_DT_WIRELESS_ENDPOINT_COMP 0x11
#define USB_DT_WIRE_ADAPTER 0x21
#define USB_DT_RPIPE 0x22
#define USB_DT_CS_RADIO_CONTROL 0x23
#define USB_DT_PIPE_USAGE 0x24
#define USB_DT_SS_ENDPOINT_COMP 0x30
#define USB_DT_SSP_ISOC_ENDPOINT_COMP 0x31
#define USB_REQ_GET_STATUS 0x00
#define USB_REQ_CLEAR_FEATURE 0x01
#define USB_REQ_SET_FEATURE 0x03
#define USB_REQ_SET_ADDRESS 0x05
#define USB_REQ_GET_DESCRIPTOR 0x06
#define USB_REQ_SET_DESCRIPTOR 0x07
#define USB_REQ_GET_CONFIGURATION 0x08
#define USB_REQ_SET_CONFIGURATION 0x09
#define USB_REQ_GET_INTERFACE 0x0A
#define USB_REQ_SET_INTERFACE 0x0B
#define USB_REQ_SYNCH_FRAME 0x0C
#define USB_REQ_SET_SEL 0x30
#define USB_REQ_SET_ISOCH_DELAY 0x31
#define USB_REQ_SET_ENCRYPTION 0x0D
#define USB_REQ_GET_ENCRYPTION 0x0E
#define USB_REQ_RPIPE_ABORT 0x0E
#define USB_REQ_SET_HANDSHAKE 0x0F
#define USB_REQ_RPIPE_RESET 0x0F
#define USB_REQ_GET_HANDSHAKE 0x10
#define USB_REQ_SET_CONNECTION 0x11
#define USB_REQ_SET_SECURITY_DATA 0x12
#define USB_REQ_GET_SECURITY_DATA 0x13
#define USB_REQ_SET_WUSB_DATA 0x14
#define USB_REQ_LOOPBACK_DATA_WRITE 0x15
#define USB_REQ_LOOPBACK_DATA_READ 0x16
#define USB_REQ_SET_INTERFACE_DS 0x17
#define USB_REQ_GET_PARTNER_PDO 20
#define USB_REQ_GET_BATTERY_STATUS 21
#define USB_REQ_SET_PDO 22
#define USB_REQ_GET_VDM 23
#define USB_REQ_SEND_VDM 24
#define USB_MAX_IFACE_NUM 4
#define USB_MAX_EP_NUM 32
#define USB_MAX_FDS 6
struct usb_endpoint_index {
struct usb_endpoint_descriptor desc;
int handle;
};
struct usb_iface_index {
struct usb_interface_descriptor* iface;
uint8_t bInterfaceNumber;
uint8_t bAlternateSetting;
uint8_t bInterfaceClass;
struct usb_endpoint_index eps[USB_MAX_EP_NUM];
int eps_num;
};
struct usb_device_index {
struct usb_device_descriptor* dev;
struct usb_config_descriptor* config;
uint8_t bDeviceClass;
uint8_t bMaxPower;
int config_length;
struct usb_iface_index ifaces[USB_MAX_IFACE_NUM];
int ifaces_num;
int iface_cur;
};
struct usb_info {
int fd;
struct usb_device_index index;
};
static struct usb_info usb_devices[USB_MAX_FDS];
static int usb_devices_num;
static bool parse_usb_descriptor(const char* buffer, size_t length, struct usb_device_index* index)
{
if (length < sizeof(*index->dev) + sizeof(*index->config))
return false;
memset(index, 0, sizeof(*index));
index->dev = (struct usb_device_descriptor*)buffer;
index->config = (struct usb_config_descriptor*)(buffer + sizeof(*index->dev));
index->bDeviceClass = index->dev->bDeviceClass;
index->bMaxPower = index->config->bMaxPower;
index->config_length = length - sizeof(*index->dev);
index->iface_cur = -1;
size_t offset = 0;
while (true) {
if (offset + 1 >= length)
break;
uint8_t desc_length = buffer[offset];
uint8_t desc_type = buffer[offset + 1];
if (desc_length <= 2)
break;
if (offset + desc_length > length)
break;
if (desc_type == USB_DT_INTERFACE && index->ifaces_num < USB_MAX_IFACE_NUM) {
struct usb_interface_descriptor* iface = (struct usb_interface_descriptor*)(buffer + offset);
index->ifaces[index->ifaces_num].iface = iface;
index->ifaces[index->ifaces_num].bInterfaceNumber = iface->bInterfaceNumber;
index->ifaces[index->ifaces_num].bAlternateSetting = iface->bAlternateSetting;
index->ifaces[index->ifaces_num].bInterfaceClass = iface->bInterfaceClass;
index->ifaces_num++;
}
if (desc_type == USB_DT_ENDPOINT && index->ifaces_num > 0) {
struct usb_iface_index* iface = &index->ifaces[index->ifaces_num - 1];
if (iface->eps_num < USB_MAX_EP_NUM) {
memcpy(&iface->eps[iface->eps_num].desc, buffer + offset, sizeof(iface->eps[iface->eps_num].desc));
iface->eps_num++;
}
}
offset += desc_length;
}
return true;
}
static struct usb_device_index* add_usb_index(int fd, const char* dev, size_t dev_len)
{
int i = __atomic_fetch_add(&usb_devices_num, 1, __ATOMIC_RELAXED);
if (i >= USB_MAX_FDS)
return NULL;
int rv = 0;
rv = parse_usb_descriptor(dev, dev_len, &usb_devices[i].index);
if (!rv)
return NULL;
__atomic_store_n(&usb_devices[i].fd, fd, __ATOMIC_RELEASE);
return &usb_devices[i].index;
}
static struct usb_device_index* lookup_usb_index(int fd)
{
int i;
for (i = 0; i < USB_MAX_FDS; i++) {
if (__atomic_load_n(&usb_devices[i].fd, __ATOMIC_ACQUIRE) == fd) {
return &usb_devices[i].index;
}
}
return NULL;
}
struct vusb_connect_string_descriptor {
uint32_t len;
char* str;
} __attribute__((packed));
struct vusb_connect_descriptors {
uint32_t qual_len;
char* qual;
uint32_t bos_len;
char* bos;
uint32_t strs_len;
struct vusb_connect_string_descriptor strs[0];
} __attribute__((packed));
static const char default_string[] = {
8, USB_DT_STRING,
's', 0, 'y', 0, 'z', 0
};
static const char default_lang_id[] = {
4, USB_DT_STRING,
0x09, 0x04
};
static bool lookup_connect_response_in(int fd, const struct vusb_connect_descriptors* descs,
const struct usb_ctrlrequest* ctrl,
char** response_data, uint32_t* response_length)
{
struct usb_device_index* index = lookup_usb_index(fd);
uint8_t str_idx;
if (!index)
return false;
switch (ctrl->bRequestType & USB_TYPE_MASK) {
case USB_TYPE_STANDARD:
switch (ctrl->bRequest) {
case USB_REQ_GET_DESCRIPTOR:
switch (ctrl->wValue >> 8) {
case USB_DT_DEVICE:
*response_data = (char*)index->dev;
*response_length = sizeof(*index->dev);
return true;
case USB_DT_CONFIG:
*response_data = (char*)index->config;
*response_length = index->config_length;
return true;
case USB_DT_STRING:
str_idx = (uint8_t)ctrl->wValue;
if (descs && str_idx < descs->strs_len) {
*response_data = descs->strs[str_idx].str;
*response_length = descs->strs[str_idx].len;
return true;
}
if (str_idx == 0) {
*response_data = (char*)&default_lang_id[0];
*response_length = default_lang_id[0];
return true;
}
*response_data = (char*)&default_string[0];
*response_length = default_string[0];
return true;
case USB_DT_BOS:
*response_data = descs->bos;
*response_length = descs->bos_len;
return true;
case USB_DT_DEVICE_QUALIFIER:
if (!descs->qual) {
struct usb_qualifier_descriptor* qual =
(struct usb_qualifier_descriptor*)response_data;
qual->bLength = sizeof(*qual);
qual->bDescriptorType = USB_DT_DEVICE_QUALIFIER;
qual->bcdUSB = index->dev->bcdUSB;
qual->bDeviceClass = index->dev->bDeviceClass;
qual->bDeviceSubClass = index->dev->bDeviceSubClass;
qual->bDeviceProtocol = index->dev->bDeviceProtocol;
qual->bMaxPacketSize0 = index->dev->bMaxPacketSize0;
qual->bNumConfigurations = index->dev->bNumConfigurations;
qual->bRESERVED = 0;
*response_length = sizeof(*qual);
return true;
}
*response_data = descs->qual;
*response_length = descs->qual_len;
return true;
default:
break;
}
break;
default:
break;
}
break;
default:
break;
}
return false;
}
typedef bool (*lookup_connect_out_response_t)(int fd, const struct vusb_connect_descriptors* descs,
const struct usb_ctrlrequest* ctrl, bool* done);
static bool lookup_connect_response_out_generic(int fd, const struct vusb_connect_descriptors* descs,
const struct usb_ctrlrequest* ctrl, bool* done)
{
switch (ctrl->bRequestType & USB_TYPE_MASK) {
case USB_TYPE_STANDARD:
switch (ctrl->bRequest) {
case USB_REQ_SET_CONFIGURATION:
*done = true;
return true;
default:
break;
}
break;
}
return false;
}
/* -------------------------------------------------------------------------- */
static int vhci_open(void)
{
return open("/dev/vhci", O_RDWR);
}
static int vhci_setport(int fd, u_int port)
{
struct vhci_ioc_set_port args;
args.port = port;
return ioctl(fd, VHCI_IOC_SET_PORT, &args);
}
static int vhci_usb_attach(int fd)
{
return ioctl(fd, VHCI_IOC_USB_ATTACH, NULL);
}
static int vhci_usb_recv(int fd, void* buf, size_t size)
{
uint8_t_t* ptr = (uint8_t_t*)buf;
ssize_t done;
while (1) {
done = read(fd, ptr, size);
if (done < 0)
return -1;
if ((size_t)done == size)
return 0;
size -= done;
ptr += done;
}
}
static int vhci_usb_send(int fd, void* buf, size_t size)
{
uint8_t_t* ptr = (uint8_t_t*)buf;
ssize_t done;
while (1) {
done = write(fd, ptr, size);
if (done <= 0)
return -1;
if ((size_t)done == size)
return 0;
size -= done;
ptr += done;
}
}
/* -------------------------------------------------------------------------- */
static volatile long syz_usb_connect_impl(uint64_t speed, uint64_t dev_len,
const char* dev, const struct vusb_connect_descriptors* descs,
lookup_connect_out_response_t lookup_connect_response_out)
{
struct usb_device_index* index;
int portnum, fd, rv;
bool done;
portnum = procid + 1;
if (!dev) {
return -1;
}
if (portnum != 1) {
/* For now, we support only one proc. */
return -1;
}
fd = vhci_open();
if (fd < 0) {
return -1;
}
index = add_usb_index(fd, dev, dev_len);
if (!index) {
goto err;
}
rv = vhci_setport(fd, portnum);
if (rv != 0) {
goto err;
}
rv = vhci_usb_attach(fd);
if (rv != 0) {
goto err;
}
done = false;
while (!done) {
vhci_request_t req;
rv = vhci_usb_recv(fd, &req, sizeof(req));
if (rv != 0) {
goto err;
}
if (req.type != VHCI_REQ_CTRL) {
goto err;
}
char* response_data = NULL;
uint32_t response_length = 0;
char data[4096];
if (req.u.ctrl.bmRequestType & UE_DIR_IN) {
bool response_found = false;
response_found = lookup_connect_response_in(fd, descs, (const usb_ctrlrequest*)&req.u.ctrl, &response_data, &response_length);
if (!response_found) {
goto err;
}
} else {
if (!lookup_connect_response_out(fd, descs, (const usb_ctrlrequest*)&req.u.ctrl, &done)) {
goto err;
}
response_data = NULL;
response_length = UGETW(req.u.ctrl.wLength);
}
if ((req.u.ctrl.bmRequestType & USB_TYPE_MASK) == USB_TYPE_STANDARD &&
req.u.ctrl.bRequest == USB_REQ_SET_CONFIGURATION) {
/* TODO: possibly revisit */
}
if (response_length > sizeof(data))
response_length = 0;
if ((uint32_t_t)UGETW(req.u.ctrl.wLength) < response_length)
response_length = UGETW(req.u.ctrl.wLength);
if (response_data)
memcpy(data, response_data, response_length);
else
memset(data, 0, response_length);
if (req.u.ctrl.bmRequestType & UE_DIR_IN) {
if (response_length > 0) {
vhci_response_t res;
res.size = response_length;
rv = vhci_usb_send(fd, &res, sizeof(res));
if (rv == 0)
rv = vhci_usb_send(fd, data, response_length);
}
} else {
rv = vhci_usb_recv(fd, data, response_length);
}
if (rv < 0) {
goto err;
}
}
sleep_ms(200);
return fd;
err:
close(fd);
return -1;
}
static volatile long syz_usb_connect(volatile long a0, volatile long a1,
volatile long a2, volatile long a3)
{
uint64_t speed = a0;
uint64_t dev_len = a1;
const char* dev = (const char*)a2;
const struct vusb_connect_descriptors* descs = (const struct vusb_connect_descriptors*)a3;
return syz_usb_connect_impl(speed, dev_len, dev, descs,
&lookup_connect_response_out_generic);
}
static volatile long syz_usb_disconnect(volatile long a0)
{
int fd = a0;
int rv = close(fd);
sleep_ms(200);
return rv;
}
static void setup_usb(void)
{
if (chmod("/dev/vhci", 0666))
exit(1);
}
static void sandbox_common()
{
if (setsid() == -1)
exit(1);
struct rlimit rlim;
rlim.rlim_cur = rlim.rlim_max = 8 << 20;
setrlimit(RLIMIT_MEMLOCK, &rlim);
rlim.rlim_cur = rlim.rlim_max = 1 << 20;
setrlimit(RLIMIT_FSIZE, &rlim);
rlim.rlim_cur = rlim.rlim_max = 1 << 20;
setrlimit(RLIMIT_STACK, &rlim);
rlim.rlim_cur = rlim.rlim_max = 0;
setrlimit(RLIMIT_CORE, &rlim);
rlim.rlim_cur = rlim.rlim_max = 256;
setrlimit(RLIMIT_NOFILE, &rlim);
}
static void loop();
static int do_sandbox_none(void)
{
sandbox_common();
loop();
return 0;
}
static long syz_execute_func(volatile long text)
{
volatile long p[8] = {0};
(void)p;
asm volatile("" ::"r"(0l), "r"(1l), "r"(2l), "r"(3l), "r"(4l), "r"(5l), "r"(6l),
"r"(7l), "r"(8l), "r"(9l), "r"(10l), "r"(11l), "r"(12l), "r"(13l));
((void (*)(void))(text))();
return 0;
}
static void execute_one(void);
#define WAIT_FLAGS 0
static void loop(void)
{
int iter;
for (iter = 0;; iter++) {
char cwdbuf[32];
sprintf(cwdbuf, "./%d", iter);
if (mkdir(cwdbuf, 0777))
exit(1);
int pid = fork();
if (pid < 0)
exit(1);
if (pid == 0) {
if (chdir(cwdbuf))
exit(1);
execute_one();
exit(0);
}
int status = 0;
uint64_t start = current_time_ms();
for (;;) {
if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
break;
sleep_ms(1);
if (current_time_ms() - start < 5 * 1000)
continue;
kill_and_wait(pid, &status);
break;
}
remove_dir(cwdbuf);
}
}
#ifndef SYS_dup2
#define SYS_dup2 90
#endif
#ifndef SYS_getgid
#define SYS_getgid 47
#endif
#ifndef SYS_getgroups
#define SYS_getgroups 79
#endif
#ifndef SYS_getsockopt
#define SYS_getsockopt 118
#endif
#ifndef SYS_mmap
#define SYS_mmap 197
#endif
#ifndef SYS_semctl
#define SYS_semctl 442
#endif
#ifndef SYS_semget
#define SYS_semget 221
#endif
#ifndef SYS_seteuid
#define SYS_seteuid 183
#endif
#ifndef SYS_setregid
#define SYS_setregid 127
#endif
#ifndef SYS_stat
#define SYS_stat 439
#endif
#ifndef SYS_writev
#define SYS_writev 121
#endif
uint64_t r[7] = {0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff};
void execute_one(void)
{
intptr_t res = 0;
res = syscall(SYS_dup2, -1, 0xffffff9c);
if (res != -1)
r[0] = res;
*(uint64_t*)0x200002c0 = 0x20000000;
memcpy((void*)0x20000000, "\x25\xc5\xf6\x76\x86\x92\xf1\x6a\x6b\x02\x33\x7b\xc5\xf2\x4e\x95\xc2\xe5\x74\xf7\xbd\x23\xda\x78\xff\x22\x41\x43\x9c\xac\xed\x12\x2e\x33\xab\x16\xd3\x77\x84\x34\x15\x78\x1f\xa5\x08\xcd\x63\x5f\x2f\xd0\x41\x13\x20\x4e\xd9\xbd\xa7\x39\x6e\x99\xa3\x8a\x2f\x10\xe9\xc7\x39\x8b\x5a\x64\xc4\x9d\x98\x66\x4b\xd1\x49\x75\xbe\x70\x76\xa8\x36\x38\xa7\xda\x30\x95\xf0\xe0\x27\xbd\x16\x1c\xcd\x5c\x99\x4f\x8b\x31\xd5\x35\xa3\xce\x4c\x57\x81\x2d\x96\x82\xf3\xeb\xb1\x0e\x05\xa7\x14\x22\x10\x51\x5b\x66\x8d\x13\x57\xd9\x1a\xaa\xbb\x6a\xd8\x8a\xed\x6b\x9f\x21\x43\xd0\x62\xe0\xb5", 141);
*(uint64_t*)0x200002c8 = 0x8d;
*(uint64_t*)0x200002d0 = 0x200000c0;
memcpy((void*)0x200000c0, "\xe8\x98\x7e\x8f\x86\x4e\x9d\x38\xb5\x56\x15\xb6\x59\xd1\x4c\xae\x9e\x91\xa9\x53\x22\x13\xff\xb4\x65\xb6\x1b", 27);
*(uint64_t*)0x200002d8 = 0x1b;
*(uint64_t*)0x200002e0 = 0x20000100;
memcpy((void*)0x20000100, "\x3f\x97\x99\x2c\x94\x0f\xba\x89\x36\xa6\xb4", 11);
*(uint64_t*)0x200002e8 = 0xb;
*(uint64_t*)0x200002f0 = 0x20000140;
memcpy((void*)0x20000140, "\xc9\x9a\xb6\x04\xeb\x2e\x44\xeb\xf7\xbf\xb7\xb0\x4c\x08\x43\x21\xa3\x0f\x43\x51\xae\xb0\x67\x6b\xb2\x1a\xef\xc3\xbc\x23\x22\xd9\x9a\x5b\x03\x4f\x88\x0a\xa2\x5d\x61\xae\x40\x76\x39\x7c\x30\x35\x7b\x22\xcc\xb7\x79\xeb\xd3\x20\x6a\xc6\x48\xfa\xb9\x08\x36\xdd\x4d\x9e\x73\xdc\x3c\x07\x72\x70\xb5\x7d\xc3\x22\x22\x84\xdd\x3c\xae\x47\x37\x95\x7d\x94\x7d\x76\x5a\x5e\x0e\x91\x9c\xbd\x3e\xf2\xd3\xd9\x52\x2a\x82\x7f\x3f\xe6\x0d\xdc", 106);
*(uint64_t*)0x200002f8 = 0x6a;
*(uint64_t*)0x20000300 = 0x200001c0;
memcpy((void*)0x200001c0, "\x2b\xc5\xa9\xfd\x6c\xc3\x45\x00\x82\x40\x5a\xb6\x07\xa0\xf5\x62\x7b\x40\x58\x9a\x69\x0a\xc5\x91\x58\xac\xf1\x0f\x2a\x1c\xc4\x61\x52\xfa\x5f\x49\x3a\x85\x99\xcc\x6e\xaa\xb5\xd9\x69\x68\xbe\xf1\xa2\x7f\x62\xda\xcf\x64\xd0\x6c\x80\xcf\xb5\xb3\x20\xb9\x77\xc9\x43\x2c\x44\x6f\xa6\xf6\x55\x14\x44\xee\x4c\x59\x98\x85\x32\x60\xd6\x5d\x2c\xb3\xc7\x78\xf4\x4f\xe2\x70\x36\x3b\x4e\xb3\x09\xe2\x4f\xc4\x77\x97\xb5\xbd\x45\x4b\xf4\xd3\xd4\x65\x6f\xa0\x78\xff\x56\xb3\x0f\x4f\x0e\x9d\x5e\x6e\x89\x43\x83\x0a\xd6\xd3\x42\x96\x8c\x22\x4f\x7c\x35\xaf\x01\xa6\x1d\x10\xe1\x55\xfe\xe7\xe0\x22\x7c\xd7\x9a\x79\x77\xb3\xf4\x03\x51\xca\x01\x83\x48\x40\xab\xba\x55\x7d\x36\xbc\x8a\x42\x08\xf9\x0d\xc5\xf5\x1e\x3f\x3d\x44\x5c\x5f\xee\xa7\x93\x68\x16\x4e\xde\xf0\x5d\x24\x74\x8c\xe9\xf0\xa5\x84\x51\xb4\x3d\x98\x91\x90\x2b\xc4\x5e\xc6\x7d\x00\xdf\x1d\xeb\x74\xe6\x5b\x29\xc0\xd0\x95\xdb\xdd\x5b\x9a\x7c", 220);
*(uint64_t*)0x20000308 = 0xdc;
syscall(SYS_writev, r[0], 0x200002c0ul, 5ul);
*(uint32_t*)0x20000340 = 0;
*(uint32_t*)0x20000344 = -1;
*(uint32_t*)0x20000348 = 0;
res = syscall(SYS_getgroups, 3ul, 0x20000340ul);
if (res != -1)
r[1] = *(uint32_t*)0x20000348;
*(uint32_t*)0x200003c0 = 0xc;
res = syscall(SYS_getsockopt, -1, 0xffff, 0x11, 0x20000380ul, 0x200003c0ul);
if (res != -1)
r[2] = *(uint32_t*)0x20000388;
syscall(SYS_setregid, r[1], r[2]);
res = syscall(SYS_semget, 0x798e2634ul, 0ul, 0xb2603d964b180ce8ul);
if (res != -1)
r[3] = res;
memcpy((void*)0x20000400, "./file0\000", 8);
res = syscall(SYS_stat, 0x20000400ul, 0x20000440ul);
if (res != -1)
r[4] = *(uint32_t*)0x2000045c;
res = syscall(SYS_getgid);
if (res != -1)
r[5] = res;
*(uint32_t*)0x20000500 = 0xfffff834;
*(uint32_t*)0x20000504 = r[4];
*(uint32_t*)0x20000508 = r[5];
*(uint32_t*)0x2000050c = -1;
*(uint32_t*)0x20000510 = 0;
*(uint32_t*)0x20000514 = 3;
*(uint16_t*)0x20000518 = 9;
*(uint16_t*)0x2000051a = 0;
*(uint64_t*)0x20000520 = 0;
*(uint64_t*)0x20000528 = 0;
*(uint64_t*)0x20000530 = 0xfffffffffffffffd;
*(uint64_t*)0x20000538 = 0x4535;
*(uint64_t*)0x20000540 = 2;
*(uint64_t*)0x20000548 = 0;
*(uint64_t*)0x20000550 = 0;
syscall(SYS_semctl, r[3], 0ul, 1ul, 0x20000500ul);
syscall(SYS_seteuid, 0);
memcpy((void*)0x20000000, "\xbf\x5b\xc2\xc4\xdd\xcd\x9b\xaa\x7f\x7c\x66\xf9\x17\x26\xa8\xc4\x90\xf6\x91\x85\x14\x0b\x5b\x42\x51\xe8\x67\x01\xc6\xc5\xa6\x0d\x84\x80\x2d\x38\x2a\x0c\x38\xdf\x4a\x28\xfd\x84\x0d\x7e\x14\x06\xa5\xc2\xeb\x5d\x3b\x6b\xc3\x23\xbd\x49\x38\x6c\x4a\x92\x49\x50\x31\x4f\xe6\x17\xf8\xcd\x34\x37\xa4\xaa\x6d\x1c\x6d\x62\x64\x03\x09\xf9\xde\x23\x93\x99\x9b\x11\x47\x68\xd5\x10\xd7\x34\xfd\x72\xd1\x98\xb2\x61\xbd\x61\x81\x14\xbf\x3f\xa3\xe2\xfe\x84\xff\xe6\x5c\x80\xe4\x72\x12\xc4\x9e\x47\xbb\x3a\xaa\x86\x89\x46\x2f\x21\xd5\x18\x80\xd9\x7c\xb4\x45\xd3", 136);
memcpy((void*)0x200000c0, "\xc4\xa1\x84\x58\x2c\xaa\x26\x44\x0f\xae\x04\xc4\x41\x0f\x74\xab\x00\x00\x01\x00\xc4\x23\xf5\x78\x4c\xe9\x9d\x40\x44\xdf\x34\x59\x26\x41\x0f\xae\x41\x01\x64\x64\x66\x44\x0f\xe5\xb9\x4e\x9a\xb0\xc4\xc4\x22\x7d\x47\x0f\x41\x0f\x45\x7f\x56\x66\x0f\xdd\xe8", 63);
syz_execute_func(0x200000c0);
memcpy((void*)0x20000140, "\x64\xd3\x2f\x16\xeb\xd8\x17\xd0\x04\xdc\xb8\x01\x71\x82\x05\xbc\xa1\xd8\x6d\xad\x3c\xb1\x32\xa2\x86\x60\x92\x14\xb7\x39\x5a\x97\xa0\xe8\xfe\xda\x5f\xad\x02\xcc\xe9\xde\xea\x94\xd5\x5a\x75\x0c\x17\xb2\x34\x07\x50\x02\xb9\xdf\x62\x9f\xa6\x8e\x3f\x7d\xa9\x7e\x9c\x2a\x2e\x0a\x95\xd1\x5d\x35\x95\x61\xb1\x47\x74\x40\x34\x2c\xd7\x9c\x7c\xeb\xd6\xbf\x00\x8a\xcd\x1c\x7f\xf1\x46\xa6\xfe\x22\x01\x36\x61\xd8\xc8\xce\x8e\xb1\x7f\x5c\xf3\x89\x2a\xe0\x8b\xba\x46\x54\x5b\x2b\x69\x0a\xb7\xe0\x36\x8a\xec\x4d\x32\xb7\x6d\x7f\xc1\x5d\xd7\xc2\xab\xa1\x84\xd4\x1a\x5e\x5a\xbb\x8d\x71\x6f\x5e\x64\x5e\x17\x67\x13\x8e\xd7\x38\xf3\x15\x79\x5a\xc9\x9e\x22\xfd\x44\xdb\x06\x09\x63\x13\xf4\x72\x9c\xe0\xd3\xbd\x93\x8f\x5b\x65\x20\xef\x93\x76\xfa\x90\x9d\xf6\xb2\x05\xc2\xd3\xf5\x2e\xe4\x3e\x3f\x59\xea\x44\x1b\x7c\x4e\x4d\x5c", 201);
memcpy((void*)0x20000240, "\xc1\xb0\x1d\x40\x73\x99\x35\xb1\x21\x7d\x0e\x39\x3c\xdd\x4f\xa4\xef\x8b\xbd\x99\x57\xee\x99\x68\x77\xe4\xca\x15\x5c\x19\x5d\xc1\x66\xf9\x48\x6a\xc4\xdb\x17\xf7\x54\xc4\x89\x38\xa4\x34\x19\xf0\x82\xa8\xc3\x0e\xff\xbe\xf0\x64\xf6\xc8\xb8\x7b\xc9\x30\xe4\x39\xc7\x19\xec\x0a\x11\x99\x04\x0b\x86\x28\x6d\x27\x1f\x25\xaf\x26\xeb\xed\x3f\x55\xc3\x2e\x68\xac\x70\x33\x0d\xf7\x69\x31\xbf\x55\xfa\xe8\x80\x25\x6b\x74\xa9\x23\xf8\xa3\x02\x2c\x31\x0f\x94\xcc\x0c\x62\x33\x02\xa5\xd1\x4b\x3f\x8e\x18\xf4\x15\x99\x88\x28\x66\xea\x02\x42\x86\x4b\x37\xd5\xae\x87\xfb\xcb\x74\x5c\x3e\x26\x42\x3d\x05\xc5\x48\x38\x33\xdf\xcd\xd4\x3d\xc0\xc6\x50\x73\x29\x03\x72\x73\xde\x28\x2e\x3a\x16\xac\x00\xc5\x53\x9c\x30\x94\x63\x98\x4b\x15\x3e\xc6\x25\x0a\x78\x19\x75\xa2\x77\x01\x72\x80\xdb\x1e\x9c\x18\xce\x66\x4d\xf5\x94\x7c\x6c\x18\xbe\xf2\x36\x7e\x61\x63\xb4\x6b\x95\x03\xf7\x00\x70\x5f\xd0\xe8\x9e\xae\x6d\xf0\x88\x4b\xf2\x7c\x00\xe0\x5f\xc5\xef\xc6\x49\x07", 234);
syz_usb_connect(0, 0xc9, 0x20000140, 0x20000240);
memcpy((void*)0x20000340, "\x36\x4f\xb1\xa4\x17\x26\x3d\xe2\x27\x97\xec\x76\x08\x61\xf3\x85\x2c\xf2\x4f\x79\xe2\xb7\xa5\xc6\x2a\xfa\xd7\xd6\xd4\xd0\x9d\x86\x2f\x8e\xcc\xd0\x2e\x1b\xb9\x89\xe0\xf8\xa8\xad\x91\x54\x42\x01\x64\x04\xc9\x82\x6a\x5c\x0a\x28\x4f\xc7\xa8\x40\x30\x47\x59\xb6\x84\xf3\x57\xb2\xe6\xfe\xcf\xb3\xcc\x81\x57\xc0\x08\xff\x0d\xcf\xf2\x10\x89\x84\x54\x8a\x2a\xd6\x95\xfa\xd9\x51\x2f\x06\xfd\x12\xd6\x6b\xc4\x43\x04\x75\x12\xab\x4e\xf3\x05\x8a\xe6\xc0\xc6\xec\x3f\xd6\x27\xe3\x70\xa1\x51\xae\x71\x9b\x8e\x3a\x77\xd6\x82\xdc\x06\xa9\x3b\xe9\xc2\xaa\x80\x18\xb5\x8a\x94\x92\xcb\x39\x03\x1b\xb5\xab\xf3\x12\x4e\xaa\xb8\x53\x30\xf1\x81\xfc\xcc\xa7\x59\x7b\x4e\xc0\x87\x9f\xcb\xcf\x51\x14\x3f\x98\xc4\x43\xc1\x67\x20\xa6\xe0\x1b\x7e\x07\xdf\x47\x27\xe2\x88\xe1\x3d\xcc\x0b\x7e\x11", 191);
memcpy((void*)0x20000400, "\x59\x03\x92\x3c\x7a\x1b\x28\x38\xf3\xc1\x21\x56\x78\x5a\x11\xc8\x1b\x2e\x82\xd9\xa1\x19\x0e\x1b\x9c\x45\x97\x6a\x91\x7c\x00\x29\x4d\xc9\x4d\x53\x54\xe8\xc5\xd6\xa4\xe8\x98\x6d\xa0\x74\xeb\x46\x1e\xd0\x73\x6b\xcb\xed\xe2\xce\xf1\xf1\x9e\x02\x16\xc0\x9e\xb7\x94\xd8\xb9\x75\x4f\xea\x26\xf1\x10\xc8\x32\x48\xc2\x86\xea\xa0\x5a\x69\x84\x4e\xb1\x29\x2f\x59\x4f\x59\xf6\xc9\xbe\xca\x47\xd8\x94\xd4\x4d\xfd\x15\xff\x81\xb7\x6b\x46\x35\x39\x2e\xb5\xed\x43\x1c\xa3\x09\x22\x30", 117);
res = syz_usb_connect(4, 0xbf, 0x20000340, 0x20000400);
if (res != -1)
r[6] = res;
syz_usb_disconnect(r[6]);
}
int main(void)
{
syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 3ul, 0x1012ul, -1, 0ul, 0ul);
use_temporary_dir();
do_sandbox_none();
return 0;
}
<stdin>:96:2: error: unknown type name 'uint8_t_t'
<stdin>:97:2: error: unknown type name 'uint8_t_t'
<stdin>:98:2: error: unknown type name 'uint8_t_t'
<stdin>:99:2: error: unknown type name 'uint8_t_t'
<stdin>:100:2: error: unknown type name 'uint16_t_t'
<stdin>:101:2: error: unknown type name 'uint8_t_t'
<stdin>:102:2: error: unknown type name 'uint8_t_t'
<stdin>:103:2: error: unknown type name 'uint8_t_t'
<stdin>:107:2: error: unknown type name 'uint8_t_t'
<stdin>:108:2: error: unknown type name 'uint8_t_t'
<stdin>:109:2: error: unknown type name 'uint16_t_t'
<stdin>:110:2: error: unknown type name 'uint8_t_t'
<stdin>:111:2: error: unknown type name 'uint8_t_t'
<stdin>:112:2: error: unknown type name 'uint8_t_t'
<stdin>:113:2: error: unknown type name 'uint8_t_t'
<stdin>:114:2: error: unknown type name 'uint16_t_t'
<stdin>:115:2: error: unknown type name 'uint16_t_t'
<stdin>:116:2: error: unknown type name 'uint16_t_t'
<stdin>:117:2: error: unknown type name 'uint8_t_t'
<stdin>:118:2: error: unknown type name 'uint8_t_t'
<stdin>:119:2: error: unknown type name 'uint8_t_t'
<stdin>:120:2: error: unknown type name 'uint8_t_t'
<stdin>:124:2: error: unknown type name 'uint8_t_t'
<stdin>:125:2: error: unknown type name 'uint8_t_t'
<stdin>:126:2: error: unknown type name 'uint16_t_t'
<stdin>:127:2: error: unknown type name 'uint8_t_t'
<stdin>:128:2: error: unknown type name 'uint8_t_t'
<stdin>:129:2: error: unknown type name 'uint8_t_t'
<stdin>:130:2: error: unknown type name 'uint8_t_t'
<stdin>:131:2: error: unknown type name 'uint8_t_t'
<stdin>:135:2: error: unknown type name 'uint8_t_t'
<stdin>:136:2: error: unknown type name 'uint8_t_t'
<stdin>:137:2: error: unknown type name 'uint8_t_t'
<stdin>:138:2: error: unknown type name 'uint8_t_t'
<stdin>:139:2: error: unknown type name 'uint8_t_t'
<stdin>:140:2: error: unknown type name 'uint8_t_t'
<stdin>:141:2: error: unknown type name 'uint8_t_t'
<stdin>:142:2: error: unknown type name 'uint8_t_t'
<stdin>:143:2: error: unknown type name 'uint8_t_t'
<stdin>:147:2: error: unknown type name 'uint8_t_t'
<stdin>:148:2: error: unknown type name 'uint8_t_t'
<stdin>:149:2: error: unknown type name 'uint16_t_t'
<stdin>:150:2: error: unknown type name 'uint16_t_t'
<stdin>:151:2: error: unknown type name 'uint16_t_t'
<stdin>:155:2: error: unknown type name 'uint8_t_t'
<stdin>:156:2: error: unknown type name 'uint8_t_t'
<stdin>:157:2: error: unknown type name 'uint16_t_t'
<stdin>:158:2: error: unknown type name 'uint8_t_t'
<stdin>:159:2: error: unknown type name 'uint8_t_t'
<stdin>:160:2: error: unknown type name 'uint8_t_t'
<stdin>:161:2: error: unknown type name 'uint8_t_t'
<stdin>:162:2: error: unknown type name 'uint8_t_t'
<stdin>:163:2: error: unknown type name 'uint8_t_t'
<stdin>: In function 'vhci_usb_recv':
<stdin>:470:2: error: unknown type name 'uint8_t_t'; did you mean 'uint8_t'?
<stdin>:470:20: error: 'uint8_t_t' undeclared (first use in this function); did you mean 'uint8_t'?
<stdin>:470:20: note: each undeclared identifier is reported only once for each function it appears in
<stdin>:470:30: error: expected expression before ')' token
<stdin>: In function 'vhci_usb_send':
<stdin>:485:2: error: unknown type name 'uint8_t_t'; did you mean 'uint8_t'?
<stdin>:485:20: error: 'uint8_t_t' undeclared (first use in this function); did you mean 'uint8_t'?
<stdin>:485:30: error: expected expression before ')' token
<stdin>: In function 'syz_usb_connect_impl':
<stdin>:546:63: error: unknown type name 'usb_ctrlrequest'
<stdin>:551:55: error: unknown type name 'usb_ctrlrequest'
<stdin>:563:8: error: 'uint32_t_t' undeclared (first use in this function); did you mean 'uint32_t'?
At top level:
<stdin>:611:13: error: 'setup_usb' defined but not used [-Werror=unused-function]
cc1: all warnings being treated as errors
compiler invocation: /syzkaller/netbsd/src/../tools/bin/x86_64--netbsd-g++ [-o /tmp/syz-executor482766479 -DGOOS_netbsd=1 -DGOARCH_amd64=1 -DHOSTGOOS_linux=1 -x c - -m64 --sysroot /syzkaller/netbsd/src/../dest/ -O2 -pthread -Wall -Werror -Wparentheses -Wframe-larger-than=16384]
--- FAIL: TestGenerate/netbsd/amd64/10 (0.76s)
csource_test.go:123: opts: {Threaded:true Collide:false Repeat:true RepeatTimes:0 Procs:0 Sandbox:none Fault:false FaultCall:0 FaultNth:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false USB:false UseTmpDir:false HandleSegv:false Repro:false Trace:false}
program:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
writev(r0, &(0x7f00000002c0)=[{&(0x7f0000000000)="25c5f6768692f16a6b02337bc5f24e95c2e574f7bd23da78ff2241439caced122e33ab16d377843415781fa508cd635f2fd04113204ed9bda7396e99a38a2f10e9c7398b5a64c49d98664bd14975be7076a83638a7da3095f0e027bd161ccd5c994f8b31d535a3ce4c57812d9682f3ebb10e05a7142210515b668d1357d91aaabb6ad88aed6b9f2143d062e0b5", 0x8d}, {&(0x7f00000000c0)="e8987e8f864e9d38b55615b659d14cae9e91a9532213ffb465b61b", 0x1b}, {&(0x7f0000000100)="3f97992c940fba8936a6b4", 0xb}, {&(0x7f0000000140)="c99ab604eb2e44ebf7bfb7b04c084321a30f4351aeb0676bb21aefc3bc2322d99a5b034f880aa25d61ae4076397c30357b22ccb779ebd3206ac648fab90836dd4d9e73dc3c077270b57dc3222284dd3cae4737957d947d765a5e0e919cbd3ef2d3d9522a827f3fe60ddc", 0x6a}, {&(0x7f00000001c0)="2bc5a9fd6cc3450082405ab607a0f5627b40589a690ac59158acf10f2a1cc46152fa5f493a8599cc6eaab5d96968bef1a27f62dacf64d06c80cfb5b320b977c9432c446fa6f6551444ee4c5998853260d65d2cb3c778f44fe270363b4eb309e24fc47797b5bd454bf4d3d4656fa078ff56b30f4f0e9d5e6e8943830ad6d342968c224f7c35af01a61d10e155fee7e0227cd79a7977b3f40351ca01834840abba557d36bc8a4208f90dc5f51e3f3d445c5feea79368164edef05d24748ce9f0a58451b43d9891902bc45ec67d00df1deb74e65b29c0d095dbdd5b9a7c", 0xdc}], 0x5)
getgroups(0x3, &(0x7f0000000340)=[0x0, 0xffffffffffffffff, <r1=>0x0])
getsockopt$sock_cred(0xffffffffffffffff, 0xffff, 0x11, &(0x7f0000000380)={0x0, 0x0, <r2=>0x0}, &(0x7f00000003c0)=0xc)
setregid(r1, r2)
r3 = semget(0x1, 0x0, 0xb2603d964b180ce8)
stat(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, <r4=>0x0})
r5 = getgid()
semctl$IPC_SET(r3, 0x0, 0x1, &(0x7f0000000500)={{0xfffff834, r4, r5, 0xffffffffffffffff, 0x0, 0x3, 0x9}, 0xfffffffffffffffd, 0x4535, 0x2})
seteuid(0x0)
syz_emit_ethernet(0x88, &(0x7f0000000000)="bf5bc2c4ddcd9baa7f7c66f91726a8c490f69185140b5b4251e86701c6c5a60d84802d382a0c38df4a28fd840d7e1406a5c2eb5d3b6bc323bd49386c4a924950314fe617f8cd3437a4aa6d1c6d62640309f9de2393999b114768d510d734fd72d198b261bd618114bf3fa3e2fe84ffe65c80e47212c49e47bb3aaa8689462f21d51880d97cb445d3")
syz_execute_func(&(0x7f00000000c0)="c4a184582caa26440fae04c4410f74ab00000100c423f5784ce99d4044df345926410fae4101646466440fe5b94e9ab0c4c4227d470f410f457f56660fdde8")
syz_extract_tcp_res(&(0x7f0000000100), 0x6, 0x1)
syz_usb_connect(0x0, 0xc9, &(0x7f0000000140)="64d32f16ebd817d004dcb801718205bca1d86dad3cb132a286609214b7395a97a0e8feda5fad02cce9deea94d55a750c17b234075002b9df629fa68e3f7da97e9c2a2e0a95d15d359561b1477440342cd79c7cebd6bf008acd1c7ff146a6fe22013661d8c8ce8eb17f5cf3892ae08bba46545b2b690ab7e0368aec4d32b76d7fc15dd7c2aba184d41a5e5abb8d716f5e645e1767138ed738f315795ac99e22fd44db06096313f4729ce0d3bd938f5b6520ef9376fa909df6b205c2d3f52ee43e3f59ea441b7c4e4d5c", &(0x7f0000000240)="c1b01d40739935b1217d0e393cdd4fa4ef8bbd9957ee996877e4ca155c195dc166f9486ac4db17f754c48938a43419f082a8c30effbef064f6c8b87bc930e439c719ec0a1199040b86286d271f25af26ebed3f55c32e68ac70330df76931bf55fae880256b74a923f8a3022c310f94cc0c623302a5d14b3f8e18f41599882866ea0242864b37d5ae87fbcb745c3e26423d05c5483833dfcdd43dc0c6507329037273de282e3a16ac00c5539c309463984b153ec6250a781975a277017280db1e9c18ce664df5947c6c18bef2367e6163b46b9503f700705fd0e89eae6df0884bf27c00e05fc5efc64907")
r6 = syz_usb_connect(0x4, 0xbf, &(0x7f0000000340)="364fb1a417263de22797ec760861f3852cf24f79e2b7a5c62afad7d6d4d09d862f8eccd02e1bb989e0f8a8ad915442016404c9826a5c0a284fc7a840304759b684f357b2e6fecfb3cc8157c008ff0dcff2108984548a2ad695fad9512f06fd12d66bc443047512ab4ef3058ae6c0c6ec3fd627e370a151ae719b8e3a77d682dc06a93be9c2aa8018b58a9492cb39031bb5abf3124eaab85330f181fccca7597b4ec0879fcbcf51143f98c443c16720a6e01b7e07df4727e288e13dcc0b7e11", &(0x7f0000000400)="5903923c7a1b2838f3c12156785a11c81b2e82d9a1190e1b9c45976a917c00294dc94d5354e8c5d6a4e8986da074eb461ed0736bcbede2cef1f19e0216c09eb794d8b9754fea26f110c83248c286eaa05a69844eb1292f594f59f6c9beca47d894d44dfd15ff81b76b4635392eb5ed431ca3092230")
syz_usb_disconnect(r6)
csource_test.go:124: failed to build program:
// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <dev/usb/usb.h>
#include <dev/usb/usbhid.h>
#include <dev/usb/vhci.h>
#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <pthread.h>
#include <pwd.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ioctl.h>
#include <sys/resource.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>
static unsigned long long procid;
static void kill_and_wait(int pid, int* status)
{
kill(pid, SIGKILL);
while (waitpid(-1, status, 0) != pid) {
}
}
static void sleep_ms(uint64_t ms)
{
usleep(ms * 1000);
}
static uint64_t current_time_ms(void)
{
struct timespec ts;
if (clock_gettime(CLOCK_MONOTONIC, &ts))
exit(1);
return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}
static void thread_start(void* (*fn)(void*), void* arg)
{
pthread_t th;
pthread_attr_t attr;
pthread_attr_init(&attr);
pthread_attr_setstacksize(&attr, 128 << 10);
int i;
for (i = 0; i < 100; i++) {
if (pthread_create(&th, &attr, fn, arg) == 0) {
pthread_attr_destroy(&attr);
return;
}
if (errno == EAGAIN) {
usleep(50);
continue;
}
break;
}
exit(1);
}
typedef struct {
pthread_mutex_t mu;
pthread_cond_t cv;
int state;
} event_t;
static void event_init(event_t* ev)
{
if (pthread_mutex_init(&ev->mu, 0))
exit(1);
if (pthread_cond_init(&ev->cv, 0))
exit(1);
ev->state = 0;
}
static void event_reset(event_t* ev)
{
ev->state = 0;
}
static void event_set(event_t* ev)
{
pthread_mutex_lock(&ev->mu);
if (ev->state)
exit(1);
ev->state = 1;
pthread_mutex_unlock(&ev->mu);
pthread_cond_broadcast(&ev->cv);
}
static void event_wait(event_t* ev)
{
pthread_mutex_lock(&ev->mu);
while (!ev->state)
pthread_cond_wait(&ev->cv, &ev->mu);
pthread_mutex_unlock(&ev->mu);
}
static int event_isset(event_t* ev)
{
pthread_mutex_lock(&ev->mu);
int res = ev->state;
pthread_mutex_unlock(&ev->mu);
return res;
}
static int event_timedwait(event_t* ev, uint64_t timeout)
{
uint64_t start = current_time_ms();
uint64_t now = start;
pthread_mutex_lock(&ev->mu);
for (;;) {
if (ev->state)
break;
uint64_t remain = timeout - (now - start);
struct timespec ts;
ts.tv_sec = remain / 1000;
ts.tv_nsec = (remain % 1000) * 1000 * 1000;
pthread_cond_timedwait(&ev->cv, &ev->mu, &ts);
now = current_time_ms();
if (now - start > timeout)
break;
}
int res = ev->state;
pthread_mutex_unlock(&ev->mu);
return res;
}
/* -------------------------------------------------------------------------- */
/*
* Redefinitions to match the linux types used in common_usb.h.
*/
struct usb_endpoint_descriptor {
uint8_t_t bLength;
uint8_t_t bDescriptorType;
uint8_t_t bEndpointAddress;
uint8_t_t bmAttributes;
uint16_t_t wMaxPacketSize;
uint8_t_t bInterval;
uint8_t_t bRefresh;
uint8_t_t bSynchAddress;
} __attribute__((packed));
struct usb_device_descriptor {
uint8_t_t bLength;
uint8_t_t bDescriptorType;
uint16_t_t bcdUSB;
uint8_t_t bDeviceClass;
uint8_t_t bDeviceSubClass;
uint8_t_t bDeviceProtocol;
uint8_t_t bMaxPacketSize0;
uint16_t_t idVendor;
uint16_t_t idProduct;
uint16_t_t bcdDevice;
uint8_t_t iManufacturer;
uint8_t_t iProduct;
uint8_t_t iSerialNumber;
uint8_t_t bNumConfigurations;
} __attribute__((packed));
struct usb_config_descriptor {
uint8_t_t bLength;
uint8_t_t bDescriptorType;
uint16_t_t wTotalLength;
uint8_t_t bNumInterfaces;
uint8_t_t bConfigurationValue;
uint8_t_t iConfiguration;
uint8_t_t bmAttributes;
uint8_t_t bMaxPower;
} __attribute__((packed));
struct usb_interface_descriptor {
uint8_t_t bLength;
uint8_t_t bDescriptorType;
uint8_t_t bInterfaceNumber;
uint8_t_t bAlternateSetting;
uint8_t_t bNumEndpoints;
uint8_t_t bInterfaceClass;
uint8_t_t bInterfaceSubClass;
uint8_t_t bInterfaceProtocol;
uint8_t_t iInterface;
} __attribute__((packed));
struct usb_ctrlrequest {
uint8_t_t bRequestType;
uint8_t_t bRequest;
uint16_t_t wValue;
uint16_t_t wIndex;
uint16_t_t wLength;
} __attribute__((packed));
struct usb_qualifier_descriptor {
uint8_t_t bLength;
uint8_t_t bDescriptorType;
uint16_t_t bcdUSB;
uint8_t_t bDeviceClass;
uint8_t_t bDeviceSubClass;
uint8_t_t bDeviceProtocol;
uint8_t_t bMaxPacketSize0;
uint8_t_t bNumConfigurations;
uint8_t_t bRESERVED;
} __attribute__((packed));
#define USB_TYPE_MASK (0x03 << 5)
#define USB_TYPE_STANDARD (0x00 << 5)
#define USB_TYPE_CLASS (0x01 << 5)
#define USB_TYPE_VENDOR (0x02 << 5)
#define USB_TYPE_RESERVED (0x03 << 5)
#define USB_DT_DEVICE 0x01
#define USB_DT_CONFIG 0x02
#define USB_DT_STRING 0x03
#define USB_DT_INTERFACE 0x04
#define USB_DT_ENDPOINT 0x05
#define USB_DT_DEVICE_QUALIFIER 0x06
#define USB_DT_OTHER_SPEED_CONFIG 0x07
#define USB_DT_INTERFACE_POWER 0x08
#define USB_DT_OTG 0x09
#define USB_DT_DEBUG 0x0a
#define USB_DT_INTERFACE_ASSOCIATION 0x0b
#define USB_DT_SECURITY 0x0c
#define USB_DT_KEY 0x0d
#define USB_DT_ENCRYPTION_TYPE 0x0e
#define USB_DT_BOS 0x0f
#define USB_DT_DEVICE_CAPABILITY 0x10
#define USB_DT_WIRELESS_ENDPOINT_COMP 0x11
#define USB_DT_WIRE_ADAPTER 0x21
#define USB_DT_RPIPE 0x22
#define USB_DT_CS_RADIO_CONTROL 0x23
#define USB_DT_PIPE_USAGE 0x24
#define USB_DT_SS_ENDPOINT_COMP 0x30
#define USB_DT_SSP_ISOC_ENDPOINT_COMP 0x31
#define USB_REQ_GET_STATUS 0x00
#define USB_REQ_CLEAR_FEATURE 0x01
#define USB_REQ_SET_FEATURE 0x03
#define USB_REQ_SET_ADDRESS 0x05
#define USB_REQ_GET_DESCRIPTOR 0x06
#define USB_REQ_SET_DESCRIPTOR 0x07
#define USB_REQ_GET_CONFIGURATION 0x08
#define USB_REQ_SET_CONFIGURATION 0x09
#define USB_REQ_GET_INTERFACE 0x0A
#define USB_REQ_SET_INTERFACE 0x0B
#define USB_REQ_SYNCH_FRAME 0x0C
#define USB_REQ_SET_SEL 0x30
#define USB_REQ_SET_ISOCH_DELAY 0x31
#define USB_REQ_SET_ENCRYPTION 0x0D
#define USB_REQ_GET_ENCRYPTION 0x0E
#define USB_REQ_RPIPE_ABORT 0x0E
#define USB_REQ_SET_HANDSHAKE 0x0F
#define USB_REQ_RPIPE_RESET 0x0F
#define USB_REQ_GET_HANDSHAKE 0x10
#define USB_REQ_SET_CONNECTION 0x11
#define USB_REQ_SET_SECURITY_DATA 0x12
#define USB_REQ_GET_SECURITY_DATA 0x13
#define USB_REQ_SET_WUSB_DATA 0x14
#define USB_REQ_LOOPBACK_DATA_WRITE 0x15
#define USB_REQ_LOOPBACK_DATA_READ 0x16
#define USB_REQ_SET_INTERFACE_DS 0x17
#define USB_REQ_GET_PARTNER_PDO 20
#define USB_REQ_GET_BATTERY_STATUS 21
#define USB_REQ_SET_PDO 22
#define USB_REQ_GET_VDM 23
#define USB_REQ_SEND_VDM 24
#define USB_MAX_IFACE_NUM 4
#define USB_MAX_EP_NUM 32
#define USB_MAX_FDS 6
struct usb_endpoint_index {
struct usb_endpoint_descriptor desc;
int handle;
};
struct usb_iface_index {
struct usb_interface_descriptor* iface;
uint8_t bInterfaceNumber;
uint8_t bAlternateSetting;
uint8_t bInterfaceClass;
struct usb_endpoint_index eps[USB_MAX_EP_NUM];
int eps_num;
};
struct usb_device_index {
struct usb_device_descriptor* dev;
struct usb_config_descriptor* config;
uint8_t bDeviceClass;
uint8_t bMaxPower;
int config_length;
struct usb_iface_index ifaces[USB_MAX_IFACE_NUM];
int ifaces_num;
int iface_cur;
};
struct usb_info {
int fd;
struct usb_device_index index;
};
static struct usb_info usb_devices[USB_MAX_FDS];
static int usb_devices_num;
static bool parse_usb_descriptor(const char* buffer, size_t length, struct usb_device_index* index)
{
if (length < sizeof(*index->dev) + sizeof(*index->config))
return false;
memset(index, 0, sizeof(*index));
index->dev = (struct usb_device_descriptor*)buffer;
index->config = (struct usb_config_descriptor*)(buffer + sizeof(*index->dev));
index->bDeviceClass = index->dev->bDeviceClass;
index->bMaxPower = index->config->bMaxPower;
index->config_length = length - sizeof(*index->dev);
index->iface_cur = -1;
size_t offset = 0;
while (true) {
if (offset + 1 >= length)
break;
uint8_t desc_length = buffer[offset];
uint8_t desc_type = buffer[offset + 1];
if (desc_length <= 2)
break;
if (offset + desc_length > length)
break;
if (desc_type == USB_DT_INTERFACE && index->ifaces_num < USB_MAX_IFACE_NUM) {
struct usb_interface_descriptor* iface = (struct usb_interface_descriptor*)(buffer + offset);
index->ifaces[index->ifaces_num].iface = iface;
index->ifaces[index->ifaces_num].bInterfaceNumber = iface->bInterfaceNumber;
index->ifaces[index->ifaces_num].bAlternateSetting = iface->bAlternateSetting;
index->ifaces[index->ifaces_num].bInterfaceClass = iface->bInterfaceClass;
index->ifaces_num++;
}
if (desc_type == USB_DT_ENDPOINT && index->ifaces_num > 0) {
struct usb_iface_index* iface = &index->ifaces[index->ifaces_num - 1];
if (iface->eps_num < USB_MAX_EP_NUM) {
memcpy(&iface->eps[iface->eps_num].desc, buffer + offset, sizeof(iface->eps[iface->eps_num].desc));
iface->eps_num++;
}
}
offset += desc_length;
}
return true;
}
static struct usb_device_index* add_usb_index(int fd, const char* dev, size_t dev_len)
{
int i = __atomic_fetch_add(&usb_devices_num, 1, __ATOMIC_RELAXED);
if (i >= USB_MAX_FDS)
return NULL;
int rv = 0;
rv = parse_usb_descriptor(dev, dev_len, &usb_devices[i].index);
if (!rv)
return NULL;
__atomic_store_n(&usb_devices[i].fd, fd, __ATOMIC_RELEASE);
return &usb_devices[i].index;
}
static struct usb_device_index* lookup_usb_index(int fd)
{
int i;
for (i = 0; i < USB_MAX_FDS; i++) {
if (__atomic_load_n(&usb_devices[i].fd, __ATOMIC_ACQUIRE) == fd) {
return &usb_devices[i].index;
}
}
return NULL;
}
struct vusb_connect_string_descriptor {
uint32_t len;
char* str;
} __attribute__((packed));
struct vusb_connect_descriptors {
uint32_t qual_len;
char* qual;
uint32_t bos_len;
char* bos;
uint32_t strs_len;
struct vusb_connect_string_descriptor strs[0];
} __attribute__((packed));
static const char default_string[] = {
8, USB_DT_STRING,
's', 0, 'y', 0, 'z', 0
};
static const char default_lang_id[] = {
4, USB_DT_STRING,
0x09, 0x04
};
static bool lookup_connect_response_in(int fd, const struct vusb_connect_descriptors* descs,
const struct usb_ctrlrequest* ctrl,
char** response_data, uint32_t* response_length)
{
struct usb_device_index* index = lookup_usb_index(fd);
uint8_t str_idx;
if (!index)
return false;
switch (ctrl->bRequestType & USB_TYPE_MASK) {
case USB_TYPE_STANDARD:
switch (ctrl->bRequest) {
case USB_REQ_GET_DESCRIPTOR:
switch (ctrl->wValue >> 8) {
case USB_DT_DEVICE:
*response_data = (char*)index->dev;
*response_length = sizeof(*index->dev);
return true;
case USB_DT_CONFIG:
*response_data = (char*)index->config;
*response_length = index->config_length;
return true;
case USB_DT_STRING:
str_idx = (uint8_t)ctrl->wValue;
if (descs && str_idx < descs->strs_len) {
*response_data = descs->strs[str_idx].str;
*response_length = descs->strs[str_idx].len;
return true;
}
if (str_idx == 0) {
*response_data = (char*)&default_lang_id[0];
*response_length = default_lang_id[0];
return true;
}
*response_data = (char*)&default_string[0];
*response_length = default_string[0];
return true;
case USB_DT_BOS:
*response_data = descs->bos;
*response_length = descs->bos_len;
return true;
case USB_DT_DEVICE_QUALIFIER:
if (!descs->qual) {
struct usb_qualifier_descriptor* qual =
(struct usb_qualifier_descriptor*)response_data;
qual->bLength = sizeof(*qual);
qual->bDescriptorType = USB_DT_DEVICE_QUALIFIER;
qual->bcdUSB = index->dev->bcdUSB;
qual->bDeviceClass = index->dev->bDeviceClass;
qual->bDeviceSubClass = index->dev->bDeviceSubClass;
qual->bDeviceProtocol = index->dev->bDeviceProtocol;
qual->bMaxPacketSize0 = index->dev->bMaxPacketSize0;
qual->bNumConfigurations = index->dev->bNumConfigurations;
qual->bRESERVED = 0;
*response_length = sizeof(*qual);
return true;
}
*response_data = descs->qual;
*response_length = descs->qual_len;
return true;
default:
break;
}
break;
default:
break;
}
break;
default:
break;
}
return false;
}
typedef bool (*lookup_connect_out_response_t)(int fd, const struct vusb_connect_descriptors* descs,
const struct usb_ctrlrequest* ctrl, bool* done);
static bool lookup_connect_response_out_generic(int fd, const struct vusb_connect_descriptors* descs,
const struct usb_ctrlrequest* ctrl, bool* done)
{
switch (ctrl->bRequestType & USB_TYPE_MASK) {
case USB_TYPE_STANDARD:
switch (ctrl->bRequest) {
case USB_REQ_SET_CONFIGURATION:
*done = true;
return true;
default:
break;
}
break;
}
return false;
}
/* -------------------------------------------------------------------------- */
static int vhci_open(void)
{
return open("/dev/vhci", O_RDWR);
}
static int vhci_setport(int fd, u_int port)
{
struct vhci_ioc_set_port args;
args.port = port;
return ioctl(fd, VHCI_IOC_SET_PORT, &args);
}
static int vhci_usb_attach(int fd)
{
return ioctl(fd, VHCI_IOC_USB_ATTACH, NULL);
}
static int vhci_usb_recv(int fd, void* buf, size_t size)
{
uint8_t_t* ptr = (uint8_t_t*)buf;
ssize_t done;
while (1) {
done = read(fd, ptr, size);
if (done < 0)
return -1;
if ((size_t)done == size)
return 0;
size -= done;
ptr += done;
}
}
static int vhci_usb_send(int fd, void* buf, size_t size)
{
uint8_t_t* ptr = (uint8_t_t*)buf;
ssize_t done;
while (1) {
done = write(fd, ptr, size);
if (done <= 0)
return -1;
if ((size_t)done == size)
return 0;
size -= done;
ptr += done;
}
}
/* -------------------------------------------------------------------------- */
static volatile long syz_usb_connect_impl(uint64_t speed, uint64_t dev_len,
const char* dev, const struct vusb_connect_descriptors* descs,
lookup_connect_out_response_t lookup_connect_response_out)
{
struct usb_device_index* index;
int portnum, fd, rv;
bool done;
portnum = procid + 1;
if (!dev) {
return -1;
}
if (portnum != 1) {
/* For now, we support only one proc. */
return -1;
}
fd = vhci_open();
if (fd < 0) {
return -1;
}
index = add_usb_index(fd, dev, dev_len);
if (!index) {
goto err;
}
rv = vhci_setport(fd, portnum);
if (rv != 0) {
goto err;
}
rv = vhci_usb_attach(fd);
if (rv != 0) {
goto err;
}
done = false;
while (!done) {
vhci_request_t req;
rv = vhci_usb_recv(fd, &req, sizeof(req));
if (rv != 0) {
goto err;
}
if (req.type != VHCI_REQ_CTRL) {
goto err;
}
char* response_data = NULL;
uint32_t response_length = 0;
char data[4096];
if (req.u.ctrl.bmRequestType & UE_DIR_IN) {
bool response_found = false;
response_found = lookup_connect_response_in(fd, descs, (const usb_ctrlrequest*)&req.u.ctrl, &response_data, &response_length);
if (!response_found) {
goto err;
}
} else {
if (!lookup_connect_response_out(fd, descs, (const usb_ctrlrequest*)&req.u.ctrl, &done)) {
goto err;
}
response_data = NULL;
response_length = UGETW(req.u.ctrl.wLength);
}
if ((req.u.ctrl.bmRequestType & USB_TYPE_MASK) == USB_TYPE_STANDARD &&
req.u.ctrl.bRequest == USB_REQ_SET_CONFIGURATION) {
/* TODO: possibly revisit */
}
if (response_length > sizeof(data))
response_length = 0;
if ((uint32_t_t)UGETW(req.u.ctrl.wLength) < response_length)
response_length = UGETW(req.u.ctrl.wLength);
if (response_data)
memcpy(data, response_data, response_length);
else
memset(data, 0, response_length);
if (req.u.ctrl.bmRequestType & UE_DIR_IN) {
if (response_length > 0) {
vhci_response_t res;
res.size = response_length;
rv = vhci_usb_send(fd, &res, sizeof(res));
if (rv == 0)
rv = vhci_usb_send(fd, data, response_length);
}
} else {
rv = vhci_usb_recv(fd, data, response_length);
}
if (rv < 0) {
goto err;
}
}
sleep_ms(200);
return fd;
err:
close(fd);
return -1;
}
static volatile long syz_usb_connect(volatile long a0, volatile long a1,
volatile long a2, volatile long a3)
{
uint64_t speed = a0;
uint64_t dev_len = a1;
const char* dev = (const char*)a2;
const struct vusb_connect_descriptors* descs = (const struct vusb_connect_descriptors*)a3;
return syz_usb_connect_impl(speed, dev_len, dev, descs,
&lookup_connect_response_out_generic);
}
static volatile long syz_usb_disconnect(volatile long a0)
{
int fd = a0;
int rv = close(fd);
sleep_ms(200);
return rv;
}
static void setup_usb(void)
{
if (chmod("/dev/vhci", 0666))
exit(1);
}
static void sandbox_common()
{
if (setsid() == -1)
exit(1);
struct rlimit rlim;
rlim.rlim_cur = rlim.rlim_max = 8 << 20;
setrlimit(RLIMIT_MEMLOCK, &rlim);
rlim.rlim_cur = rlim.rlim_max = 1 << 20;
setrlimit(RLIMIT_FSIZE, &rlim);
rlim.rlim_cur = rlim.rlim_max = 1 << 20;
setrlimit(RLIMIT_STACK, &rlim);
rlim.rlim_cur = rlim.rlim_max = 0;
setrlimit(RLIMIT_CORE, &rlim);
rlim.rlim_cur = rlim.rlim_max = 256;
setrlimit(RLIMIT_NOFILE, &rlim);
}
static void loop();
static int do_sandbox_none(void)
{
sandbox_common();
loop();
return 0;
}
static long syz_execute_func(volatile long text)
{
volatile long p[8] = {0};
(void)p;
asm volatile("" ::"r"(0l), "r"(1l), "r"(2l), "r"(3l), "r"(4l), "r"(5l), "r"(6l),
"r"(7l), "r"(8l), "r"(9l), "r"(10l), "r"(11l), "r"(12l), "r"(13l));
((void (*)(void))(text))();
return 0;
}
struct thread_t {
int created, call;
event_t ready, done;
};
static struct thread_t threads[16];
static void execute_call(int call);
static int running;
static void* thr(void* arg)
{
struct thread_t* th = (struct thread_t*)arg;
for (;;) {
event_wait(&th->ready);
event_reset(&th->ready);
execute_call(th->call);
__atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED);
event_set(&th->done);
}
return 0;
}
static void execute_one(void)
{
int i, call, thread;
for (call = 0; call < 16; call++) {
for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0])); thread++) {
struct thread_t* th = &threads[thread];
if (!th->created) {
th->created = 1;
event_init(&th->ready);
event_init(&th->done);
event_set(&th->done);
thread_start(thr, th);
}
if (!event_isset(&th->done))
continue;
event_reset(&th->done);
th->call = call;
__atomic_fetch_add(&running, 1, __ATOMIC_RELAXED);
event_set(&th->ready);
event_timedwait(&th->done, 45 + (call == 13 ? 3000 : 0) + (call == 14 ? 3000 : 0) + (call == 15 ? 300 : 0));
break;
}
}
for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++)
sleep_ms(1);
}
static void execute_one(void);
#define WAIT_FLAGS 0
static void loop(void)
{
int iter;
for (iter = 0;; iter++) {
int pid = fork();
if (pid < 0)
exit(1);
if (pid == 0) {
execute_one();
exit(0);
}
int status = 0;
uint64_t start = current_time_ms();
for (;;) {
if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
break;
sleep_ms(1);
if (current_time_ms() - start < 5 * 1000)
continue;
kill_and_wait(pid, &status);
break;
}
}
}
#ifndef SYS_dup2
#define SYS_dup2 90
#endif
#ifndef SYS_getgid
#define SYS_getgid 47
#endif
#ifndef SYS_getgroups
#define SYS_getgroups 79
#endif
#ifndef SYS_getsockopt
#define SYS_getsockopt 118
#endif
#ifndef SYS_mmap
#define SYS_mmap 197
#endif
#ifndef SYS_semctl
#define SYS_semctl 442
#endif
#ifndef SYS_semget
#define SYS_semget 221
#endif
#ifndef SYS_seteuid
#define SYS_seteuid 183
#endif
#ifndef SYS_setregid
#define SYS_setregid 127
#endif
#ifndef SYS_stat
#define SYS_stat 439
#endif
#ifndef SYS_writev
#define SYS_writev 121
#endif
uint64_t r[7] = {0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff};
void execute_call(int call)
{
intptr_t res = 0;
switch (call) {
case 0:
res = syscall(SYS_dup2, -1, 0xffffff9c);
if (res != -1)
r[0] = res;
break;
case 1:
*(uint64_t*)0x200002c0 = 0x20000000;
memcpy((void*)0x20000000, "\x25\xc5\xf6\x76\x86\x92\xf1\x6a\x6b\x02\x33\x7b\xc5\xf2\x4e\x95\xc2\xe5\x74\xf7\xbd\x23\xda\x78\xff\x22\x41\x43\x9c\xac\xed\x12\x2e\x33\xab\x16\xd3\x77\x84\x34\x15\x78\x1f\xa5\x08\xcd\x63\x5f\x2f\xd0\x41\x13\x20\x4e\xd9\xbd\xa7\x39\x6e\x99\xa3\x8a\x2f\x10\xe9\xc7\x39\x8b\x5a\x64\xc4\x9d\x98\x66\x4b\xd1\x49\x75\xbe\x70\x76\xa8\x36\x38\xa7\xda\x30\x95\xf0\xe0\x27\xbd\x16\x1c\xcd\x5c\x99\x4f\x8b\x31\xd5\x35\xa3\xce\x4c\x57\x81\x2d\x96\x82\xf3\xeb\xb1\x0e\x05\xa7\x14\x22\x10\x51\x5b\x66\x8d\x13\x57\xd9\x1a\xaa\xbb\x6a\xd8\x8a\xed\x6b\x9f\x21\x43\xd0\x62\xe0\xb5", 141);
*(uint64_t*)0x200002c8 = 0x8d;
*(uint64_t*)0x200002d0 = 0x200000c0;
memcpy((void*)0x200000c0, "\xe8\x98\x7e\x8f\x86\x4e\x9d\x38\xb5\x56\x15\xb6\x59\xd1\x4c\xae\x9e\x91\xa9\x53\x22\x13\xff\xb4\x65\xb6\x1b", 27);
*(uint64_t*)0x200002d8 = 0x1b;
*(uint64_t*)0x200002e0 = 0x20000100;
memcpy((void*)0x20000100, "\x3f\x97\x99\x2c\x94\x0f\xba\x89\x36\xa6\xb4", 11);
*(uint64_t*)0x200002e8 = 0xb;
*(uint64_t*)0x200002f0 = 0x20000140;
memcpy((void*)0x20000140, "\xc9\x9a\xb6\x04\xeb\x2e\x44\xeb\xf7\xbf\xb7\xb0\x4c\x08\x43\x21\xa3\x0f\x43\x51\xae\xb0\x67\x6b\xb2\x1a\xef\xc3\xbc\x23\x22\xd9\x9a\x5b\x03\x4f\x88\x0a\xa2\x5d\x61\xae\x40\x76\x39\x7c\x30\x35\x7b\x22\xcc\xb7\x79\xeb\xd3\x20\x6a\xc6\x48\xfa\xb9\x08\x36\xdd\x4d\x9e\x73\xdc\x3c\x07\x72\x70\xb5\x7d\xc3\x22\x22\x84\xdd\x3c\xae\x47\x37\x95\x7d\x94\x7d\x76\x5a\x5e\x0e\x91\x9c\xbd\x3e\xf2\xd3\xd9\x52\x2a\x82\x7f\x3f\xe6\x0d\xdc", 106);
*(uint64_t*)0x200002f8 = 0x6a;
*(uint64_t*)0x20000300 = 0x200001c0;
memcpy((void*)0x200001c0, "\x2b\xc5\xa9\xfd\x6c\xc3\x45\x00\x82\x40\x5a\xb6\x07\xa0\xf5\x62\x7b\x40\x58\x9a\x69\x0a\xc5\x91\x58\xac\xf1\x0f\x2a\x1c\xc4\x61\x52\xfa\x5f\x49\x3a\x85\x99\xcc\x6e\xaa\xb5\xd9\x69\x68\xbe\xf1\xa2\x7f\x62\xda\xcf\x64\xd0\x6c\x80\xcf\xb5\xb3\x20\xb9\x77\xc9\x43\x2c\x44\x6f\xa6\xf6\x55\x14\x44\xee\x4c\x59\x98\x85\x32\x60\xd6\x5d\x2c\xb3\xc7\x78\xf4\x4f\xe2\x70\x36\x3b\x4e\xb3\x09\xe2\x4f\xc4\x77\x97\xb5\xbd\x45\x4b\xf4\xd3\xd4\x65\x6f\xa0\x78\xff\x56\xb3\x0f\x4f\x0e\x9d\x5e\x6e\x89\x43\x83\x0a\xd6\xd3\x42\x96\x8c\x22\x4f\x7c\x35\xaf\x01\xa6\x1d\x10\xe1\x55\xfe\xe7\xe0\x22\x7c\xd7\x9a\x79\x77\xb3\xf4\x03\x51\xca\x01\x83\x48\x40\xab\xba\x55\x7d\x36\xbc\x8a\x42\x08\xf9\x0d\xc5\xf5\x1e\x3f\x3d\x44\x5c\x5f\xee\xa7\x93\x68\x16\x4e\xde\xf0\x5d\x24\x74\x8c\xe9\xf0\xa5\x84\x51\xb4\x3d\x98\x91\x90\x2b\xc4\x5e\xc6\x7d\x00\xdf\x1d\xeb\x74\xe6\x5b\x29\xc0\xd0\x95\xdb\xdd\x5b\x9a\x7c", 220);
*(uint64_t*)0x20000308 = 0xdc;
syscall(SYS_writev, r[0], 0x200002c0ul, 5ul);
break;
case 2:
*(uint32_t*)0x20000340 = 0;
*(uint32_t*)0x20000344 = -1;
*(uint32_t*)0x20000348 = 0;
res = syscall(SYS_getgroups, 3ul, 0x20000340ul);
if (res != -1)
r[1] = *(uint32_t*)0x20000348;
break;
case 3:
*(uint32_t*)0x200003c0 = 0xc;
res = syscall(SYS_getsockopt, -1, 0xffff, 0x11, 0x20000380ul, 0x200003c0ul);
if (res != -1)
r[2] = *(uint32_t*)0x20000388;
break;
case 4:
syscall(SYS_setregid, r[1], r[2]);
break;
case 5:
res = syscall(SYS_semget, 0x798e2634ul, 0ul, 0xb2603d964b180ce8ul);
if (res != -1)
r[3] = res;
break;
case 6:
memcpy((void*)0x20000400, "./file0\000", 8);
res = syscall(SYS_stat, 0x20000400ul, 0x20000440ul);
if (res != -1)
r[4] = *(uint32_t*)0x2000045c;
break;
case 7:
res = syscall(SYS_getgid);
if (res != -1)
r[5] = res;
break;
case 8:
*(uint32_t*)0x20000500 = 0xfffff834;
*(uint32_t*)0x20000504 = r[4];
*(uint32_t*)0x20000508 = r[5];
*(uint32_t*)0x2000050c = -1;
*(uint32_t*)0x20000510 = 0;
*(uint32_t*)0x20000514 = 3;
*(uint16_t*)0x20000518 = 9;
*(uint16_t*)0x2000051a = 0;
*(uint64_t*)0x20000520 = 0;
*(uint64_t*)0x20000528 = 0;
*(uint64_t*)0x20000530 = 0xfffffffffffffffd;
*(uint64_t*)0x20000538 = 0x4535;
*(uint64_t*)0x20000540 = 2;
*(uint64_t*)0x20000548 = 0;
*(uint64_t*)0x20000550 = 0;
syscall(SYS_semctl, r[3], 0ul, 1ul, 0x20000500ul);
break;
case 9:
syscall(SYS_seteuid, 0);
break;
case 10:
memcpy((void*)0x20000000, "\xbf\x5b\xc2\xc4\xdd\xcd\x9b\xaa\x7f\x7c\x66\xf9\x17\x26\xa8\xc4\x90\xf6\x91\x85\x14\x0b\x5b\x42\x51\xe8\x67\x01\xc6\xc5\xa6\x0d\x84\x80\x2d\x38\x2a\x0c\x38\xdf\x4a\x28\xfd\x84\x0d\x7e\x14\x06\xa5\xc2\xeb\x5d\x3b\x6b\xc3\x23\xbd\x49\x38\x6c\x4a\x92\x49\x50\x31\x4f\xe6\x17\xf8\xcd\x34\x37\xa4\xaa\x6d\x1c\x6d\x62\x64\x03\x09\xf9\xde\x23\x93\x99\x9b\x11\x47\x68\xd5\x10\xd7\x34\xfd\x72\xd1\x98\xb2\x61\xbd\x61\x81\x14\xbf\x3f\xa3\xe2\xfe\x84\xff\xe6\x5c\x80\xe4\x72\x12\xc4\x9e\x47\xbb\x3a\xaa\x86\x89\x46\x2f\x21\xd5\x18\x80\xd9\x7c\xb4\x45\xd3", 136);
break;
case 11:
memcpy((void*)0x200000c0, "\xc4\xa1\x84\x58\x2c\xaa\x26\x44\x0f\xae\x04\xc4\x41\x0f\x74\xab\x00\x00\x01\x00\xc4\x23\xf5\x78\x4c\xe9\x9d\x40\x44\xdf\x34\x59\x26\x41\x0f\xae\x41\x01\x64\x64\x66\x44\x0f\xe5\xb9\x4e\x9a\xb0\xc4\xc4\x22\x7d\x47\x0f\x41\x0f\x45\x7f\x56\x66\x0f\xdd\xe8", 63);
syz_execute_func(0x200000c0);
break;
case 12:
break;
case 13:
memcpy((void*)0x20000140, "\x64\xd3\x2f\x16\xeb\xd8\x17\xd0\x04\xdc\xb8\x01\x71\x82\x05\xbc\xa1\xd8\x6d\xad\x3c\xb1\x32\xa2\x86\x60\x92\x14\xb7\x39\x5a\x97\xa0\xe8\xfe\xda\x5f\xad\x02\xcc\xe9\xde\xea\x94\xd5\x5a\x75\x0c\x17\xb2\x34\x07\x50\x02\xb9\xdf\x62\x9f\xa6\x8e\x3f\x7d\xa9\x7e\x9c\x2a\x2e\x0a\x95\xd1\x5d\x35\x95\x61\xb1\x47\x74\x40\x34\x2c\xd7\x9c\x7c\xeb\xd6\xbf\x00\x8a\xcd\x1c\x7f\xf1\x46\xa6\xfe\x22\x01\x36\x61\xd8\xc8\xce\x8e\xb1\x7f\x5c\xf3\x89\x2a\xe0\x8b\xba\x46\x54\x5b\x2b\x69\x0a\xb7\xe0\x36\x8a\xec\x4d\x32\xb7\x6d\x7f\xc1\x5d\xd7\xc2\xab\xa1\x84\xd4\x1a\x5e\x5a\xbb\x8d\x71\x6f\x5e\x64\x5e\x17\x67\x13\x8e\xd7\x38\xf3\x15\x79\x5a\xc9\x9e\x22\xfd\x44\xdb\x06\x09\x63\x13\xf4\x72\x9c\xe0\xd3\xbd\x93\x8f\x5b\x65\x20\xef\x93\x76\xfa\x90\x9d\xf6\xb2\x05\xc2\xd3\xf5\x2e\xe4\x3e\x3f\x59\xea\x44\x1b\x7c\x4e\x4d\x5c", 201);
memcpy((void*)0x20000240, "\xc1\xb0\x1d\x40\x73\x99\x35\xb1\x21\x7d\x0e\x39\x3c\xdd\x4f\xa4\xef\x8b\xbd\x99\x57\xee\x99\x68\x77\xe4\xca\x15\x5c\x19\x5d\xc1\x66\xf9\x48\x6a\xc4\xdb\x17\xf7\x54\xc4\x89\x38\xa4\x34\x19\xf0\x82\xa8\xc3\x0e\xff\xbe\xf0\x64\xf6\xc8\xb8\x7b\xc9\x30\xe4\x39\xc7\x19\xec\x0a\x11\x99\x04\x0b\x86\x28\x6d\x27\x1f\x25\xaf\x26\xeb\xed\x3f\x55\xc3\x2e\x68\xac\x70\x33\x0d\xf7\x69\x31\xbf\x55\xfa\xe8\x80\x25\x6b\x74\xa9\x23\xf8\xa3\x02\x2c\x31\x0f\x94\xcc\x0c\x62\x33\x02\xa5\xd1\x4b\x3f\x8e\x18\xf4\x15\x99\x88\x28\x66\xea\x02\x42\x86\x4b\x37\xd5\xae\x87\xfb\xcb\x74\x5c\x3e\x26\x42\x3d\x05\xc5\x48\x38\x33\xdf\xcd\xd4\x3d\xc0\xc6\x50\x73\x29\x03\x72\x73\xde\x28\x2e\x3a\x16\xac\x00\xc5\x53\x9c\x30\x94\x63\x98\x4b\x15\x3e\xc6\x25\x0a\x78\x19\x75\xa2\x77\x01\x72\x80\xdb\x1e\x9c\x18\xce\x66\x4d\xf5\x94\x7c\x6c\x18\xbe\xf2\x36\x7e\x61\x63\xb4\x6b\x95\x03\xf7\x00\x70\x5f\xd0\xe8\x9e\xae\x6d\xf0\x88\x4b\xf2\x7c\x00\xe0\x5f\xc5\xef\xc6\x49\x07", 234);
syz_usb_connect(0, 0xc9, 0x20000140, 0x20000240);
break;
case 14:
memcpy((void*)0x20000340, "\x36\x4f\xb1\xa4\x17\x26\x3d\xe2\x27\x97\xec\x76\x08\x61\xf3\x85\x2c\xf2\x4f\x79\xe2\xb7\xa5\xc6\x2a\xfa\xd7\xd6\xd4\xd0\x9d\x86\x2f\x8e\xcc\xd0\x2e\x1b\xb9\x89\xe0\xf8\xa8\xad\x91\x54\x42\x01\x64\x04\xc9\x82\x6a\x5c\x0a\x28\x4f\xc7\xa8\x40\x30\x47\x59\xb6\x84\xf3\x57\xb2\xe6\xfe\xcf\xb3\xcc\x81\x57\xc0\x08\xff\x0d\xcf\xf2\x10\x89\x84\x54\x8a\x2a\xd6\x95\xfa\xd9\x51\x2f\x06\xfd\x12\xd6\x6b\xc4\x43\x04\x75\x12\xab\x4e\xf3\x05\x8a\xe6\xc0\xc6\xec\x3f\xd6\x27\xe3\x70\xa1\x51\xae\x71\x9b\x8e\x3a\x77\xd6\x82\xdc\x06\xa9\x3b\xe9\xc2\xaa\x80\x18\xb5\x8a\x94\x92\xcb\x39\x03\x1b\xb5\xab\xf3\x12\x4e\xaa\xb8\x53\x30\xf1\x81\xfc\xcc\xa7\x59\x7b\x4e\xc0\x87\x9f\xcb\xcf\x51\x14\x3f\x98\xc4\x43\xc1\x67\x20\xa6\xe0\x1b\x7e\x07\xdf\x47\x27\xe2\x88\xe1\x3d\xcc\x0b\x7e\x11", 191);
memcpy((void*)0x20000400, "\x59\x03\x92\x3c\x7a\x1b\x28\x38\xf3\xc1\x21\x56\x78\x5a\x11\xc8\x1b\x2e\x82\xd9\xa1\x19\x0e\x1b\x9c\x45\x97\x6a\x91\x7c\x00\x29\x4d\xc9\x4d\x53\x54\xe8\xc5\xd6\xa4\xe8\x98\x6d\xa0\x74\xeb\x46\x1e\xd0\x73\x6b\xcb\xed\xe2\xce\xf1\xf1\x9e\x02\x16\xc0\x9e\xb7\x94\xd8\xb9\x75\x4f\xea\x26\xf1\x10\xc8\x32\x48\xc2\x86\xea\xa0\x5a\x69\x84\x4e\xb1\x29\x2f\x59\x4f\x59\xf6\xc9\xbe\xca\x47\xd8\x94\xd4\x4d\xfd\x15\xff\x81\xb7\x6b\x46\x35\x39\x2e\xb5\xed\x43\x1c\xa3\x09\x22\x30", 117);
res = syz_usb_connect(4, 0xbf, 0x20000340, 0x20000400);
if (res != -1)
r[6] = res;
break;
case 15:
syz_usb_disconnect(r[6]);
break;
}
}
int main(void)
{
syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 3ul, 0x1012ul, -1, 0ul, 0ul);
do_sandbox_none();
return 0;
}
<stdin>:146:2: error: unknown type name 'uint8_t_t'
<stdin>:147:2: error: unknown type name 'uint8_t_t'
<stdin>:148:2: error: unknown type name 'uint8_t_t'
<stdin>:149:2: error: unknown type name 'uint8_t_t'
<stdin>:150:2: error: unknown type name 'uint16_t_t'
<stdin>:151:2: error: unknown type name 'uint8_t_t'
<stdin>:152:2: error: unknown type name 'uint8_t_t'
<stdin>:153:2: error: unknown type name 'uint8_t_t'
<stdin>:157:2: error: unknown type name 'uint8_t_t'
<stdin>:158:2: error: unknown type name 'uint8_t_t'
<stdin>:159:2: error: unknown type name 'uint16_t_t'
<stdin>:160:2: error: unknown type name 'uint8_t_t'
<stdin>:161:2: error: unknown type name 'uint8_t_t'
<stdin>:162:2: error: unknown type name 'uint8_t_t'
<stdin>:163:2: error: unknown type name 'uint8_t_t'
<stdin>:164:2: error: unknown type name 'uint16_t_t'
<stdin>:165:2: error: unknown type name 'uint16_t_t'
<stdin>:166:2: error: unknown type name 'uint16_t_t'
<stdin>:167:2: error: unknown type name 'uint8_t_t'
<stdin>:168:2: error: unknown type name 'uint8_t_t'
<stdin>:169:2: error: unknown type name 'uint8_t_t'
<stdin>:170:2: error: unknown type name 'uint8_t_t'
<stdin>:174:2: error: unknown type name 'uint8_t_t'
<stdin>:175:2: error: unknown type name 'uint8_t_t'
<stdin>:176:2: error: unknown type name 'uint16_t_t'
<stdin>:177:2: error: unknown type name 'uint8_t_t'
<stdin>:178:2: error: unknown type name 'uint8_t_t'
<stdin>:179:2: error: unknown type name 'uint8_t_t'
<stdin>:180:2: error: unknown type name 'uint8_t_t'
<stdin>:181:2: error: unknown type name 'uint8_t_t'
<stdin>:185:2: error: unknown type name 'uint8_t_t'
<stdin>:186:2: error: unknown type name 'uint8_t_t'
<stdin>:187:2: error: unknown type name 'uint8_t_t'
<stdin>:188:2: error: unknown type name 'uint8_t_t'
<stdin>:189:2: error: unknown type name 'uint8_t_t'
<stdin>:190:2: error: unknown type name 'uint8_t_t'
<stdin>:191:2: error: unknown type name 'uint8_t_t'
<stdin>:192:2: error: unknown type name 'uint8_t_t'
<stdin>:193:2: error: unknown type name 'uint8_t_t'
<stdin>:197:2: error: unknown type name 'uint8_t_t'
<stdin>:198:2: error: unknown type name 'uint8_t_t'
<stdin>:199:2: error: unknown type name 'uint16_t_t'
<stdin>:200:2: error: unknown type name 'uint16_t_t'
<stdin>:201:2: error: unknown type name 'uint16_t_t'
<stdin>:205:2: error: unknown type name 'uint8_t_t'
<stdin>:206:2: error: unknown type name 'uint8_t_t'
<stdin>:207:2: error: unknown type name 'uint16_t_t'
<stdin>:208:2: error: unknown type name 'uint8_t_t'
<stdin>:209:2: error: unknown type name 'uint8_t_t'
<stdin>:210:2: error: unknown type name 'uint8_t_t'
<stdin>:211:2: error: unknown type name 'uint8_t_t'
<stdin>:212:2: error: unknown type name 'uint8_t_t'
<stdin>:213:2: error: unknown type name 'uint8_t_t'
<stdin>: In function 'vhci_usb_recv':
<stdin>:520:2: error: unknown type name 'uint8_t_t'; did you mean 'uint8_t'?
<stdin>:520:20: error: 'uint8_t_t' undeclared (first use in this function); did you mean 'uint8_t'?
<stdin>:520:20: note: each undeclared identifier is reported only once for each function it appears in
<stdin>:520:30: error: expected expression before ')' token
<stdin>: In function 'vhci_usb_send':
<stdin>:535:2: error: unknown type name 'uint8_t_t'; did you mean 'uint8_t'?
<stdin>:535:20: error: 'uint8_t_t' undeclared (first use in this function); did you mean 'uint8_t'?
<stdin>:535:30: error: expected expression before ')' token
<stdin>: In function 'syz_usb_connect_impl':
<stdin>:596:63: error: unknown type name 'usb_ctrlrequest'
<stdin>:601:55: error: unknown type name 'usb_ctrlrequest'
<stdin>:613:8: error: 'uint32_t_t' undeclared (first use in this function); did you mean 'uint32_t'?
<stdin>: In function 'setup_usb':
<stdin>:663:6: error: implicit declaration of function 'chmod' [-Werror=implicit-function-declaration]
At top level:
<stdin>:661:13: error: 'setup_usb' defined but not used [-Werror=unused-function]
cc1: all warnings being treated as errors
compiler invocation: /syzkaller/netbsd/src/../tools/bin/x86_64--netbsd-g++ [-o /tmp/syz-executor058070425 -DGOOS_netbsd=1 -DGOARCH_amd64=1 -DHOSTGOOS_linux=1 -x c - -m64 --sysroot /syzkaller/netbsd/src/../dest/ -O2 -pthread -Wall -Werror -Wparentheses -Wframe-larger-than=16384]
--- FAIL: TestGenerate/netbsd/amd64/12 (0.76s)
csource_test.go:123: opts: {Threaded:true Collide:false Repeat:true RepeatTimes:0 Procs:0 Sandbox:none Fault:false FaultCall:0 FaultNth:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false USB:false UseTmpDir:true HandleSegv:false Repro:true Trace:false}
program:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
writev(r0, &(0x7f00000002c0)=[{&(0x7f0000000000)="25c5f6768692f16a6b02337bc5f24e95c2e574f7bd23da78ff2241439caced122e33ab16d377843415781fa508cd635f2fd04113204ed9bda7396e99a38a2f10e9c7398b5a64c49d98664bd14975be7076a83638a7da3095f0e027bd161ccd5c994f8b31d535a3ce4c57812d9682f3ebb10e05a7142210515b668d1357d91aaabb6ad88aed6b9f2143d062e0b5", 0x8d}, {&(0x7f00000000c0)="e8987e8f864e9d38b55615b659d14cae9e91a9532213ffb465b61b", 0x1b}, {&(0x7f0000000100)="3f97992c940fba8936a6b4", 0xb}, {&(0x7f0000000140)="c99ab604eb2e44ebf7bfb7b04c084321a30f4351aeb0676bb21aefc3bc2322d99a5b034f880aa25d61ae4076397c30357b22ccb779ebd3206ac648fab90836dd4d9e73dc3c077270b57dc3222284dd3cae4737957d947d765a5e0e919cbd3ef2d3d9522a827f3fe60ddc", 0x6a}, {&(0x7f00000001c0)="2bc5a9fd6cc3450082405ab607a0f5627b40589a690ac59158acf10f2a1cc46152fa5f493a8599cc6eaab5d96968bef1a27f62dacf64d06c80cfb5b320b977c9432c446fa6f6551444ee4c5998853260d65d2cb3c778f44fe270363b4eb309e24fc47797b5bd454bf4d3d4656fa078ff56b30f4f0e9d5e6e8943830ad6d342968c224f7c35af01a61d10e155fee7e0227cd79a7977b3f40351ca01834840abba557d36bc8a4208f90dc5f51e3f3d445c5feea79368164edef05d24748ce9f0a58451b43d9891902bc45ec67d00df1deb74e65b29c0d095dbdd5b9a7c", 0xdc}], 0x5)
getgroups(0x3, &(0x7f0000000340)=[0x0, 0xffffffffffffffff, <r1=>0x0])
getsockopt$sock_cred(0xffffffffffffffff, 0xffff, 0x11, &(0x7f0000000380)={0x0, 0x0, <r2=>0x0}, &(0x7f00000003c0)=0xc)
setregid(r1, r2)
r3 = semget(0x1, 0x0, 0xb2603d964b180ce8)
stat(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, <r4=>0x0})
r5 = getgid()
semctl$IPC_SET(r3, 0x0, 0x1, &(0x7f0000000500)={{0xfffff834, r4, r5, 0xffffffffffffffff, 0x0, 0x3, 0x9}, 0xfffffffffffffffd, 0x4535, 0x2})
seteuid(0x0)
syz_emit_ethernet(0x88, &(0x7f0000000000)="bf5bc2c4ddcd9baa7f7c66f91726a8c490f69185140b5b4251e86701c6c5a60d84802d382a0c38df4a28fd840d7e1406a5c2eb5d3b6bc323bd49386c4a924950314fe617f8cd3437a4aa6d1c6d62640309f9de2393999b114768d510d734fd72d198b261bd618114bf3fa3e2fe84ffe65c80e47212c49e47bb3aaa8689462f21d51880d97cb445d3")
syz_execute_func(&(0x7f00000000c0)="c4a184582caa26440fae04c4410f74ab00000100c423f5784ce99d4044df345926410fae4101646466440fe5b94e9ab0c4c4227d470f410f457f56660fdde8")
syz_extract_tcp_res(&(0x7f0000000100), 0x6, 0x1)
syz_usb_connect(0x0, 0xc9, &(0x7f0000000140)="64d32f16ebd817d004dcb801718205bca1d86dad3cb132a286609214b7395a97a0e8feda5fad02cce9deea94d55a750c17b234075002b9df629fa68e3f7da97e9c2a2e0a95d15d359561b1477440342cd79c7cebd6bf008acd1c7ff146a6fe22013661d8c8ce8eb17f5cf3892ae08bba46545b2b690ab7e0368aec4d32b76d7fc15dd7c2aba184d41a5e5abb8d716f5e645e1767138ed738f315795ac99e22fd44db06096313f4729ce0d3bd938f5b6520ef9376fa909df6b205c2d3f52ee43e3f59ea441b7c4e4d5c", &(0x7f0000000240)="c1b01d40739935b1217d0e393cdd4fa4ef8bbd9957ee996877e4ca155c195dc166f9486ac4db17f754c48938a43419f082a8c30effbef064f6c8b87bc930e439c719ec0a1199040b86286d271f25af26ebed3f55c32e68ac70330df76931bf55fae880256b74a923f8a3022c310f94cc0c623302a5d14b3f8e18f41599882866ea0242864b37d5ae87fbcb745c3e26423d05c5483833dfcdd43dc0c6507329037273de282e3a16ac00c5539c309463984b153ec6250a781975a277017280db1e9c18ce664df5947c6c18bef2367e6163b46b9503f700705fd0e89eae6df0884bf27c00e05fc5efc64907")
r6 = syz_usb_connect(0x4, 0xbf, &(0x7f0000000340)="364fb1a417263de22797ec760861f3852cf24f79e2b7a5c62afad7d6d4d09d862f8eccd02e1bb989e0f8a8ad915442016404c9826a5c0a284fc7a840304759b684f357b2e6fecfb3cc8157c008ff0dcff2108984548a2ad695fad9512f06fd12d66bc443047512ab4ef3058ae6c0c6ec3fd627e370a151ae719b8e3a77d682dc06a93be9c2aa8018b58a9492cb39031bb5abf3124eaab85330f181fccca7597b4ec0879fcbcf51143f98c443c16720a6e01b7e07df4727e288e13dcc0b7e11", &(0x7f0000000400)="5903923c7a1b2838f3c12156785a11c81b2e82d9a1190e1b9c45976a917c00294dc94d5354e8c5d6a4e8986da074eb461ed0736bcbede2cef1f19e0216c09eb794d8b9754fea26f110c83248c286eaa05a69844eb1292f594f59f6c9beca47d894d44dfd15ff81b76b4635392eb5ed431ca3092230")
syz_usb_disconnect(r6)
csource_test.go:124: failed to build program:
// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <dev/usb/usb.h>
#include <dev/usb/usbhid.h>
#include <dev/usb/vhci.h>
#include <dirent.h>
#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <pthread.h>
#include <pwd.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ioctl.h>
#include <sys/resource.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>
static unsigned long long procid;
static void kill_and_wait(int pid, int* status)
{
kill(pid, SIGKILL);
while (waitpid(-1, status, 0) != pid) {
}
}
static void sleep_ms(uint64_t ms)
{
usleep(ms * 1000);
}
static uint64_t current_time_ms(void)
{
struct timespec ts;
if (clock_gettime(CLOCK_MONOTONIC, &ts))
exit(1);
return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}
static void use_temporary_dir(void)
{
char tmpdir_template[] = "./syzkaller.XXXXXX";
char* tmpdir = mkdtemp(tmpdir_template);
if (!tmpdir)
exit(1);
if (chmod(tmpdir, 0777))
exit(1);
if (chdir(tmpdir))
exit(1);
}
static void remove_dir(const char* dir)
{
DIR* dp;
struct dirent* ep;
dp = opendir(dir);
if (dp == NULL)
exit(1);
while ((ep = readdir(dp))) {
if (strcmp(ep->d_name, ".") == 0 || strcmp(ep->d_name, "..") == 0)
continue;
char filename[FILENAME_MAX];
snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name);
struct stat st;
if (lstat(filename, &st))
exit(1);
if (S_ISDIR(st.st_mode)) {
remove_dir(filename);
continue;
}
if (unlink(filename))
exit(1);
}
closedir(dp);
if (rmdir(dir))
exit(1);
}
static void thread_start(void* (*fn)(void*), void* arg)
{
pthread_t th;
pthread_attr_t attr;
pthread_attr_init(&attr);
pthread_attr_setstacksize(&attr, 128 << 10);
int i;
for (i = 0; i < 100; i++) {
if (pthread_create(&th, &attr, fn, arg) == 0) {
pthread_attr_destroy(&attr);
return;
}
if (errno == EAGAIN) {
usleep(50);
continue;
}
break;
}
exit(1);
}
typedef struct {
pthread_mutex_t mu;
pthread_cond_t cv;
int state;
} event_t;
static void event_init(event_t* ev)
{
if (pthread_mutex_init(&ev->mu, 0))
exit(1);
if (pthread_cond_init(&ev->cv, 0))
exit(1);
ev->state = 0;
}
static void event_reset(event_t* ev)
{
ev->state = 0;
}
static void event_set(event_t* ev)
{
pthread_mutex_lock(&ev->mu);
if (ev->state)
exit(1);
ev->state = 1;
pthread_mutex_unlock(&ev->mu);
pthread_cond_broadcast(&ev->cv);
}
static void event_wait(event_t* ev)
{
pthread_mutex_lock(&ev->mu);
while (!ev->state)
pthread_cond_wait(&ev->cv, &ev->mu);
pthread_mutex_unlock(&ev->mu);
}
static int event_isset(event_t* ev)
{
pthread_mutex_lock(&ev->mu);
int res = ev->state;
pthread_mutex_unlock(&ev->mu);
return res;
}
static int event_timedwait(event_t* ev, uint64_t timeout)
{
uint64_t start = current_time_ms();
uint64_t now = start;
pthread_mutex_lock(&ev->mu);
for (;;) {
if (ev->state)
break;
uint64_t remain = timeout - (now - start);
struct timespec ts;
ts.tv_sec = remain / 1000;
ts.tv_nsec = (remain % 1000) * 1000 * 1000;
pthread_cond_timedwait(&ev->cv, &ev->mu, &ts);
now = current_time_ms();
if (now - start > timeout)
break;
}
int res = ev->state;
pthread_mutex_unlock(&ev->mu);
return res;
}
/* -------------------------------------------------------------------------- */
/*
* Redefinitions to match the linux types used in common_usb.h.
*/
struct usb_endpoint_descriptor {
uint8_t_t bLength;
uint8_t_t bDescriptorType;
uint8_t_t bEndpointAddress;
uint8_t_t bmAttributes;
uint16_t_t wMaxPacketSize;
uint8_t_t bInterval;
uint8_t_t bRefresh;
uint8_t_t bSynchAddress;
} __attribute__((packed));
struct usb_device_descriptor {
uint8_t_t bLength;
uint8_t_t bDescriptorType;
uint16_t_t bcdUSB;
uint8_t_t bDeviceClass;
uint8_t_t bDeviceSubClass;
uint8_t_t bDeviceProtocol;
uint8_t_t bMaxPacketSize0;
uint16_t_t idVendor;
uint16_t_t idProduct;
uint16_t_t bcdDevice;
uint8_t_t iManufacturer;
uint8_t_t iProduct;
uint8_t_t iSerialNumber;
uint8_t_t bNumConfigurations;
} __attribute__((packed));
struct usb_config_descriptor {
uint8_t_t bLength;
uint8_t_t bDescriptorType;
uint16_t_t wTotalLength;
uint8_t_t bNumInterfaces;
uint8_t_t bConfigurationValue;
uint8_t_t iConfiguration;
uint8_t_t bmAttributes;
uint8_t_t bMaxPower;
} __attribute__((packed));
struct usb_interface_descriptor {
uint8_t_t bLength;
uint8_t_t bDescriptorType;
uint8_t_t bInterfaceNumber;
uint8_t_t bAlternateSetting;
uint8_t_t bNumEndpoints;
uint8_t_t bInterfaceClass;
uint8_t_t bInterfaceSubClass;
uint8_t_t bInterfaceProtocol;
uint8_t_t iInterface;
} __attribute__((packed));
struct usb_ctrlrequest {
uint8_t_t bRequestType;
uint8_t_t bRequest;
uint16_t_t wValue;
uint16_t_t wIndex;
uint16_t_t wLength;
} __attribute__((packed));
struct usb_qualifier_descriptor {
uint8_t_t bLength;
uint8_t_t bDescriptorType;
uint16_t_t bcdUSB;
uint8_t_t bDeviceClass;
uint8_t_t bDeviceSubClass;
uint8_t_t bDeviceProtocol;
uint8_t_t bMaxPacketSize0;
uint8_t_t bNumConfigurations;
uint8_t_t bRESERVED;
} __attribute__((packed));
#define USB_TYPE_MASK (0x03 << 5)
#define USB_TYPE_STANDARD (0x00 << 5)
#define USB_TYPE_CLASS (0x01 << 5)
#define USB_TYPE_VENDOR (0x02 << 5)
#define USB_TYPE_RESERVED (0x03 << 5)
#define USB_DT_DEVICE 0x01
#define USB_DT_CONFIG 0x02
#define USB_DT_STRING 0x03
#define USB_DT_INTERFACE 0x04
#define USB_DT_ENDPOINT 0x05
#define USB_DT_DEVICE_QUALIFIER 0x06
#define USB_DT_OTHER_SPEED_CONFIG 0x07
#define USB_DT_INTERFACE_POWER 0x08
#define USB_DT_OTG 0x09
#define USB_DT_DEBUG 0x0a
#define USB_DT_INTERFACE_ASSOCIATION 0x0b
#define USB_DT_SECURITY 0x0c
#define USB_DT_KEY 0x0d
#define USB_DT_ENCRYPTION_TYPE 0x0e
#define USB_DT_BOS 0x0f
#define USB_DT_DEVICE_CAPABILITY 0x10
#define USB_DT_WIRELESS_ENDPOINT_COMP 0x11
#define USB_DT_WIRE_ADAPTER 0x21
#define USB_DT_RPIPE 0x22
#define USB_DT_CS_RADIO_CONTROL 0x23
#define USB_DT_PIPE_USAGE 0x24
#define USB_DT_SS_ENDPOINT_COMP 0x30
#define USB_DT_SSP_ISOC_ENDPOINT_COMP 0x31
#define USB_REQ_GET_STATUS 0x00
#define USB_REQ_CLEAR_FEATURE 0x01
#define USB_REQ_SET_FEATURE 0x03
#define USB_REQ_SET_ADDRESS 0x05
#define USB_REQ_GET_DESCRIPTOR 0x06
#define USB_REQ_SET_DESCRIPTOR 0x07
#define USB_REQ_GET_CONFIGURATION 0x08
#define USB_REQ_SET_CONFIGURATION 0x09
#define USB_REQ_GET_INTERFACE 0x0A
#define USB_REQ_SET_INTERFACE 0x0B
#define USB_REQ_SYNCH_FRAME 0x0C
#define USB_REQ_SET_SEL 0x30
#define USB_REQ_SET_ISOCH_DELAY 0x31
#define USB_REQ_SET_ENCRYPTION 0x0D
#define USB_REQ_GET_ENCRYPTION 0x0E
#define USB_REQ_RPIPE_ABORT 0x0E
#define USB_REQ_SET_HANDSHAKE 0x0F
#define USB_REQ_RPIPE_RESET 0x0F
#define USB_REQ_GET_HANDSHAKE 0x10
#define USB_REQ_SET_CONNECTION 0x11
#define USB_REQ_SET_SECURITY_DATA 0x12
#define USB_REQ_GET_SECURITY_DATA 0x13
#define USB_REQ_SET_WUSB_DATA 0x14
#define USB_REQ_LOOPBACK_DATA_WRITE 0x15
#define USB_REQ_LOOPBACK_DATA_READ 0x16
#define USB_REQ_SET_INTERFACE_DS 0x17
#define USB_REQ_GET_PARTNER_PDO 20
#define USB_REQ_GET_BATTERY_STATUS 21
#define USB_REQ_SET_PDO 22
#define USB_REQ_GET_VDM 23
#define USB_REQ_SEND_VDM 24
#define USB_MAX_IFACE_NUM 4
#define USB_MAX_EP_NUM 32
#define USB_MAX_FDS 6
struct usb_endpoint_index {
struct usb_endpoint_descriptor desc;
int handle;
};
struct usb_iface_index {
struct usb_interface_descriptor* iface;
uint8_t bInterfaceNumber;
uint8_t bAlternateSetting;
uint8_t bInterfaceClass;
struct usb_endpoint_index eps[USB_MAX_EP_NUM];
int eps_num;
};
struct usb_device_index {
struct usb_device_descriptor* dev;
struct usb_config_descriptor* config;
uint8_t bDeviceClass;
uint8_t bMaxPower;
int config_length;
struct usb_iface_index ifaces[USB_MAX_IFACE_NUM];
int ifaces_num;
int iface_cur;
};
struct usb_info {
int fd;
struct usb_device_index index;
};
static struct usb_info usb_devices[USB_MAX_FDS];
static int usb_devices_num;
static bool parse_usb_descriptor(const char* buffer, size_t length, struct usb_device_index* index)
{
if (length < sizeof(*index->dev) + sizeof(*index->config))
return false;
memset(index, 0, sizeof(*index));
index->dev = (struct usb_device_descriptor*)buffer;
index->config = (struct usb_config_descriptor*)(buffer + sizeof(*index->dev));
index->bDeviceClass = index->dev->bDeviceClass;
index->bMaxPower = index->config->bMaxPower;
index->config_length = length - sizeof(*index->dev);
index->iface_cur = -1;
size_t offset = 0;
while (true) {
if (offset + 1 >= length)
break;
uint8_t desc_length = buffer[offset];
uint8_t desc_type = buffer[offset + 1];
if (desc_length <= 2)
break;
if (offset + desc_length > length)
break;
if (desc_type == USB_DT_INTERFACE && index->ifaces_num < USB_MAX_IFACE_NUM) {
struct usb_interface_descriptor* iface = (struct usb_interface_descriptor*)(buffer + offset);
index->ifaces[index->ifaces_num].iface = iface;
index->ifaces[index->ifaces_num].bInterfaceNumber = iface->bInterfaceNumber;
index->ifaces[index->ifaces_num].bAlternateSetting = iface->bAlternateSetting;
index->ifaces[index->ifaces_num].bInterfaceClass = iface->bInterfaceClass;
index->ifaces_num++;
}
if (desc_type == USB_DT_ENDPOINT && index->ifaces_num > 0) {
struct usb_iface_index* iface = &index->ifaces[index->ifaces_num - 1];
if (iface->eps_num < USB_MAX_EP_NUM) {
memcpy(&iface->eps[iface->eps_num].desc, buffer + offset, sizeof(iface->eps[iface->eps_num].desc));
iface->eps_num++;
}
}
offset += desc_length;
}
return true;
}
static struct usb_device_index* add_usb_index(int fd, const char* dev, size_t dev_len)
{
int i = __atomic_fetch_add(&usb_devices_num, 1, __ATOMIC_RELAXED);
if (i >= USB_MAX_FDS)
return NULL;
int rv = 0;
rv = parse_usb_descriptor(dev, dev_len, &usb_devices[i].index);
if (!rv)
return NULL;
__atomic_store_n(&usb_devices[i].fd, fd, __ATOMIC_RELEASE);
return &usb_devices[i].index;
}
static struct usb_device_index* lookup_usb_index(int fd)
{
int i;
for (i = 0; i < USB_MAX_FDS; i++) {
if (__atomic_load_n(&usb_devices[i].fd, __ATOMIC_ACQUIRE) == fd) {
return &usb_devices[i].index;
}
}
return NULL;
}
struct vusb_connect_string_descriptor {
uint32_t len;
char* str;
} __attribute__((packed));
struct vusb_connect_descriptors {
uint32_t qual_len;
char* qual;
uint32_t bos_len;
char* bos;
uint32_t strs_len;
struct vusb_connect_string_descriptor strs[0];
} __attribute__((packed));
static const char default_string[] = {
8, USB_DT_STRING,
's', 0, 'y', 0, 'z', 0
};
static const char default_lang_id[] = {
4, USB_DT_STRING,
0x09, 0x04
};
static bool lookup_connect_response_in(int fd, const struct vusb_connect_descriptors* descs,
const struct usb_ctrlrequest* ctrl,
char** response_data, uint32_t* response_length)
{
struct usb_device_index* index = lookup_usb_index(fd);
uint8_t str_idx;
if (!index)
return false;
switch (ctrl->bRequestType & USB_TYPE_MASK) {
case USB_TYPE_STANDARD:
switch (ctrl->bRequest) {
case USB_REQ_GET_DESCRIPTOR:
switch (ctrl->wValue >> 8) {
case USB_DT_DEVICE:
*response_data = (char*)index->dev;
*response_length = sizeof(*index->dev);
return true;
case USB_DT_CONFIG:
*response_data = (char*)index->config;
*response_length = index->config_length;
return true;
case USB_DT_STRING:
str_idx = (uint8_t)ctrl->wValue;
if (descs && str_idx < descs->strs_len) {
*response_data = descs->strs[str_idx].str;
*response_length = descs->strs[str_idx].len;
return true;
}
if (str_idx == 0) {
*response_data = (char*)&default_lang_id[0];
*response_length = default_lang_id[0];
return true;
}
*response_data = (char*)&default_string[0];
*response_length = default_string[0];
return true;
case USB_DT_BOS:
*response_data = descs->bos;
*response_length = descs->bos_len;
return true;
case USB_DT_DEVICE_QUALIFIER:
if (!descs->qual) {
struct usb_qualifier_descriptor* qual =
(struct usb_qualifier_descriptor*)response_data;
qual->bLength = sizeof(*qual);
qual->bDescriptorType = USB_DT_DEVICE_QUALIFIER;
qual->bcdUSB = index->dev->bcdUSB;
qual->bDeviceClass = index->dev->bDeviceClass;
qual->bDeviceSubClass = index->dev->bDeviceSubClass;
qual->bDeviceProtocol = index->dev->bDeviceProtocol;
qual->bMaxPacketSize0 = index->dev->bMaxPacketSize0;
qual->bNumConfigurations = index->dev->bNumConfigurations;
qual->bRESERVED = 0;
*response_length = sizeof(*qual);
return true;
}
*response_data = descs->qual;
*response_length = descs->qual_len;
return true;
default:
break;
}
break;
default:
break;
}
break;
default:
break;
}
return false;
}
typedef bool (*lookup_connect_out_response_t)(int fd, const struct vusb_connect_descriptors* descs,
const struct usb_ctrlrequest* ctrl, bool* done);
static bool lookup_connect_response_out_generic(int fd, const struct vusb_connect_descriptors* descs,
const struct usb_ctrlrequest* ctrl, bool* done)
{
switch (ctrl->bRequestType & USB_TYPE_MASK) {
case USB_TYPE_STANDARD:
switch (ctrl->bRequest) {
case USB_REQ_SET_CONFIGURATION:
*done = true;
return true;
default:
break;
}
break;
}
return false;
}
/* -------------------------------------------------------------------------- */
static int vhci_open(void)
{
return open("/dev/vhci", O_RDWR);
}
static int vhci_setport(int fd, u_int port)
{
struct vhci_ioc_set_port args;
args.port = port;
return ioctl(fd, VHCI_IOC_SET_PORT, &args);
}
static int vhci_usb_attach(int fd)
{
return ioctl(fd, VHCI_IOC_USB_ATTACH, NULL);
}
static int vhci_usb_recv(int fd, void* buf, size_t size)
{
uint8_t_t* ptr = (uint8_t_t*)buf;
ssize_t done;
while (1) {
done = read(fd, ptr, size);
if (done < 0)
return -1;
if ((size_t)done == size)
return 0;
size -= done;
ptr += done;
}
}
static int vhci_usb_send(int fd, void* buf, size_t size)
{
uint8_t_t* ptr = (uint8_t_t*)buf;
ssize_t done;
while (1) {
done = write(fd, ptr, size);
if (done <= 0)
return -1;
if ((size_t)done == size)
return 0;
size -= done;
ptr += done;
}
}
/* -------------------------------------------------------------------------- */
static volatile long syz_usb_connect_impl(uint64_t speed, uint64_t dev_len,
const char* dev, const struct vusb_connect_descriptors* descs,
lookup_connect_out_response_t lookup_connect_response_out)
{
struct usb_device_index* index;
int portnum, fd, rv;
bool done;
portnum = procid + 1;
if (!dev) {
return -1;
}
if (portnum != 1) {
/* For now, we support only one proc. */
return -1;
}
fd = vhci_open();
if (fd < 0) {
return -1;
}
index = add_usb_index(fd, dev, dev_len);
if (!index) {
goto err;
}
rv = vhci_setport(fd, portnum);
if (rv != 0) {
goto err;
}
rv = vhci_usb_attach(fd);
if (rv != 0) {
goto err;
}
done = false;
while (!done) {
vhci_request_t req;
rv = vhci_usb_recv(fd, &req, sizeof(req));
if (rv != 0) {
goto err;
}
if (req.type != VHCI_REQ_CTRL) {
goto err;
}
char* response_data = NULL;
uint32_t response_length = 0;
char data[4096];
if (req.u.ctrl.bmRequestType & UE_DIR_IN) {
bool response_found = false;
response_found = lookup_connect_response_in(fd, descs, (const usb_ctrlrequest*)&req.u.ctrl, &response_data, &response_length);
if (!response_found) {
goto err;
}
} else {
if (!lookup_connect_response_out(fd, descs, (const usb_ctrlrequest*)&req.u.ctrl, &done)) {
goto err;
}
response_data = NULL;
response_length = UGETW(req.u.ctrl.wLength);
}
if ((req.u.ctrl.bmRequestType & USB_TYPE_MASK) == USB_TYPE_STANDARD &&
req.u.ctrl.bRequest == USB_REQ_SET_CONFIGURATION) {
/* TODO: possibly revisit */
}
if (response_length > sizeof(data))
response_length = 0;
if ((uint32_t_t)UGETW(req.u.ctrl.wLength) < response_length)
response_length = UGETW(req.u.ctrl.wLength);
if (response_data)
memcpy(data, response_data, response_length);
else
memset(data, 0, response_length);
if (req.u.ctrl.bmRequestType & UE_DIR_IN) {
if (response_length > 0) {
vhci_response_t res;
res.size = response_length;
rv = vhci_usb_send(fd, &res, sizeof(res));
if (rv == 0)
rv = vhci_usb_send(fd, data, response_length);
}
} else {
rv = vhci_usb_recv(fd, data, response_length);
}
if (rv < 0) {
goto err;
}
}
sleep_ms(200);
return fd;
err:
close(fd);
return -1;
}
static volatile long syz_usb_connect(volatile long a0, volatile long a1,
volatile long a2, volatile long a3)
{
uint64_t speed = a0;
uint64_t dev_len = a1;
const char* dev = (const char*)a2;
const struct vusb_connect_descriptors* descs = (const struct vusb_connect_descriptors*)a3;
return syz_usb_connect_impl(speed, dev_len, dev, descs,
&lookup_connect_response_out_generic);
}
static volatile long syz_usb_disconnect(volatile long a0)
{
int fd = a0;
int rv = close(fd);
sleep_ms(200);
return rv;
}
static void setup_usb(void)
{
if (chmod("/dev/vhci", 0666))
exit(1);
}
static void sandbox_common()
{
if (setsid() == -1)
exit(1);
struct rlimit rlim;
rlim.rlim_cur = rlim.rlim_max = 8 << 20;
setrlimit(RLIMIT_MEMLOCK, &rlim);
rlim.rlim_cur = rlim.rlim_max = 1 << 20;
setrlimit(RLIMIT_FSIZE, &rlim);
rlim.rlim_cur = rlim.rlim_max = 1 << 20;
setrlimit(RLIMIT_STACK, &rlim);
rlim.rlim_cur = rlim.rlim_max = 0;
setrlimit(RLIMIT_CORE, &rlim);
rlim.rlim_cur = rlim.rlim_max = 256;
setrlimit(RLIMIT_NOFILE, &rlim);
}
static void loop();
static int do_sandbox_none(void)
{
sandbox_common();
loop();
return 0;
}
static long syz_execute_func(volatile long text)
{
volatile long p[8] = {0};
(void)p;
asm volatile("" ::"r"(0l), "r"(1l), "r"(2l), "r"(3l), "r"(4l), "r"(5l), "r"(6l),
"r"(7l), "r"(8l), "r"(9l), "r"(10l), "r"(11l), "r"(12l), "r"(13l));
((void (*)(void))(text))();
return 0;
}
struct thread_t {
int created, call;
event_t ready, done;
};
static struct thread_t threads[16];
static void execute_call(int call);
static int running;
static void* thr(void* arg)
{
struct thread_t* th = (struct thread_t*)arg;
for (;;) {
event_wait(&th->ready);
event_reset(&th->ready);
execute_call(th->call);
__atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED);
event_set(&th->done);
}
return 0;
}
static void execute_one(void)
{
if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {
}
int i, call, thread;
for (call = 0; call < 16; call++) {
for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0])); thread++) {
struct thread_t* th = &threads[thread];
if (!th->created) {
th->created = 1;
event_init(&th->ready);
event_init(&th->done);
event_set(&th->done);
thread_start(thr, th);
}
if (!event_isset(&th->done))
continue;
event_reset(&th->done);
th->call = call;
__atomic_fetch_add(&running, 1, __ATOMIC_RELAXED);
event_set(&th->ready);
event_timedwait(&th->done, 45 + (call == 13 ? 3000 : 0) + (call == 14 ? 3000 : 0) + (call == 15 ? 300 : 0));
break;
}
}
for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++)
sleep_ms(1);
}
static void execute_one(void);
#define WAIT_FLAGS 0
static void loop(void)
{
int iter;
for (iter = 0;; iter++) {
char cwdbuf[32];
sprintf(cwdbuf, "./%d", iter);
if (mkdir(cwdbuf, 0777))
exit(1);
int pid = fork();
if (pid < 0)
exit(1);
if (pid == 0) {
if (chdir(cwdbuf))
exit(1);
execute_one();
exit(0);
}
int status = 0;
uint64_t start = current_time_ms();
for (;;) {
if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
break;
sleep_ms(1);
if (current_time_ms() - start < 5 * 1000)
continue;
kill_and_wait(pid, &status);
break;
}
remove_dir(cwdbuf);
}
}
#ifndef SYS_dup2
#define SYS_dup2 90
#endif
#ifndef SYS_getgid
#define SYS_getgid 47
#endif
#ifndef SYS_getgroups
#define SYS_getgroups 79
#endif
#ifndef SYS_getsockopt
#define SYS_getsockopt 118
#endif
#ifndef SYS_mmap
#define SYS_mmap 197
#endif
#ifndef SYS_semctl
#define SYS_semctl 442
#endif
#ifndef SYS_semget
#define SYS_semget 221
#endif
#ifndef SYS_seteuid
#define SYS_seteuid 183
#endif
#ifndef SYS_setregid
#define SYS_setregid 127
#endif
#ifndef SYS_stat
#define SYS_stat 439
#endif
#ifndef SYS_writev
#define SYS_writev 121
#endif
uint64_t r[7] = {0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff};
void execute_call(int call)
{
intptr_t res = 0;
switch (call) {
case 0:
res = syscall(SYS_dup2, -1, 0xffffff9c);
if (res != -1)
r[0] = res;
break;
case 1:
*(uint64_t*)0x200002c0 = 0x20000000;
memcpy((void*)0x20000000, "\x25\xc5\xf6\x76\x86\x92\xf1\x6a\x6b\x02\x33\x7b\xc5\xf2\x4e\x95\xc2\xe5\x74\xf7\xbd\x23\xda\x78\xff\x22\x41\x43\x9c\xac\xed\x12\x2e\x33\xab\x16\xd3\x77\x84\x34\x15\x78\x1f\xa5\x08\xcd\x63\x5f\x2f\xd0\x41\x13\x20\x4e\xd9\xbd\xa7\x39\x6e\x99\xa3\x8a\x2f\x10\xe9\xc7\x39\x8b\x5a\x64\xc4\x9d\x98\x66\x4b\xd1\x49\x75\xbe\x70\x76\xa8\x36\x38\xa7\xda\x30\x95\xf0\xe0\x27\xbd\x16\x1c\xcd\x5c\x99\x4f\x8b\x31\xd5\x35\xa3\xce\x4c\x57\x81\x2d\x96\x82\xf3\xeb\xb1\x0e\x05\xa7\x14\x22\x10\x51\x5b\x66\x8d\x13\x57\xd9\x1a\xaa\xbb\x6a\xd8\x8a\xed\x6b\x9f\x21\x43\xd0\x62\xe0\xb5", 141);
*(uint64_t*)0x200002c8 = 0x8d;
*(uint64_t*)0x200002d0 = 0x200000c0;
memcpy((void*)0x200000c0, "\xe8\x98\x7e\x8f\x86\x4e\x9d\x38\xb5\x56\x15\xb6\x59\xd1\x4c\xae\x9e\x91\xa9\x53\x22\x13\xff\xb4\x65\xb6\x1b", 27);
*(uint64_t*)0x200002d8 = 0x1b;
*(uint64_t*)0x200002e0 = 0x20000100;
memcpy((void*)0x20000100, "\x3f\x97\x99\x2c\x94\x0f\xba\x89\x36\xa6\xb4", 11);
*(uint64_t*)0x200002e8 = 0xb;
*(uint64_t*)0x200002f0 = 0x20000140;
memcpy((void*)0x20000140, "\xc9\x9a\xb6\x04\xeb\x2e\x44\xeb\xf7\xbf\xb7\xb0\x4c\x08\x43\x21\xa3\x0f\x43\x51\xae\xb0\x67\x6b\xb2\x1a\xef\xc3\xbc\x23\x22\xd9\x9a\x5b\x03\x4f\x88\x0a\xa2\x5d\x61\xae\x40\x76\x39\x7c\x30\x35\x7b\x22\xcc\xb7\x79\xeb\xd3\x20\x6a\xc6\x48\xfa\xb9\x08\x36\xdd\x4d\x9e\x73\xdc\x3c\x07\x72\x70\xb5\x7d\xc3\x22\x22\x84\xdd\x3c\xae\x47\x37\x95\x7d\x94\x7d\x76\x5a\x5e\x0e\x91\x9c\xbd\x3e\xf2\xd3\xd9\x52\x2a\x82\x7f\x3f\xe6\x0d\xdc", 106);
*(uint64_t*)0x200002f8 = 0x6a;
*(uint64_t*)0x20000300 = 0x200001c0;
memcpy((void*)0x200001c0, "\x2b\xc5\xa9\xfd\x6c\xc3\x45\x00\x82\x40\x5a\xb6\x07\xa0\xf5\x62\x7b\x40\x58\x9a\x69\x0a\xc5\x91\x58\xac\xf1\x0f\x2a\x1c\xc4\x61\x52\xfa\x5f\x49\x3a\x85\x99\xcc\x6e\xaa\xb5\xd9\x69\x68\xbe\xf1\xa2\x7f\x62\xda\xcf\x64\xd0\x6c\x80\xcf\xb5\xb3\x20\xb9\x77\xc9\x43\x2c\x44\x6f\xa6\xf6\x55\x14\x44\xee\x4c\x59\x98\x85\x32\x60\xd6\x5d\x2c\xb3\xc7\x78\xf4\x4f\xe2\x70\x36\x3b\x4e\xb3\x09\xe2\x4f\xc4\x77\x97\xb5\xbd\x45\x4b\xf4\xd3\xd4\x65\x6f\xa0\x78\xff\x56\xb3\x0f\x4f\x0e\x9d\x5e\x6e\x89\x43\x83\x0a\xd6\xd3\x42\x96\x8c\x22\x4f\x7c\x35\xaf\x01\xa6\x1d\x10\xe1\x55\xfe\xe7\xe0\x22\x7c\xd7\x9a\x79\x77\xb3\xf4\x03\x51\xca\x01\x83\x48\x40\xab\xba\x55\x7d\x36\xbc\x8a\x42\x08\xf9\x0d\xc5\xf5\x1e\x3f\x3d\x44\x5c\x5f\xee\xa7\x93\x68\x16\x4e\xde\xf0\x5d\x24\x74\x8c\xe9\xf0\xa5\x84\x51\xb4\x3d\x98\x91\x90\x2b\xc4\x5e\xc6\x7d\x00\xdf\x1d\xeb\x74\xe6\x5b\x29\xc0\xd0\x95\xdb\xdd\x5b\x9a\x7c", 220);
*(uint64_t*)0x20000308 = 0xdc;
syscall(SYS_writev, r[0], 0x200002c0ul, 5ul);
break;
case 2:
*(uint32_t*)0x20000340 = 0;
*(uint32_t*)0x20000344 = -1;
*(uint32_t*)0x20000348 = 0;
res = syscall(SYS_getgroups, 3ul, 0x20000340ul);
if (res != -1)
r[1] = *(uint32_t*)0x20000348;
break;
case 3:
*(uint32_t*)0x200003c0 = 0xc;
res = syscall(SYS_getsockopt, -1, 0xffff, 0x11, 0x20000380ul, 0x200003c0ul);
if (res != -1)
r[2] = *(uint32_t*)0x20000388;
break;
case 4:
syscall(SYS_setregid, r[1], r[2]);
break;
case 5:
res = syscall(SYS_semget, 0x798e2634ul, 0ul, 0xb2603d964b180ce8ul);
if (res != -1)
r[3] = res;
break;
case 6:
memcpy((void*)0x20000400, "./file0\000", 8);
res = syscall(SYS_stat, 0x20000400ul, 0x20000440ul);
if (res != -1)
r[4] = *(uint32_t*)0x2000045c;
break;
case 7:
res = syscall(SYS_getgid);
if (res != -1)
r[5] = res;
break;
case 8:
*(uint32_t*)0x20000500 = 0xfffff834;
*(uint32_t*)0x20000504 = r[4];
*(uint32_t*)0x20000508 = r[5];
*(uint32_t*)0x2000050c = -1;
*(uint32_t*)0x20000510 = 0;
*(uint32_t*)0x20000514 = 3;
*(uint16_t*)0x20000518 = 9;
*(uint16_t*)0x2000051a = 0;
*(uint64_t*)0x20000520 = 0;
*(uint64_t*)0x20000528 = 0;
*(uint64_t*)0x20000530 = 0xfffffffffffffffd;
*(uint64_t*)0x20000538 = 0x4535;
*(uint64_t*)0x20000540 = 2;
*(uint64_t*)0x20000548 = 0;
*(uint64_t*)0x20000550 = 0;
syscall(SYS_semctl, r[3], 0ul, 1ul, 0x20000500ul);
break;
case 9:
syscall(SYS_seteuid, 0);
break;
case 10:
memcpy((void*)0x20000000, "\xbf\x5b\xc2\xc4\xdd\xcd\x9b\xaa\x7f\x7c\x66\xf9\x17\x26\xa8\xc4\x90\xf6\x91\x85\x14\x0b\x5b\x42\x51\xe8\x67\x01\xc6\xc5\xa6\x0d\x84\x80\x2d\x38\x2a\x0c\x38\xdf\x4a\x28\xfd\x84\x0d\x7e\x14\x06\xa5\xc2\xeb\x5d\x3b\x6b\xc3\x23\xbd\x49\x38\x6c\x4a\x92\x49\x50\x31\x4f\xe6\x17\xf8\xcd\x34\x37\xa4\xaa\x6d\x1c\x6d\x62\x64\x03\x09\xf9\xde\x23\x93\x99\x9b\x11\x47\x68\xd5\x10\xd7\x34\xfd\x72\xd1\x98\xb2\x61\xbd\x61\x81\x14\xbf\x3f\xa3\xe2\xfe\x84\xff\xe6\x5c\x80\xe4\x72\x12\xc4\x9e\x47\xbb\x3a\xaa\x86\x89\x46\x2f\x21\xd5\x18\x80\xd9\x7c\xb4\x45\xd3", 136);
break;
case 11:
memcpy((void*)0x200000c0, "\xc4\xa1\x84\x58\x2c\xaa\x26\x44\x0f\xae\x04\xc4\x41\x0f\x74\xab\x00\x00\x01\x00\xc4\x23\xf5\x78\x4c\xe9\x9d\x40\x44\xdf\x34\x59\x26\x41\x0f\xae\x41\x01\x64\x64\x66\x44\x0f\xe5\xb9\x4e\x9a\xb0\xc4\xc4\x22\x7d\x47\x0f\x41\x0f\x45\x7f\x56\x66\x0f\xdd\xe8", 63);
syz_execute_func(0x200000c0);
break;
case 12:
break;
case 13:
memcpy((void*)0x20000140, "\x64\xd3\x2f\x16\xeb\xd8\x17\xd0\x04\xdc\xb8\x01\x71\x82\x05\xbc\xa1\xd8\x6d\xad\x3c\xb1\x32\xa2\x86\x60\x92\x14\xb7\x39\x5a\x97\xa0\xe8\xfe\xda\x5f\xad\x02\xcc\xe9\xde\xea\x94\xd5\x5a\x75\x0c\x17\xb2\x34\x07\x50\x02\xb9\xdf\x62\x9f\xa6\x8e\x3f\x7d\xa9\x7e\x9c\x2a\x2e\x0a\x95\xd1\x5d\x35\x95\x61\xb1\x47\x74\x40\x34\x2c\xd7\x9c\x7c\xeb\xd6\xbf\x00\x8a\xcd\x1c\x7f\xf1\x46\xa6\xfe\x22\x01\x36\x61\xd8\xc8\xce\x8e\xb1\x7f\x5c\xf3\x89\x2a\xe0\x8b\xba\x46\x54\x5b\x2b\x69\x0a\xb7\xe0\x36\x8a\xec\x4d\x32\xb7\x6d\x7f\xc1\x5d\xd7\xc2\xab\xa1\x84\xd4\x1a\x5e\x5a\xbb\x8d\x71\x6f\x5e\x64\x5e\x17\x67\x13\x8e\xd7\x38\xf3\x15\x79\x5a\xc9\x9e\x22\xfd\x44\xdb\x06\x09\x63\x13\xf4\x72\x9c\xe0\xd3\xbd\x93\x8f\x5b\x65\x20\xef\x93\x76\xfa\x90\x9d\xf6\xb2\x05\xc2\xd3\xf5\x2e\xe4\x3e\x3f\x59\xea\x44\x1b\x7c\x4e\x4d\x5c", 201);
memcpy((void*)0x20000240, "\xc1\xb0\x1d\x40\x73\x99\x35\xb1\x21\x7d\x0e\x39\x3c\xdd\x4f\xa4\xef\x8b\xbd\x99\x57\xee\x99\x68\x77\xe4\xca\x15\x5c\x19\x5d\xc1\x66\xf9\x48\x6a\xc4\xdb\x17\xf7\x54\xc4\x89\x38\xa4\x34\x19\xf0\x82\xa8\xc3\x0e\xff\xbe\xf0\x64\xf6\xc8\xb8\x7b\xc9\x30\xe4\x39\xc7\x19\xec\x0a\x11\x99\x04\x0b\x86\x28\x6d\x27\x1f\x25\xaf\x26\xeb\xed\x3f\x55\xc3\x2e\x68\xac\x70\x33\x0d\xf7\x69\x31\xbf\x55\xfa\xe8\x80\x25\x6b\x74\xa9\x23\xf8\xa3\x02\x2c\x31\x0f\x94\xcc\x0c\x62\x33\x02\xa5\xd1\x4b\x3f\x8e\x18\xf4\x15\x99\x88\x28\x66\xea\x02\x42\x86\x4b\x37\xd5\xae\x87\xfb\xcb\x74\x5c\x3e\x26\x42\x3d\x05\xc5\x48\x38\x33\xdf\xcd\xd4\x3d\xc0\xc6\x50\x73\x29\x03\x72\x73\xde\x28\x2e\x3a\x16\xac\x00\xc5\x53\x9c\x30\x94\x63\x98\x4b\x15\x3e\xc6\x25\x0a\x78\x19\x75\xa2\x77\x01\x72\x80\xdb\x1e\x9c\x18\xce\x66\x4d\xf5\x94\x7c\x6c\x18\xbe\xf2\x36\x7e\x61\x63\xb4\x6b\x95\x03\xf7\x00\x70\x5f\xd0\xe8\x9e\xae\x6d\xf0\x88\x4b\xf2\x7c\x00\xe0\x5f\xc5\xef\xc6\x49\x07", 234);
syz_usb_connect(0, 0xc9, 0x20000140, 0x20000240);
break;
case 14:
memcpy((void*)0x20000340, "\x36\x4f\xb1\xa4\x17\x26\x3d\xe2\x27\x97\xec\x76\x08\x61\xf3\x85\x2c\xf2\x4f\x79\xe2\xb7\xa5\xc6\x2a\xfa\xd7\xd6\xd4\xd0\x9d\x86\x2f\x8e\xcc\xd0\x2e\x1b\xb9\x89\xe0\xf8\xa8\xad\x91\x54\x42\x01\x64\x04\xc9\x82\x6a\x5c\x0a\x28\x4f\xc7\xa8\x40\x30\x47\x59\xb6\x84\xf3\x57\xb2\xe6\xfe\xcf\xb3\xcc\x81\x57\xc0\x08\xff\x0d\xcf\xf2\x10\x89\x84\x54\x8a\x2a\xd6\x95\xfa\xd9\x51\x2f\x06\xfd\x12\xd6\x6b\xc4\x43\x04\x75\x12\xab\x4e\xf3\x05\x8a\xe6\xc0\xc6\xec\x3f\xd6\x27\xe3\x70\xa1\x51\xae\x71\x9b\x8e\x3a\x77\xd6\x82\xdc\x06\xa9\x3b\xe9\xc2\xaa\x80\x18\xb5\x8a\x94\x92\xcb\x39\x03\x1b\xb5\xab\xf3\x12\x4e\xaa\xb8\x53\x30\xf1\x81\xfc\xcc\xa7\x59\x7b\x4e\xc0\x87\x9f\xcb\xcf\x51\x14\x3f\x98\xc4\x43\xc1\x67\x20\xa6\xe0\x1b\x7e\x07\xdf\x47\x27\xe2\x88\xe1\x3d\xcc\x0b\x7e\x11", 191);
memcpy((void*)0x20000400, "\x59\x03\x92\x3c\x7a\x1b\x28\x38\xf3\xc1\x21\x56\x78\x5a\x11\xc8\x1b\x2e\x82\xd9\xa1\x19\x0e\x1b\x9c\x45\x97\x6a\x91\x7c\x00\x29\x4d\xc9\x4d\x53\x54\xe8\xc5\xd6\xa4\xe8\x98\x6d\xa0\x74\xeb\x46\x1e\xd0\x73\x6b\xcb\xed\xe2\xce\xf1\xf1\x9e\x02\x16\xc0\x9e\xb7\x94\xd8\xb9\x75\x4f\xea\x26\xf1\x10\xc8\x32\x48\xc2\x86\xea\xa0\x5a\x69\x84\x4e\xb1\x29\x2f\x59\x4f\x59\xf6\xc9\xbe\xca\x47\xd8\x94\xd4\x4d\xfd\x15\xff\x81\xb7\x6b\x46\x35\x39\x2e\xb5\xed\x43\x1c\xa3\x09\x22\x30", 117);
res = syz_usb_connect(4, 0xbf, 0x20000340, 0x20000400);
if (res != -1)
r[6] = res;
break;
case 15:
syz_usb_disconnect(r[6]);
break;
}
}
int main(void)
{
syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 3ul, 0x1012ul, -1, 0ul, 0ul);
use_temporary_dir();
do_sandbox_none();
return 0;
}
<stdin>:187:2: error: unknown type name 'uint8_t_t'
<stdin>:188:2: error: unknown type name 'uint8_t_t'
<stdin>:189:2: error: unknown type name 'uint8_t_t'
<stdin>:190:2: error: unknown type name 'uint8_t_t'
<stdin>:191:2: error: unknown type name 'uint16_t_t'
<stdin>:192:2: error: unknown type name 'uint8_t_t'
<stdin>:193:2: error: unknown type name 'uint8_t_t'
<stdin>:194:2: error: unknown type name 'uint8_t_t'
<stdin>:198:2: error: unknown type name 'uint8_t_t'
<stdin>:199:2: error: unknown type name 'uint8_t_t'
<stdin>:200:2: error: unknown type name 'uint16_t_t'
<stdin>:201:2: error: unknown type name 'uint8_t_t'
<stdin>:202:2: error: unknown type name 'uint8_t_t'
<stdin>:203:2: error: unknown type name 'uint8_t_t'
<stdin>:204:2: error: unknown type name 'uint8_t_t'
<stdin>:205:2: error: unknown type name 'uint16_t_t'
<stdin>:206:2: error: unknown type name 'uint16_t_t'
<stdin>:207:2: error: unknown type name 'uint16_t_t'
<stdin>:208:2: error: unknown type name 'uint8_t_t'
<stdin>:209:2: error: unknown type name 'uint8_t_t'
<stdin>:210:2: error: unknown type name 'uint8_t_t'
<stdin>:211:2: error: unknown type name 'uint8_t_t'
<stdin>:215:2: error: unknown type name 'uint8_t_t'
<stdin>:216:2: error: unknown type name 'uint8_t_t'
<stdin>:217:2: error: unknown type name 'uint16_t_t'
<stdin>:218:2: error: unknown type name 'uint8_t_t'
<stdin>:219:2: error: unknown type name 'uint8_t_t'
<stdin>:220:2: error: unknown type name 'uint8_t_t'
<stdin>:221:2: error: unknown type name 'uint8_t_t'
<stdin>:222:2: error: unknown type name 'uint8_t_t'
<stdin>:226:2: error: unknown type name 'uint8_t_t'
<stdin>:227:2: error: unknown type name 'uint8_t_t'
<stdin>:228:2: error: unknown type name 'uint8_t_t'
<stdin>:229:2: error: unknown type name 'uint8_t_t'
<stdin>:230:2: error: unknown type name 'uint8_t_t'
<stdin>:231:2: error: unknown type name 'uint8_t_t'
<stdin>:232:2: error: unknown type name 'uint8_t_t'
<stdin>:233:2: error: unknown type name 'uint8_t_t'
<stdin>:234:2: error: unknown type name 'uint8_t_t'
<stdin>:238:2: error: unknown type name 'uint8_t_t'
<stdin>:239:2: error: unknown type name 'uint8_t_t'
<stdin>:240:2: error: unknown type name 'uint16_t_t'
<stdin>:241:2: error: unknown type name 'uint16_t_t'
<stdin>:242:2: error: unknown type name 'uint16_t_t'
<stdin>:246:2: error: unknown type name 'uint8_t_t'
<stdin>:247:2: error: unknown type name 'uint8_t_t'
<stdin>:248:2: error: unknown type name 'uint16_t_t'
<stdin>:249:2: error: unknown type name 'uint8_t_t'
<stdin>:250:2: error: unknown type name 'uint8_t_t'
<stdin>:251:2: error: unknown type name 'uint8_t_t'
<stdin>:252:2: error: unknown type name 'uint8_t_t'
<stdin>:253:2: error: unknown type name 'uint8_t_t'
<stdin>:254:2: error: unknown type name 'uint8_t_t'
<stdin>: In function 'vhci_usb_recv':
<stdin>:561:2: error: unknown type name 'uint8_t_t'; did you mean 'uint8_t'?
<stdin>:561:20: error: 'uint8_t_t' undeclared (first use in this function); did you mean 'uint8_t'?
<stdin>:561:20: note: each undeclared identifier is reported only once for each function it appears in
<stdin>:561:30: error: expected expression before ')' token
<stdin>: In function 'vhci_usb_send':
<stdin>:576:2: error: unknown type name 'uint8_t_t'; did you mean 'uint8_t'?
<stdin>:576:20: error: 'uint8_t_t' undeclared (first use in this function); did you mean 'uint8_t'?
<stdin>:576:30: error: expected expression before ')' token
<stdin>: In function 'syz_usb_connect_impl':
<stdin>:637:63: error: unknown type name 'usb_ctrlrequest'
<stdin>:642:55: error: unknown type name 'usb_ctrlrequest'
<stdin>:654:8: error: 'uint32_t_t' undeclared (first use in this function); did you mean 'uint32_t'?
At top level:
<stdin>:702:13: error: 'setup_usb' defined but not used [-Werror=unused-function]
cc1: all warnings being treated as errors
compiler invocation: /syzkaller/netbsd/src/../tools/bin/x86_64--netbsd-g++ [-o /tmp/syz-executor530370355 -DGOOS_netbsd=1 -DGOARCH_amd64=1 -DHOSTGOOS_linux=1 -x c - -m64 --sysroot /syzkaller/netbsd/src/../dest/ -O2 -pthread -Wall -Werror -Wparentheses -Wframe-larger-than=16384]
--- FAIL: TestGenerate/netbsd/amd64/8 (0.76s)
csource_test.go:123: opts: {Threaded:true Collide:false Repeat:true RepeatTimes:0 Procs:0 Sandbox:setuid Fault:false FaultCall:0 FaultNth:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false USB:false UseTmpDir:true HandleSegv:false Repro:false Trace:false}
program:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
writev(r0, &(0x7f00000002c0)=[{&(0x7f0000000000)="25c5f6768692f16a6b02337bc5f24e95c2e574f7bd23da78ff2241439caced122e33ab16d377843415781fa508cd635f2fd04113204ed9bda7396e99a38a2f10e9c7398b5a64c49d98664bd14975be7076a83638a7da3095f0e027bd161ccd5c994f8b31d535a3ce4c57812d9682f3ebb10e05a7142210515b668d1357d91aaabb6ad88aed6b9f2143d062e0b5", 0x8d}, {&(0x7f00000000c0)="e8987e8f864e9d38b55615b659d14cae9e91a9532213ffb465b61b", 0x1b}, {&(0x7f0000000100)="3f97992c940fba8936a6b4", 0xb}, {&(0x7f0000000140)="c99ab604eb2e44ebf7bfb7b04c084321a30f4351aeb0676bb21aefc3bc2322d99a5b034f880aa25d61ae4076397c30357b22ccb779ebd3206ac648fab90836dd4d9e73dc3c077270b57dc3222284dd3cae4737957d947d765a5e0e919cbd3ef2d3d9522a827f3fe60ddc", 0x6a}, {&(0x7f00000001c0)="2bc5a9fd6cc3450082405ab607a0f5627b40589a690ac59158acf10f2a1cc46152fa5f493a8599cc6eaab5d96968bef1a27f62dacf64d06c80cfb5b320b977c9432c446fa6f6551444ee4c5998853260d65d2cb3c778f44fe270363b4eb309e24fc47797b5bd454bf4d3d4656fa078ff56b30f4f0e9d5e6e8943830ad6d342968c224f7c35af01a61d10e155fee7e0227cd79a7977b3f40351ca01834840abba557d36bc8a4208f90dc5f51e3f3d445c5feea79368164edef05d24748ce9f0a58451b43d9891902bc45ec67d00df1deb74e65b29c0d095dbdd5b9a7c", 0xdc}], 0x5)
getgroups(0x3, &(0x7f0000000340)=[0x0, 0xffffffffffffffff, <r1=>0x0])
getsockopt$sock_cred(0xffffffffffffffff, 0xffff, 0x11, &(0x7f0000000380)={0x0, 0x0, <r2=>0x0}, &(0x7f00000003c0)=0xc)
setregid(r1, r2)
r3 = semget(0x1, 0x0, 0xb2603d964b180ce8)
stat(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, <r4=>0x0})
r5 = getgid()
semctl$IPC_SET(r3, 0x0, 0x1, &(0x7f0000000500)={{0xfffff834, r4, r5, 0xffffffffffffffff, 0x0, 0x3, 0x9}, 0xfffffffffffffffd, 0x4535, 0x2})
seteuid(0x0)
syz_emit_ethernet(0x88, &(0x7f0000000000)="bf5bc2c4ddcd9baa7f7c66f91726a8c490f69185140b5b4251e86701c6c5a60d84802d382a0c38df4a28fd840d7e1406a5c2eb5d3b6bc323bd49386c4a924950314fe617f8cd3437a4aa6d1c6d62640309f9de2393999b114768d510d734fd72d198b261bd618114bf3fa3e2fe84ffe65c80e47212c49e47bb3aaa8689462f21d51880d97cb445d3")
syz_execute_func(&(0x7f00000000c0)="c4a184582caa26440fae04c4410f74ab00000100c423f5784ce99d4044df345926410fae4101646466440fe5b94e9ab0c4c4227d470f410f457f56660fdde8")
syz_extract_tcp_res(&(0x7f0000000100), 0x6, 0x1)
syz_usb_connect(0x0, 0xc9, &(0x7f0000000140)="64d32f16ebd817d004dcb801718205bca1d86dad3cb132a286609214b7395a97a0e8feda5fad02cce9deea94d55a750c17b234075002b9df629fa68e3f7da97e9c2a2e0a95d15d359561b1477440342cd79c7cebd6bf008acd1c7ff146a6fe22013661d8c8ce8eb17f5cf3892ae08bba46545b2b690ab7e0368aec4d32b76d7fc15dd7c2aba184d41a5e5abb8d716f5e645e1767138ed738f315795ac99e22fd44db06096313f4729ce0d3bd938f5b6520ef9376fa909df6b205c2d3f52ee43e3f59ea441b7c4e4d5c", &(0x7f0000000240)="c1b01d40739935b1217d0e393cdd4fa4ef8bbd9957ee996877e4ca155c195dc166f9486ac4db17f754c48938a43419f082a8c30effbef064f6c8b87bc930e439c719ec0a1199040b86286d271f25af26ebed3f55c32e68ac70330df76931bf55fae880256b74a923f8a3022c310f94cc0c623302a5d14b3f8e18f41599882866ea0242864b37d5ae87fbcb745c3e26423d05c5483833dfcdd43dc0c6507329037273de282e3a16ac00c5539c309463984b153ec6250a781975a277017280db1e9c18ce664df5947c6c18bef2367e6163b46b9503f700705fd0e89eae6df0884bf27c00e05fc5efc64907")
r6 = syz_usb_connect(0x4, 0xbf, &(0x7f0000000340)="364fb1a417263de22797ec760861f3852cf24f79e2b7a5c62afad7d6d4d09d862f8eccd02e1bb989e0f8a8ad915442016404c9826a5c0a284fc7a840304759b684f357b2e6fecfb3cc8157c008ff0dcff2108984548a2ad695fad9512f06fd12d66bc443047512ab4ef3058ae6c0c6ec3fd627e370a151ae719b8e3a77d682dc06a93be9c2aa8018b58a9492cb39031bb5abf3124eaab85330f181fccca7597b4ec0879fcbcf51143f98c443c16720a6e01b7e07df4727e288e13dcc0b7e11", &(0x7f0000000400)="5903923c7a1b2838f3c12156785a11c81b2e82d9a1190e1b9c45976a917c00294dc94d5354e8c5d6a4e8986da074eb461ed0736bcbede2cef1f19e0216c09eb794d8b9754fea26f110c83248c286eaa05a69844eb1292f594f59f6c9beca47d894d44dfd15ff81b76b4635392eb5ed431ca3092230")
syz_usb_disconnect(r6)
csource_test.go:124: failed to build program:
// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <dev/usb/usb.h>
#include <dev/usb/usbhid.h>
#include <dev/usb/vhci.h>
#include <dirent.h>
#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <pthread.h>
#include <pwd.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ioctl.h>
#include <sys/resource.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>
static unsigned long long procid;
static void kill_and_wait(int pid, int* status)
{
kill(pid, SIGKILL);
while (waitpid(-1, status, 0) != pid) {
}
}
static void sleep_ms(uint64_t ms)
{
usleep(ms * 1000);
}
static uint64_t current_time_ms(void)
{
struct timespec ts;
if (clock_gettime(CLOCK_MONOTONIC, &ts))
exit(1);
return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}
static void use_temporary_dir(void)
{
char tmpdir_template[] = "./syzkaller.XXXXXX";
char* tmpdir = mkdtemp(tmpdir_template);
if (!tmpdir)
exit(1);
if (chmod(tmpdir, 0777))
exit(1);
if (chdir(tmpdir))
exit(1);
}
static void remove_dir(const char* dir)
{
DIR* dp;
struct dirent* ep;
dp = opendir(dir);
if (dp == NULL)
exit(1);
while ((ep = readdir(dp))) {
if (strcmp(ep->d_name, ".") == 0 || strcmp(ep->d_name, "..") == 0)
continue;
char filename[FILENAME_MAX];
snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name);
struct stat st;
if (lstat(filename, &st))
exit(1);
if (S_ISDIR(st.st_mode)) {
remove_dir(filename);
continue;
}
if (unlink(filename))
exit(1);
}
closedir(dp);
if (rmdir(dir))
exit(1);
}
static void thread_start(void* (*fn)(void*), void* arg)
{
pthread_t th;
pthread_attr_t attr;
pthread_attr_init(&attr);
pthread_attr_setstacksize(&attr, 128 << 10);
int i;
for (i = 0; i < 100; i++) {
if (pthread_create(&th, &attr, fn, arg) == 0) {
pthread_attr_destroy(&attr);
return;
}
if (errno == EAGAIN) {
usleep(50);
continue;
}
break;
}
exit(1);
}
typedef struct {
pthread_mutex_t mu;
pthread_cond_t cv;
int state;
} event_t;
static void event_init(event_t* ev)
{
if (pthread_mutex_init(&ev->mu, 0))
exit(1);
if (pthread_cond_init(&ev->cv, 0))
exit(1);
ev->state = 0;
}
static void event_reset(event_t* ev)
{
ev->state = 0;
}
static void event_set(event_t* ev)
{
pthread_mutex_lock(&ev->mu);
if (ev->state)
exit(1);
ev->state = 1;
pthread_mutex_unlock(&ev->mu);
pthread_cond_broadcast(&ev->cv);
}
static void event_wait(event_t* ev)
{
pthread_mutex_lock(&ev->mu);
while (!ev->state)
pthread_cond_wait(&ev->cv, &ev->mu);
pthread_mutex_unlock(&ev->mu);
}
static int event_isset(event_t* ev)
{
pthread_mutex_lock(&ev->mu);
int res = ev->state;
pthread_mutex_unlock(&ev->mu);
return res;
}
static int event_timedwait(event_t* ev, uint64_t timeout)
{
uint64_t start = current_time_ms();
uint64_t now = start;
pthread_mutex_lock(&ev->mu);
for (;;) {
if (ev->state)
break;
uint64_t remain = timeout - (now - start);
struct timespec ts;
ts.tv_sec = remain / 1000;
ts.tv_nsec = (remain % 1000) * 1000 * 1000;
pthread_cond_timedwait(&ev->cv, &ev->mu, &ts);
now = current_time_ms();
if (now - start > timeout)
break;
}
int res = ev->state;
pthread_mutex_unlock(&ev->mu);
return res;
}
/* -------------------------------------------------------------------------- */
/*
* Redefinitions to match the linux types used in common_usb.h.
*/
struct usb_endpoint_descriptor {
uint8_t_t bLength;
uint8_t_t bDescriptorType;
uint8_t_t bEndpointAddress;
uint8_t_t bmAttributes;
uint16_t_t wMaxPacketSize;
uint8_t_t bInterval;
uint8_t_t bRefresh;
uint8_t_t bSynchAddress;
} __attribute__((packed));
struct usb_device_descriptor {
uint8_t_t bLength;
uint8_t_t bDescriptorType;
uint16_t_t bcdUSB;
uint8_t_t bDeviceClass;
uint8_t_t bDeviceSubClass;
uint8_t_t bDeviceProtocol;
uint8_t_t bMaxPacketSize0;
uint16_t_t idVendor;
uint16_t_t idProduct;
uint16_t_t bcdDevice;
uint8_t_t iManufacturer;
uint8_t_t iProduct;
uint8_t_t iSerialNumber;
uint8_t_t bNumConfigurations;
} __attribute__((packed));
struct usb_config_descriptor {
uint8_t_t bLength;
uint8_t_t bDescriptorType;
uint16_t_t wTotalLength;
uint8_t_t bNumInterfaces;
uint8_t_t bConfigurationValue;
uint8_t_t iConfiguration;
uint8_t_t bmAttributes;
uint8_t_t bMaxPower;
} __attribute__((packed));
struct usb_interface_descriptor {
uint8_t_t bLength;
uint8_t_t bDescriptorType;
uint8_t_t bInterfaceNumber;
uint8_t_t bAlternateSetting;
uint8_t_t bNumEndpoints;
uint8_t_t bInterfaceClass;
uint8_t_t bInterfaceSubClass;
uint8_t_t bInterfaceProtocol;
uint8_t_t iInterface;
} __attribute__((packed));
struct usb_ctrlrequest {
uint8_t_t bRequestType;
uint8_t_t bRequest;
uint16_t_t wValue;
uint16_t_t wIndex;
uint16_t_t wLength;
} __attribute__((packed));
struct usb_qualifier_descriptor {
uint8_t_t bLength;
uint8_t_t bDescriptorType;
uint16_t_t bcdUSB;
uint8_t_t bDeviceClass;
uint8_t_t bDeviceSubClass;
uint8_t_t bDeviceProtocol;
uint8_t_t bMaxPacketSize0;
uint8_t_t bNumConfigurations;
uint8_t_t bRESERVED;
} __attribute__((packed));
#define USB_TYPE_MASK (0x03 << 5)
#define USB_TYPE_STANDARD (0x00 << 5)
#define USB_TYPE_CLASS (0x01 << 5)
#define USB_TYPE_VENDOR (0x02 << 5)
#define USB_TYPE_RESERVED (0x03 << 5)
#define USB_DT_DEVICE 0x01
#define USB_DT_CONFIG 0x02
#define USB_DT_STRING 0x03
#define USB_DT_INTERFACE 0x04
#define USB_DT_ENDPOINT 0x05
#define USB_DT_DEVICE_QUALIFIER 0x06
#define USB_DT_OTHER_SPEED_CONFIG 0x07
#define USB_DT_INTERFACE_POWER 0x08
#define USB_DT_OTG 0x09
#define USB_DT_DEBUG 0x0a
#define USB_DT_INTERFACE_ASSOCIATION 0x0b
#define USB_DT_SECURITY 0x0c
#define USB_DT_KEY 0x0d
#define USB_DT_ENCRYPTION_TYPE 0x0e
#define USB_DT_BOS 0x0f
#define USB_DT_DEVICE_CAPABILITY 0x10
#define USB_DT_WIRELESS_ENDPOINT_COMP 0x11
#define USB_DT_WIRE_ADAPTER 0x21
#define USB_DT_RPIPE 0x22
#define USB_DT_CS_RADIO_CONTROL 0x23
#define USB_DT_PIPE_USAGE 0x24
#define USB_DT_SS_ENDPOINT_COMP 0x30
#define USB_DT_SSP_ISOC_ENDPOINT_COMP 0x31
#define USB_REQ_GET_STATUS 0x00
#define USB_REQ_CLEAR_FEATURE 0x01
#define USB_REQ_SET_FEATURE 0x03
#define USB_REQ_SET_ADDRESS 0x05
#define USB_REQ_GET_DESCRIPTOR 0x06
#define USB_REQ_SET_DESCRIPTOR 0x07
#define USB_REQ_GET_CONFIGURATION 0x08
#define USB_REQ_SET_CONFIGURATION 0x09
#define USB_REQ_GET_INTERFACE 0x0A
#define USB_REQ_SET_INTERFACE 0x0B
#define USB_REQ_SYNCH_FRAME 0x0C
#define USB_REQ_SET_SEL 0x30
#define USB_REQ_SET_ISOCH_DELAY 0x31
#define USB_REQ_SET_ENCRYPTION 0x0D
#define USB_REQ_GET_ENCRYPTION 0x0E
#define USB_REQ_RPIPE_ABORT 0x0E
#define USB_REQ_SET_HANDSHAKE 0x0F
#define USB_REQ_RPIPE_RESET 0x0F
#define USB_REQ_GET_HANDSHAKE 0x10
#define USB_REQ_SET_CONNECTION 0x11
#define USB_REQ_SET_SECURITY_DATA 0x12
#define USB_REQ_GET_SECURITY_DATA 0x13
#define USB_REQ_SET_WUSB_DATA 0x14
#define USB_REQ_LOOPBACK_DATA_WRITE 0x15
#define USB_REQ_LOOPBACK_DATA_READ 0x16
#define USB_REQ_SET_INTERFACE_DS 0x17
#define USB_REQ_GET_PARTNER_PDO 20
#define USB_REQ_GET_BATTERY_STATUS 21
#define USB_REQ_SET_PDO 22
#define USB_REQ_GET_VDM 23
#define USB_REQ_SEND_VDM 24
#define USB_MAX_IFACE_NUM 4
#define USB_MAX_EP_NUM 32
#define USB_MAX_FDS 6
struct usb_endpoint_index {
struct usb_endpoint_descriptor desc;
int handle;
};
struct usb_iface_index {
struct usb_interface_descriptor* iface;
uint8_t bInterfaceNumber;
uint8_t bAlternateSetting;
uint8_t bInterfaceClass;
struct usb_endpoint_index eps[USB_MAX_EP_NUM];
int eps_num;
};
struct usb_device_index {
struct usb_device_descriptor* dev;
struct usb_config_descriptor* config;
uint8_t bDeviceClass;
uint8_t bMaxPower;
int config_length;
struct usb_iface_index ifaces[USB_MAX_IFACE_NUM];
int ifaces_num;
int iface_cur;
};
struct usb_info {
int fd;
struct usb_device_index index;
};
static struct usb_info usb_devices[USB_MAX_FDS];
static int usb_devices_num;
static bool parse_usb_descriptor(const char* buffer, size_t length, struct usb_device_index* index)
{
if (length < sizeof(*index->dev) + sizeof(*index->config))
return false;
memset(index, 0, sizeof(*index));
index->dev = (struct usb_device_descriptor*)buffer;
index->config = (struct usb_config_descriptor*)(buffer + sizeof(*index->dev));
index->bDeviceClass = index->dev->bDeviceClass;
index->bMaxPower = index->config->bMaxPower;
index->config_length = length - sizeof(*index->dev);
index->iface_cur = -1;
size_t offset = 0;
while (true) {
if (offset + 1 >= length)
break;
uint8_t desc_length = buffer[offset];
uint8_t desc_type = buffer[offset + 1];
if (desc_length <= 2)
break;
if (offset + desc_length > length)
break;
if (desc_type == USB_DT_INTERFACE && index->ifaces_num < USB_MAX_IFACE_NUM) {
struct usb_interface_descriptor* iface = (struct usb_interface_descriptor*)(buffer + offset);
index->ifaces[index->ifaces_num].iface = iface;
index->ifaces[index->ifaces_num].bInterfaceNumber = iface->bInterfaceNumber;
index->ifaces[index->ifaces_num].bAlternateSetting = iface->bAlternateSetting;
index->ifaces[index->ifaces_num].bInterfaceClass = iface->bInterfaceClass;
index->ifaces_num++;
}
if (desc_type == USB_DT_ENDPOINT && index->ifaces_num > 0) {
struct usb_iface_index* iface = &index->ifaces[index->ifaces_num - 1];
if (iface->eps_num < USB_MAX_EP_NUM) {
memcpy(&iface->eps[iface->eps_num].desc, buffer + offset, sizeof(iface->eps[iface->eps_num].desc));
iface->eps_num++;
}
}
offset += desc_length;
}
return true;
}
static struct usb_device_index* add_usb_index(int fd, const char* dev, size_t dev_len)
{
int i = __atomic_fetch_add(&usb_devices_num, 1, __ATOMIC_RELAXED);
if (i >= USB_MAX_FDS)
return NULL;
int rv = 0;
rv = parse_usb_descriptor(dev, dev_len, &usb_devices[i].index);
if (!rv)
return NULL;
__atomic_store_n(&usb_devices[i].fd, fd, __ATOMIC_RELEASE);
return &usb_devices[i].index;
}
static struct usb_device_index* lookup_usb_index(int fd)
{
int i;
for (i = 0; i < USB_MAX_FDS; i++) {
if (__atomic_load_n(&usb_devices[i].fd, __ATOMIC_ACQUIRE) == fd) {
return &usb_devices[i].index;
}
}
return NULL;
}
struct vusb_connect_string_descriptor {
uint32_t len;
char* str;
} __attribute__((packed));
struct vusb_connect_descriptors {
uint32_t qual_len;
char* qual;
uint32_t bos_len;
char* bos;
uint32_t strs_len;
struct vusb_connect_string_descriptor strs[0];
} __attribute__((packed));
static const char default_string[] = {
8, USB_DT_STRING,
's', 0, 'y', 0, 'z', 0
};
static const char default_lang_id[] = {
4, USB_DT_STRING,
0x09, 0x04
};
static bool lookup_connect_response_in(int fd, const struct vusb_connect_descriptors* descs,
const struct usb_ctrlrequest* ctrl,
char** response_data, uint32_t* response_length)
{
struct usb_device_index* index = lookup_usb_index(fd);
uint8_t str_idx;
if (!index)
return false;
switch (ctrl->bRequestType & USB_TYPE_MASK) {
case USB_TYPE_STANDARD:
switch (ctrl->bRequest) {
case USB_REQ_GET_DESCRIPTOR:
switch (ctrl->wValue >> 8) {
case USB_DT_DEVICE:
*response_data = (char*)index->dev;
*response_length = sizeof(*index->dev);
return true;
case USB_DT_CONFIG:
*response_data = (char*)index->config;
*response_length = index->config_length;
return true;
case USB_DT_STRING:
str_idx = (uint8_t)ctrl->wValue;
if (descs && str_idx < descs->strs_len) {
*response_data = descs->strs[str_idx].str;
*response_length = descs->strs[str_idx].len;
return true;
}
if (str_idx == 0) {
*response_data = (char*)&default_lang_id[0];
*response_length = default_lang_id[0];
return true;
}
*response_data = (char*)&default_string[0];
*response_length = default_string[0];
return true;
case USB_DT_BOS:
*response_data = descs->bos;
*response_length = descs->bos_len;
return true;
case USB_DT_DEVICE_QUALIFIER:
if (!descs->qual) {
struct usb_qualifier_descriptor* qual =
(struct usb_qualifier_descriptor*)response_data;
qual->bLength = sizeof(*qual);
qual->bDescriptorType = USB_DT_DEVICE_QUALIFIER;
qual->bcdUSB = index->dev->bcdUSB;
qual->bDeviceClass = index->dev->bDeviceClass;
qual->bDeviceSubClass = index->dev->bDeviceSubClass;
qual->bDeviceProtocol = index->dev->bDeviceProtocol;
qual->bMaxPacketSize0 = index->dev->bMaxPacketSize0;
qual->bNumConfigurations = index->dev->bNumConfigurations;
qual->bRESERVED = 0;
*response_length = sizeof(*qual);
return true;
}
*response_data = descs->qual;
*response_length = descs->qual_len;
return true;
default:
break;
}
break;
default:
break;
}
break;
default:
break;
}
return false;
}
typedef bool (*lookup_connect_out_response_t)(int fd, const struct vusb_connect_descriptors* descs,
const struct usb_ctrlrequest* ctrl, bool* done);
static bool lookup_connect_response_out_generic(int fd, const struct vusb_connect_descriptors* descs,
const struct usb_ctrlrequest* ctrl, bool* done)
{
switch (ctrl->bRequestType & USB_TYPE_MASK) {
case USB_TYPE_STANDARD:
switch (ctrl->bRequest) {
case USB_REQ_SET_CONFIGURATION:
*done = true;
return true;
default:
break;
}
break;
}
return false;
}
/* -------------------------------------------------------------------------- */
static int vhci_open(void)
{
return open("/dev/vhci", O_RDWR);
}
static int vhci_setport(int fd, u_int port)
{
struct vhci_ioc_set_port args;
args.port = port;
return ioctl(fd, VHCI_IOC_SET_PORT, &args);
}
static int vhci_usb_attach(int fd)
{
return ioctl(fd, VHCI_IOC_USB_ATTACH, NULL);
}
static int vhci_usb_recv(int fd, void* buf, size_t size)
{
uint8_t_t* ptr = (uint8_t_t*)buf;
ssize_t done;
while (1) {
done = read(fd, ptr, size);
if (done < 0)
return -1;
if ((size_t)done == size)
return 0;
size -= done;
ptr += done;
}
}
static int vhci_usb_send(int fd, void* buf, size_t size)
{
uint8_t_t* ptr = (uint8_t_t*)buf;
ssize_t done;
while (1) {
done = write(fd, ptr, size);
if (done <= 0)
return -1;
if ((size_t)done == size)
return 0;
size -= done;
ptr += done;
}
}
/* -------------------------------------------------------------------------- */
static volatile long syz_usb_connect_impl(uint64_t speed, uint64_t dev_len,
const char* dev, const struct vusb_connect_descriptors* descs,
lookup_connect_out_response_t lookup_connect_response_out)
{
struct usb_device_index* index;
int portnum, fd, rv;
bool done;
portnum = procid + 1;
if (!dev) {
return -1;
}
if (portnum != 1) {
/* For now, we support only one proc. */
return -1;
}
fd = vhci_open();
if (fd < 0) {
return -1;
}
index = add_usb_index(fd, dev, dev_len);
if (!index) {
goto err;
}
rv = vhci_setport(fd, portnum);
if (rv != 0) {
goto err;
}
rv = vhci_usb_attach(fd);
if (rv != 0) {
goto err;
}
done = false;
while (!done) {
vhci_request_t req;
rv = vhci_usb_recv(fd, &req, sizeof(req));
if (rv != 0) {
goto err;
}
if (req.type != VHCI_REQ_CTRL) {
goto err;
}
char* response_data = NULL;
uint32_t response_length = 0;
char data[4096];
if (req.u.ctrl.bmRequestType & UE_DIR_IN) {
bool response_found = false;
response_found = lookup_connect_response_in(fd, descs, (const usb_ctrlrequest*)&req.u.ctrl, &response_data, &response_length);
if (!response_found) {
goto err;
}
} else {
if (!lookup_connect_response_out(fd, descs, (const usb_ctrlrequest*)&req.u.ctrl, &done)) {
goto err;
}
response_data = NULL;
response_length = UGETW(req.u.ctrl.wLength);
}
if ((req.u.ctrl.bmRequestType & USB_TYPE_MASK) == USB_TYPE_STANDARD &&
req.u.ctrl.bRequest == USB_REQ_SET_CONFIGURATION) {
/* TODO: possibly revisit */
}
if (response_length > sizeof(data))
response_length = 0;
if ((uint32_t_t)UGETW(req.u.ctrl.wLength) < response_length)
response_length = UGETW(req.u.ctrl.wLength);
if (response_data)
memcpy(data, response_data, response_length);
else
memset(data, 0, response_length);
if (req.u.ctrl.bmRequestType & UE_DIR_IN) {
if (response_length > 0) {
vhci_response_t res;
res.size = response_length;
rv = vhci_usb_send(fd, &res, sizeof(res));
if (rv == 0)
rv = vhci_usb_send(fd, data, response_length);
}
} else {
rv = vhci_usb_recv(fd, data, response_length);
}
if (rv < 0) {
goto err;
}
}
sleep_ms(200);
return fd;
err:
close(fd);
return -1;
}
static volatile long syz_usb_connect(volatile long a0, volatile long a1,
volatile long a2, volatile long a3)
{
uint64_t speed = a0;
uint64_t dev_len = a1;
const char* dev = (const char*)a2;
const struct vusb_connect_descriptors* descs = (const struct vusb_connect_descriptors*)a3;
return syz_usb_connect_impl(speed, dev_len, dev, descs,
&lookup_connect_response_out_generic);
}
static volatile long syz_usb_disconnect(volatile long a0)
{
int fd = a0;
int rv = close(fd);
sleep_ms(200);
return rv;
}
static void setup_usb(void)
{
if (chmod("/dev/vhci", 0666))
exit(1);
}
static void sandbox_common()
{
if (setsid() == -1)
exit(1);
struct rlimit rlim;
rlim.rlim_cur = rlim.rlim_max = 8 << 20;
setrlimit(RLIMIT_MEMLOCK, &rlim);
rlim.rlim_cur = rlim.rlim_max = 1 << 20;
setrlimit(RLIMIT_FSIZE, &rlim);
rlim.rlim_cur = rlim.rlim_max = 1 << 20;
setrlimit(RLIMIT_STACK, &rlim);
rlim.rlim_cur = rlim.rlim_max = 0;
setrlimit(RLIMIT_CORE, &rlim);
rlim.rlim_cur = rlim.rlim_max = 256;
setrlimit(RLIMIT_NOFILE, &rlim);
}
static void loop();
static int wait_for_loop(int pid)
{
if (pid < 0)
exit(1);
int status = 0;
while (waitpid(-1, &status, WUNTRACED) != pid) {
}
return WEXITSTATUS(status);
}
static int do_sandbox_setuid(void)
{
int pid = fork();
if (pid != 0)
return wait_for_loop(pid);
sandbox_common();
char pwbuf[1024];
struct passwd *pw, pwres;
if (getpwnam_r("nobody", &pwres, pwbuf, sizeof(pwbuf), &pw) != 0 || !pw)
exit(1);
if (setgroups(0, NULL))
exit(1);
if (setgid(pw->pw_gid))
exit(1);
if (setuid(pw->pw_uid))
exit(1);
loop();
exit(1);
}
static long syz_execute_func(volatile long text)
{
volatile long p[8] = {0};
(void)p;
asm volatile("" ::"r"(0l), "r"(1l), "r"(2l), "r"(3l), "r"(4l), "r"(5l), "r"(6l),
"r"(7l), "r"(8l), "r"(9l), "r"(10l), "r"(11l), "r"(12l), "r"(13l));
((void (*)(void))(text))();
return 0;
}
struct thread_t {
int created, call;
event_t ready, done;
};
static struct thread_t threads[16];
static void execute_call(int call);
static int running;
static void* thr(void* arg)
{
struct thread_t* th = (struct thread_t*)arg;
for (;;) {
event_wait(&th->ready);
event_reset(&th->ready);
execute_call(th->call);
__atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED);
event_set(&th->done);
}
return 0;
}
static void execute_one(void)
{
int i, call, thread;
for (call = 0; call < 16; call++) {
for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0])); thread++) {
struct thread_t* th = &threads[thread];
if (!th->created) {
th->created = 1;
event_init(&th->ready);
event_init(&th->done);
event_set(&th->done);
thread_start(thr, th);
}
if (!event_isset(&th->done))
continue;
event_reset(&th->done);
th->call = call;
__atomic_fetch_add(&running, 1, __ATOMIC_RELAXED);
event_set(&th->ready);
event_timedwait(&th->done, 45 + (call == 13 ? 3000 : 0) + (call == 14 ? 3000 : 0) + (call == 15 ? 300 : 0));
break;
}
}
for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++)
sleep_ms(1);
}
static void execute_one(void);
#define WAIT_FLAGS 0
static void loop(void)
{
int iter;
for (iter = 0;; iter++) {
char cwdbuf[32];
sprintf(cwdbuf, "./%d", iter);
if (mkdir(cwdbuf, 0777))
exit(1);
int pid = fork();
if (pid < 0)
exit(1);
if (pid == 0) {
if (chdir(cwdbuf))
exit(1);
execute_one();
exit(0);
}
int status = 0;
uint64_t start = current_time_ms();
for (;;) {
if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
break;
sleep_ms(1);
if (current_time_ms() - start < 5 * 1000)
continue;
kill_and_wait(pid, &status);
break;
}
remove_dir(cwdbuf);
}
}
#ifndef SYS_dup2
#define SYS_dup2 90
#endif
#ifndef SYS_getgid
#define SYS_getgid 47
#endif
#ifndef SYS_getgroups
#define SYS_getgroups 79
#endif
#ifndef SYS_getsockopt
#define SYS_getsockopt 118
#endif
#ifndef SYS_mmap
#define SYS_mmap 197
#endif
#ifndef SYS_semctl
#define SYS_semctl 442
#endif
#ifndef SYS_semget
#define SYS_semget 221
#endif
#ifndef SYS_seteuid
#define SYS_seteuid 183
#endif
#ifndef SYS_setregid
#define SYS_setregid 127
#endif
#ifndef SYS_stat
#define SYS_stat 439
#endif
#ifndef SYS_writev
#define SYS_writev 121
#endif
uint64_t r[7] = {0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff};
void execute_call(int call)
{
intptr_t res = 0;
switch (call) {
case 0:
res = syscall(SYS_dup2, -1, 0xffffff9c);
if (res != -1)
r[0] = res;
break;
case 1:
*(uint64_t*)0x200002c0 = 0x20000000;
memcpy((void*)0x20000000, "\x25\xc5\xf6\x76\x86\x92\xf1\x6a\x6b\x02\x33\x7b\xc5\xf2\x4e\x95\xc2\xe5\x74\xf7\xbd\x23\xda\x78\xff\x22\x41\x43\x9c\xac\xed\x12\x2e\x33\xab\x16\xd3\x77\x84\x34\x15\x78\x1f\xa5\x08\xcd\x63\x5f\x2f\xd0\x41\x13\x20\x4e\xd9\xbd\xa7\x39\x6e\x99\xa3\x8a\x2f\x10\xe9\xc7\x39\x8b\x5a\x64\xc4\x9d\x98\x66\x4b\xd1\x49\x75\xbe\x70\x76\xa8\x36\x38\xa7\xda\x30\x95\xf0\xe0\x27\xbd\x16\x1c\xcd\x5c\x99\x4f\x8b\x31\xd5\x35\xa3\xce\x4c\x57\x81\x2d\x96\x82\xf3\xeb\xb1\x0e\x05\xa7\x14\x22\x10\x51\x5b\x66\x8d\x13\x57\xd9\x1a\xaa\xbb\x6a\xd8\x8a\xed\x6b\x9f\x21\x43\xd0\x62\xe0\xb5", 141);
*(uint64_t*)0x200002c8 = 0x8d;
*(uint64_t*)0x200002d0 = 0x200000c0;
memcpy((void*)0x200000c0, "\xe8\x98\x7e\x8f\x86\x4e\x9d\x38\xb5\x56\x15\xb6\x59\xd1\x4c\xae\x9e\x91\xa9\x53\x22\x13\xff\xb4\x65\xb6\x1b", 27);
*(uint64_t*)0x200002d8 = 0x1b;
*(uint64_t*)0x200002e0 = 0x20000100;
memcpy((void*)0x20000100, "\x3f\x97\x99\x2c\x94\x0f\xba\x89\x36\xa6\xb4", 11);
*(uint64_t*)0x200002e8 = 0xb;
*(uint64_t*)0x200002f0 = 0x20000140;
memcpy((void*)0x20000140, "\xc9\x9a\xb6\x04\xeb\x2e\x44\xeb\xf7\xbf\xb7\xb0\x4c\x08\x43\x21\xa3\x0f\x43\x51\xae\xb0\x67\x6b\xb2\x1a\xef\xc3\xbc\x23\x22\xd9\x9a\x5b\x03\x4f\x88\x0a\xa2\x5d\x61\xae\x40\x76\x39\x7c\x30\x35\x7b\x22\xcc\xb7\x79\xeb\xd3\x20\x6a\xc6\x48\xfa\xb9\x08\x36\xdd\x4d\x9e\x73\xdc\x3c\x07\x72\x70\xb5\x7d\xc3\x22\x22\x84\xdd\x3c\xae\x47\x37\x95\x7d\x94\x7d\x76\x5a\x5e\x0e\x91\x9c\xbd\x3e\xf2\xd3\xd9\x52\x2a\x82\x7f\x3f\xe6\x0d\xdc", 106);
*(uint64_t*)0x200002f8 = 0x6a;
*(uint64_t*)0x20000300 = 0x200001c0;
memcpy((void*)0x200001c0, "\x2b\xc5\xa9\xfd\x6c\xc3\x45\x00\x82\x40\x5a\xb6\x07\xa0\xf5\x62\x7b\x40\x58\x9a\x69\x0a\xc5\x91\x58\xac\xf1\x0f\x2a\x1c\xc4\x61\x52\xfa\x5f\x49\x3a\x85\x99\xcc\x6e\xaa\xb5\xd9\x69\x68\xbe\xf1\xa2\x7f\x62\xda\xcf\x64\xd0\x6c\x80\xcf\xb5\xb3\x20\xb9\x77\xc9\x43\x2c\x44\x6f\xa6\xf6\x55\x14\x44\xee\x4c\x59\x98\x85\x32\x60\xd6\x5d\x2c\xb3\xc7\x78\xf4\x4f\xe2\x70\x36\x3b\x4e\xb3\x09\xe2\x4f\xc4\x77\x97\xb5\xbd\x45\x4b\xf4\xd3\xd4\x65\x6f\xa0\x78\xff\x56\xb3\x0f\x4f\x0e\x9d\x5e\x6e\x89\x43\x83\x0a\xd6\xd3\x42\x96\x8c\x22\x4f\x7c\x35\xaf\x01\xa6\x1d\x10\xe1\x55\xfe\xe7\xe0\x22\x7c\xd7\x9a\x79\x77\xb3\xf4\x03\x51\xca\x01\x83\x48\x40\xab\xba\x55\x7d\x36\xbc\x8a\x42\x08\xf9\x0d\xc5\xf5\x1e\x3f\x3d\x44\x5c\x5f\xee\xa7\x93\x68\x16\x4e\xde\xf0\x5d\x24\x74\x8c\xe9\xf0\xa5\x84\x51\xb4\x3d\x98\x91\x90\x2b\xc4\x5e\xc6\x7d\x00\xdf\x1d\xeb\x74\xe6\x5b\x29\xc0\xd0\x95\xdb\xdd\x5b\x9a\x7c", 220);
*(uint64_t*)0x20000308 = 0xdc;
syscall(SYS_writev, r[0], 0x200002c0ul, 5ul);
break;
case 2:
*(uint32_t*)0x20000340 = 0;
*(uint32_t*)0x20000344 = -1;
*(uint32_t*)0x20000348 = 0;
res = syscall(SYS_getgroups, 3ul, 0x20000340ul);
if (res != -1)
r[1] = *(uint32_t*)0x20000348;
break;
case 3:
*(uint32_t*)0x200003c0 = 0xc;
res = syscall(SYS_getsockopt, -1, 0xffff, 0x11, 0x20000380ul, 0x200003c0ul);
if (res != -1)
r[2] = *(uint32_t*)0x20000388;
break;
case 4:
syscall(SYS_setregid, r[1], r[2]);
break;
case 5:
res = syscall(SYS_semget, 0x798e2634ul, 0ul, 0xb2603d964b180ce8ul);
if (res != -1)
r[3] = res;
break;
case 6:
memcpy((void*)0x20000400, "./file0\000", 8);
res = syscall(SYS_stat, 0x20000400ul, 0x20000440ul);
if (res != -1)
r[4] = *(uint32_t*)0x2000045c;
break;
case 7:
res = syscall(SYS_getgid);
if (res != -1)
r[5] = res;
break;
case 8:
*(uint32_t*)0x20000500 = 0xfffff834;
*(uint32_t*)0x20000504 = r[4];
*(uint32_t*)0x20000508 = r[5];
*(uint32_t*)0x2000050c = -1;
*(uint32_t*)0x20000510 = 0;
*(uint32_t*)0x20000514 = 3;
*(uint16_t*)0x20000518 = 9;
*(uint16_t*)0x2000051a = 0;
*(uint64_t*)0x20000520 = 0;
*(uint64_t*)0x20000528 = 0;
*(uint64_t*)0x20000530 = 0xfffffffffffffffd;
*(uint64_t*)0x20000538 = 0x4535;
*(uint64_t*)0x20000540 = 2;
*(uint64_t*)0x20000548 = 0;
*(uint64_t*)0x20000550 = 0;
syscall(SYS_semctl, r[3], 0ul, 1ul, 0x20000500ul);
break;
case 9:
syscall(SYS_seteuid, 0);
break;
case 10:
memcpy((void*)0x20000000, "\xbf\x5b\xc2\xc4\xdd\xcd\x9b\xaa\x7f\x7c\x66\xf9\x17\x26\xa8\xc4\x90\xf6\x91\x85\x14\x0b\x5b\x42\x51\xe8\x67\x01\xc6\xc5\xa6\x0d\x84\x80\x2d\x38\x2a\x0c\x38\xdf\x4a\x28\xfd\x84\x0d\x7e\x14\x06\xa5\xc2\xeb\x5d\x3b\x6b\xc3\x23\xbd\x49\x38\x6c\x4a\x92\x49\x50\x31\x4f\xe6\x17\xf8\xcd\x34\x37\xa4\xaa\x6d\x1c\x6d\x62\x64\x03\x09\xf9\xde\x23\x93\x99\x9b\x11\x47\x68\xd5\x10\xd7\x34\xfd\x72\xd1\x98\xb2\x61\xbd\x61\x81\x14\xbf\x3f\xa3\xe2\xfe\x84\xff\xe6\x5c\x80\xe4\x72\x12\xc4\x9e\x47\xbb\x3a\xaa\x86\x89\x46\x2f\x21\xd5\x18\x80\xd9\x7c\xb4\x45\xd3", 136);
break;
case 11:
memcpy((void*)0x200000c0, "\xc4\xa1\x84\x58\x2c\xaa\x26\x44\x0f\xae\x04\xc4\x41\x0f\x74\xab\x00\x00\x01\x00\xc4\x23\xf5\x78\x4c\xe9\x9d\x40\x44\xdf\x34\x59\x26\x41\x0f\xae\x41\x01\x64\x64\x66\x44\x0f\xe5\xb9\x4e\x9a\xb0\xc4\xc4\x22\x7d\x47\x0f\x41\x0f\x45\x7f\x56\x66\x0f\xdd\xe8", 63);
syz_execute_func(0x200000c0);
break;
case 12:
break;
case 13:
memcpy((void*)0x20000140, "\x64\xd3\x2f\x16\xeb\xd8\x17\xd0\x04\xdc\xb8\x01\x71\x82\x05\xbc\xa1\xd8\x6d\xad\x3c\xb1\x32\xa2\x86\x60\x92\x14\xb7\x39\x5a\x97\xa0\xe8\xfe\xda\x5f\xad\x02\xcc\xe9\xde\xea\x94\xd5\x5a\x75\x0c\x17\xb2\x34\x07\x50\x02\xb9\xdf\x62\x9f\xa6\x8e\x3f\x7d\xa9\x7e\x9c\x2a\x2e\x0a\x95\xd1\x5d\x35\x95\x61\xb1\x47\x74\x40\x34\x2c\xd7\x9c\x7c\xeb\xd6\xbf\x00\x8a\xcd\x1c\x7f\xf1\x46\xa6\xfe\x22\x01\x36\x61\xd8\xc8\xce\x8e\xb1\x7f\x5c\xf3\x89\x2a\xe0\x8b\xba\x46\x54\x5b\x2b\x69\x0a\xb7\xe0\x36\x8a\xec\x4d\x32\xb7\x6d\x7f\xc1\x5d\xd7\xc2\xab\xa1\x84\xd4\x1a\x5e\x5a\xbb\x8d\x71\x6f\x5e\x64\x5e\x17\x67\x13\x8e\xd7\x38\xf3\x15\x79\x5a\xc9\x9e\x22\xfd\x44\xdb\x06\x09\x63\x13\xf4\x72\x9c\xe0\xd3\xbd\x93\x8f\x5b\x65\x20\xef\x93\x76\xfa\x90\x9d\xf6\xb2\x05\xc2\xd3\xf5\x2e\xe4\x3e\x3f\x59\xea\x44\x1b\x7c\x4e\x4d\x5c", 201);
memcpy((void*)0x20000240, "\xc1\xb0\x1d\x40\x73\x99\x35\xb1\x21\x7d\x0e\x39\x3c\xdd\x4f\xa4\xef\x8b\xbd\x99\x57\xee\x99\x68\x77\xe4\xca\x15\x5c\x19\x5d\xc1\x66\xf9\x48\x6a\xc4\xdb\x17\xf7\x54\xc4\x89\x38\xa4\x34\x19\xf0\x82\xa8\xc3\x0e\xff\xbe\xf0\x64\xf6\xc8\xb8\x7b\xc9\x30\xe4\x39\xc7\x19\xec\x0a\x11\x99\x04\x0b\x86\x28\x6d\x27\x1f\x25\xaf\x26\xeb\xed\x3f\x55\xc3\x2e\x68\xac\x70\x33\x0d\xf7\x69\x31\xbf\x55\xfa\xe8\x80\x25\x6b\x74\xa9\x23\xf8\xa3\x02\x2c\x31\x0f\x94\xcc\x0c\x62\x33\x02\xa5\xd1\x4b\x3f\x8e\x18\xf4\x15\x99\x88\x28\x66\xea\x02\x42\x86\x4b\x37\xd5\xae\x87\xfb\xcb\x74\x5c\x3e\x26\x42\x3d\x05\xc5\x48\x38\x33\xdf\xcd\xd4\x3d\xc0\xc6\x50\x73\x29\x03\x72\x73\xde\x28\x2e\x3a\x16\xac\x00\xc5\x53\x9c\x30\x94\x63\x98\x4b\x15\x3e\xc6\x25\x0a\x78\x19\x75\xa2\x77\x01\x72\x80\xdb\x1e\x9c\x18\xce\x66\x4d\xf5\x94\x7c\x6c\x18\xbe\xf2\x36\x7e\x61\x63\xb4\x6b\x95\x03\xf7\x00\x70\x5f\xd0\xe8\x9e\xae\x6d\xf0\x88\x4b\xf2\x7c\x00\xe0\x5f\xc5\xef\xc6\x49\x07", 234);
syz_usb_connect(0, 0xc9, 0x20000140, 0x20000240);
break;
case 14:
memcpy((void*)0x20000340, "\x36\x4f\xb1\xa4\x17\x26\x3d\xe2\x27\x97\xec\x76\x08\x61\xf3\x85\x2c\xf2\x4f\x79\xe2\xb7\xa5\xc6\x2a\xfa\xd7\xd6\xd4\xd0\x9d\x86\x2f\x8e\xcc\xd0\x2e\x1b\xb9\x89\xe0\xf8\xa8\xad\x91\x54\x42\x01\x64\x04\xc9\x82\x6a\x5c\x0a\x28\x4f\xc7\xa8\x40\x30\x47\x59\xb6\x84\xf3\x57\xb2\xe6\xfe\xcf\xb3\xcc\x81\x57\xc0\x08\xff\x0d\xcf\xf2\x10\x89\x84\x54\x8a\x2a\xd6\x95\xfa\xd9\x51\x2f\x06\xfd\x12\xd6\x6b\xc4\x43\x04\x75\x12\xab\x4e\xf3\x05\x8a\xe6\xc0\xc6\xec\x3f\xd6\x27\xe3\x70\xa1\x51\xae\x71\x9b\x8e\x3a\x77\xd6\x82\xdc\x06\xa9\x3b\xe9\xc2\xaa\x80\x18\xb5\x8a\x94\x92\xcb\x39\x03\x1b\xb5\xab\xf3\x12\x4e\xaa\xb8\x53\x30\xf1\x81\xfc\xcc\xa7\x59\x7b\x4e\xc0\x87\x9f\xcb\xcf\x51\x14\x3f\x98\xc4\x43\xc1\x67\x20\xa6\xe0\x1b\x7e\x07\xdf\x47\x27\xe2\x88\xe1\x3d\xcc\x0b\x7e\x11", 191);
memcpy((void*)0x20000400, "\x59\x03\x92\x3c\x7a\x1b\x28\x38\xf3\xc1\x21\x56\x78\x5a\x11\xc8\x1b\x2e\x82\xd9\xa1\x19\x0e\x1b\x9c\x45\x97\x6a\x91\x7c\x00\x29\x4d\xc9\x4d\x53\x54\xe8\xc5\xd6\xa4\xe8\x98\x6d\xa0\x74\xeb\x46\x1e\xd0\x73\x6b\xcb\xed\xe2\xce\xf1\xf1\x9e\x02\x16\xc0\x9e\xb7\x94\xd8\xb9\x75\x4f\xea\x26\xf1\x10\xc8\x32\x48\xc2\x86\xea\xa0\x5a\x69\x84\x4e\xb1\x29\x2f\x59\x4f\x59\xf6\xc9\xbe\xca\x47\xd8\x94\xd4\x4d\xfd\x15\xff\x81\xb7\x6b\x46\x35\x39\x2e\xb5\xed\x43\x1c\xa3\x09\x22\x30", 117);
res = syz_usb_connect(4, 0xbf, 0x20000340, 0x20000400);
if (res != -1)
r[6] = res;
break;
case 15:
syz_usb_disconnect(r[6]);
break;
}
}
int main(void)
{
syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 3ul, 0x1012ul, -1, 0ul, 0ul);
use_temporary_dir();
do_sandbox_setuid();
return 0;
}
<stdin>:187:2: error: unknown type name 'uint8_t_t'
<stdin>:188:2: error: unknown type name 'uint8_t_t'
<stdin>:189:2: error: unknown type name 'uint8_t_t'
<stdin>:190:2: error: unknown type name 'uint8_t_t'
<stdin>:191:2: error: unknown type name 'uint16_t_t'
<stdin>:192:2: error: unknown type name 'uint8_t_t'
<stdin>:193:2: error: unknown type name 'uint8_t_t'
<stdin>:194:2: error: unknown type name 'uint8_t_t'
<stdin>:198:2: error: unknown type name 'uint8_t_t'
<stdin>:199:2: error: unknown type name 'uint8_t_t'
<stdin>:200:2: error: unknown type name 'uint16_t_t'
<stdin>:201:2: error: unknown type name 'uint8_t_t'
<stdin>:202:2: error: unknown type name 'uint8_t_t'
<stdin>:203:2: error: unknown type name 'uint8_t_t'
<stdin>:204:2: error: unknown type name 'uint8_t_t'
<stdin>:205:2: error: unknown type name 'uint16_t_t'
<stdin>:206:2: error: unknown type name 'uint16_t_t'
<stdin>:207:2: error: unknown type name 'uint16_t_t'
<stdin>:208:2: error: unknown type name 'uint8_t_t'
<stdin>:209:2: error: unknown type name 'uint8_t_t'
<stdin>:210:2: error: unknown type name 'uint8_t_t'
<stdin>:211:2: error: unknown type name 'uint8_t_t'
<stdin>:215:2: error: unknown type name 'uint8_t_t'
<stdin>:216:2: error: unknown type name 'uint8_t_t'
<stdin>:217:2: error: unknown type name 'uint16_t_t'
<stdin>:218:2: error: unknown type name 'uint8_t_t'
<stdin>:219:2: error: unknown type name 'uint8_t_t'
<stdin>:220:2: error: unknown type name 'uint8_t_t'
<stdin>:221:2: error: unknown type name 'uint8_t_t'
<stdin>:222:2: error: unknown type name 'uint8_t_t'
<stdin>:226:2: error: unknown type name 'uint8_t_t'
<stdin>:227:2: error: unknown type name 'uint8_t_t'
<stdin>:228:2: error: unknown type name 'uint8_t_t'
<stdin>:229:2: error: unknown type name 'uint8_t_t'
<stdin>:230:2: error: unknown type name 'uint8_t_t'
<stdin>:231:2: error: unknown type name 'uint8_t_t'
<stdin>:232:2: error: unknown type name 'uint8_t_t'
<stdin>:233:2: error: unknown type name 'uint8_t_t'
<stdin>:234:2: error: unknown type name 'uint8_t_t'
<stdin>:238:2: error: unknown type name 'uint8_t_t'
<stdin>:239:2: error: unknown type name 'uint8_t_t'
<stdin>:240:2: error: unknown type name 'uint16_t_t'
<stdin>:241:2: error: unknown type name 'uint16_t_t'
<stdin>:242:2: error: unknown type name 'uint16_t_t'
<stdin>:246:2: error: unknown type name 'uint8_t_t'
<stdin>:247:2: error: unknown type name 'uint8_t_t'
<stdin>:248:2: error: unknown type name 'uint16_t_t'
<stdin>:249:2: error: unknown type name 'uint8_t_t'
<stdin>:250:2: error: unknown type name 'uint8_t_t'
<stdin>:251:2: error: unknown type name 'uint8_t_t'
<stdin>:252:2: error: unknown type name 'uint8_t_t'
<stdin>:253:2: error: unknown type name 'uint8_t_t'
<stdin>:254:2: error: unknown type name 'uint8_t_t'
<stdin>: In function 'vhci_usb_recv':
<stdin>:561:2: error: unknown type name 'uint8_t_t'; did you mean 'uint8_t'?
<stdin>:561:20: error: 'uint8_t_t' undeclared (first use in this function); did you mean 'uint8_t'?
<stdin>:561:20: note: each undeclared identifier is reported only once for each function it appears in
<stdin>:561:30: error: expected expression before ')' token
<stdin>: In function 'vhci_usb_send':
<stdin>:576:2: error: unknown type name 'uint8_t_t'; did you mean 'uint8_t'?
<stdin>:576:20: error: 'uint8_t_t' undeclared (first use in this function); did you mean 'uint8_t'?
<stdin>:576:30: error: expected expression before ')' token
<stdin>: In function 'syz_usb_connect_impl':
<stdin>:637:63: error: unknown type name 'usb_ctrlrequest'
<stdin>:642:55: error: unknown type name 'usb_ctrlrequest'
<stdin>:654:8: error: 'uint32_t_t' undeclared (first use in this function); did you mean 'uint32_t'?
At top level:
<stdin>:702:13: error: 'setup_usb' defined but not used [-Werror=unused-function]
cc1: all warnings being treated as errors
compiler invocation: /syzkaller/netbsd/src/../tools/bin/x86_64--netbsd-g++ [-o /tmp/syz-executor197148708 -DGOOS_netbsd=1 -DGOARCH_amd64=1 -DHOSTGOOS_linux=1 -x c - -m64 --sysroot /syzkaller/netbsd/src/../dest/ -O2 -pthread -Wall -Werror -Wparentheses -Wframe-larger-than=16384]
--- FAIL: TestGenerate/netbsd/amd64/13 (0.64s)
csource_test.go:123: opts: {Threaded:true Collide:false Repeat:true RepeatTimes:0 Procs:0 Sandbox:none Fault:false FaultCall:0 FaultNth:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false USB:false UseTmpDir:true HandleSegv:false Repro:false Trace:true}
program:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
writev(r0, &(0x7f00000002c0)=[{&(0x7f0000000000)="25c5f6768692f16a6b02337bc5f24e95c2e574f7bd23da78ff2241439caced122e33ab16d377843415781fa508cd635f2fd04113204ed9bda7396e99a38a2f10e9c7398b5a64c49d98664bd14975be7076a83638a7da3095f0e027bd161ccd5c994f8b31d535a3ce4c57812d9682f3ebb10e05a7142210515b668d1357d91aaabb6ad88aed6b9f2143d062e0b5", 0x8d}, {&(0x7f00000000c0)="e8987e8f864e9d38b55615b659d14cae9e91a9532213ffb465b61b", 0x1b}, {&(0x7f0000000100)="3f97992c940fba8936a6b4", 0xb}, {&(0x7f0000000140)="c99ab604eb2e44ebf7bfb7b04c084321a30f4351aeb0676bb21aefc3bc2322d99a5b034f880aa25d61ae4076397c30357b22ccb779ebd3206ac648fab90836dd4d9e73dc3c077270b57dc3222284dd3cae4737957d947d765a5e0e919cbd3ef2d3d9522a827f3fe60ddc", 0x6a}, {&(0x7f00000001c0)="2bc5a9fd6cc3450082405ab607a0f5627b40589a690ac59158acf10f2a1cc46152fa5f493a8599cc6eaab5d96968bef1a27f62dacf64d06c80cfb5b320b977c9432c446fa6f6551444ee4c5998853260d65d2cb3c778f44fe270363b4eb309e24fc47797b5bd454bf4d3d4656fa078ff56b30f4f0e9d5e6e8943830ad6d342968c224f7c35af01a61d10e155fee7e0227cd79a7977b3f40351ca01834840abba557d36bc8a4208f90dc5f51e3f3d445c5feea79368164edef05d24748ce9f0a58451b43d9891902bc45ec67d00df1deb74e65b29c0d095dbdd5b9a7c", 0xdc}], 0x5)
getgroups(0x3, &(0x7f0000000340)=[0x0, 0xffffffffffffffff, <r1=>0x0])
getsockopt$sock_cred(0xffffffffffffffff, 0xffff, 0x11, &(0x7f0000000380)={0x0, 0x0, <r2=>0x0}, &(0x7f00000003c0)=0xc)
setregid(r1, r2)
r3 = semget(0x1, 0x0, 0xb2603d964b180ce8)
stat(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, <r4=>0x0})
r5 = getgid()
semctl$IPC_SET(r3, 0x0, 0x1, &(0x7f0000000500)={{0xfffff834, r4, r5, 0xffffffffffffffff, 0x0, 0x3, 0x9}, 0xfffffffffffffffd, 0x4535, 0x2})
seteuid(0x0)
syz_emit_ethernet(0x88, &(0x7f0000000000)="bf5bc2c4ddcd9baa7f7c66f91726a8c490f69185140b5b4251e86701c6c5a60d84802d382a0c38df4a28fd840d7e1406a5c2eb5d3b6bc323bd49386c4a924950314fe617f8cd3437a4aa6d1c6d62640309f9de2393999b114768d510d734fd72d198b261bd618114bf3fa3e2fe84ffe65c80e47212c49e47bb3aaa8689462f21d51880d97cb445d3")
syz_execute_func(&(0x7f00000000c0)="c4a184582caa26440fae04c4410f74ab00000100c423f5784ce99d4044df345926410fae4101646466440fe5b94e9ab0c4c4227d470f410f457f56660fdde8")
syz_extract_tcp_res(&(0x7f0000000100), 0x6, 0x1)
syz_usb_connect(0x0, 0xc9, &(0x7f0000000140)="64d32f16ebd817d004dcb801718205bca1d86dad3cb132a286609214b7395a97a0e8feda5fad02cce9deea94d55a750c17b234075002b9df629fa68e3f7da97e9c2a2e0a95d15d359561b1477440342cd79c7cebd6bf008acd1c7ff146a6fe22013661d8c8ce8eb17f5cf3892ae08bba46545b2b690ab7e0368aec4d32b76d7fc15dd7c2aba184d41a5e5abb8d716f5e645e1767138ed738f315795ac99e22fd44db06096313f4729ce0d3bd938f5b6520ef9376fa909df6b205c2d3f52ee43e3f59ea441b7c4e4d5c", &(0x7f0000000240)="c1b01d40739935b1217d0e393cdd4fa4ef8bbd9957ee996877e4ca155c195dc166f9486ac4db17f754c48938a43419f082a8c30effbef064f6c8b87bc930e439c719ec0a1199040b86286d271f25af26ebed3f55c32e68ac70330df76931bf55fae880256b74a923f8a3022c310f94cc0c623302a5d14b3f8e18f41599882866ea0242864b37d5ae87fbcb745c3e26423d05c5483833dfcdd43dc0c6507329037273de282e3a16ac00c5539c309463984b153ec6250a781975a277017280db1e9c18ce664df5947c6c18bef2367e6163b46b9503f700705fd0e89eae6df0884bf27c00e05fc5efc64907")
r6 = syz_usb_connect(0x4, 0xbf, &(0x7f0000000340)="364fb1a417263de22797ec760861f3852cf24f79e2b7a5c62afad7d6d4d09d862f8eccd02e1bb989e0f8a8ad915442016404c9826a5c0a284fc7a840304759b684f357b2e6fecfb3cc8157c008ff0dcff2108984548a2ad695fad9512f06fd12d66bc443047512ab4ef3058ae6c0c6ec3fd627e370a151ae719b8e3a77d682dc06a93be9c2aa8018b58a9492cb39031bb5abf3124eaab85330f181fccca7597b4ec0879fcbcf51143f98c443c16720a6e01b7e07df4727e288e13dcc0b7e11", &(0x7f0000000400)="5903923c7a1b2838f3c12156785a11c81b2e82d9a1190e1b9c45976a917c00294dc94d5354e8c5d6a4e8986da074eb461ed0736bcbede2cef1f19e0216c09eb794d8b9754fea26f110c83248c286eaa05a69844eb1292f594f59f6c9beca47d894d44dfd15ff81b76b4635392eb5ed431ca3092230")
syz_usb_disconnect(r6)
csource_test.go:124: failed to build program:
// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <dev/usb/usb.h>
#include <dev/usb/usbhid.h>
#include <dev/usb/vhci.h>
#include <dirent.h>
#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <pthread.h>
#include <pwd.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ioctl.h>
#include <sys/resource.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>
static unsigned long long procid;
static void kill_and_wait(int pid, int* status)
{
kill(pid, SIGKILL);
while (waitpid(-1, status, 0) != pid) {
}
}
static void sleep_ms(uint64_t ms)
{
usleep(ms * 1000);
}
static uint64_t current_time_ms(void)
{
struct timespec ts;
if (clock_gettime(CLOCK_MONOTONIC, &ts))
exit(1);
return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}
static void use_temporary_dir(void)
{
char tmpdir_template[] = "./syzkaller.XXXXXX";
char* tmpdir = mkdtemp(tmpdir_template);
if (!tmpdir)
exit(1);
if (chmod(tmpdir, 0777))
exit(1);
if (chdir(tmpdir))
exit(1);
}
static void remove_dir(const char* dir)
{
DIR* dp;
struct dirent* ep;
dp = opendir(dir);
if (dp == NULL)
exit(1);
while ((ep = readdir(dp))) {
if (strcmp(ep->d_name, ".") == 0 || strcmp(ep->d_name, "..") == 0)
continue;
char filename[FILENAME_MAX];
snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name);
struct stat st;
if (lstat(filename, &st))
exit(1);
if (S_ISDIR(st.st_mode)) {
remove_dir(filename);
continue;
}
if (unlink(filename))
exit(1);
}
closedir(dp);
if (rmdir(dir))
exit(1);
}
static void thread_start(void* (*fn)(void*), void* arg)
{
pthread_t th;
pthread_attr_t attr;
pthread_attr_init(&attr);
pthread_attr_setstacksize(&attr, 128 << 10);
int i;
for (i = 0; i < 100; i++) {
if (pthread_create(&th, &attr, fn, arg) == 0) {
pthread_attr_destroy(&attr);
return;
}
if (errno == EAGAIN) {
usleep(50);
continue;
}
break;
}
exit(1);
}
typedef struct {
pthread_mutex_t mu;
pthread_cond_t cv;
int state;
} event_t;
static void event_init(event_t* ev)
{
if (pthread_mutex_init(&ev->mu, 0))
exit(1);
if (pthread_cond_init(&ev->cv, 0))
exit(1);
ev->state = 0;
}
static void event_reset(event_t* ev)
{
ev->state = 0;
}
static void event_set(event_t* ev)
{
pthread_mutex_lock(&ev->mu);
if (ev->state)
exit(1);
ev->state = 1;
pthread_mutex_unlock(&ev->mu);
pthread_cond_broadcast(&ev->cv);
}
static void event_wait(event_t* ev)
{
pthread_mutex_lock(&ev->mu);
while (!ev->state)
pthread_cond_wait(&ev->cv, &ev->mu);
pthread_mutex_unlock(&ev->mu);
}
static int event_isset(event_t* ev)
{
pthread_mutex_lock(&ev->mu);
int res = ev->state;
pthread_mutex_unlock(&ev->mu);
return res;
}
static int event_timedwait(event_t* ev, uint64_t timeout)
{
uint64_t start = current_time_ms();
uint64_t now = start;
pthread_mutex_lock(&ev->mu);
for (;;) {
if (ev->state)
break;
uint64_t remain = timeout - (now - start);
struct timespec ts;
ts.tv_sec = remain / 1000;
ts.tv_nsec = (remain % 1000) * 1000 * 1000;
pthread_cond_timedwait(&ev->cv, &ev->mu, &ts);
now = current_time_ms();
if (now - start > timeout)
break;
}
int res = ev->state;
pthread_mutex_unlock(&ev->mu);
return res;
}
/* -------------------------------------------------------------------------- */
/*
* Redefinitions to match the linux types used in common_usb.h.
*/
struct usb_endpoint_descriptor {
uint8_t_t bLength;
uint8_t_t bDescriptorType;
uint8_t_t bEndpointAddress;
uint8_t_t bmAttributes;
uint16_t_t wMaxPacketSize;
uint8_t_t bInterval;
uint8_t_t bRefresh;
uint8_t_t bSynchAddress;
} __attribute__((packed));
struct usb_device_descriptor {
uint8_t_t bLength;
uint8_t_t bDescriptorType;
uint16_t_t bcdUSB;
uint8_t_t bDeviceClass;
uint8_t_t bDeviceSubClass;
uint8_t_t bDeviceProtocol;
uint8_t_t bMaxPacketSize0;
uint16_t_t idVendor;
uint16_t_t idProduct;
uint16_t_t bcdDevice;
uint8_t_t iManufacturer;
uint8_t_t iProduct;
uint8_t_t iSerialNumber;
uint8_t_t bNumConfigurations;
} __attribute__((packed));
struct usb_config_descriptor {
uint8_t_t bLength;
uint8_t_t bDescriptorType;
uint16_t_t wTotalLength;
uint8_t_t bNumInterfaces;
uint8_t_t bConfigurationValue;
uint8_t_t iConfiguration;
uint8_t_t bmAttributes;
uint8_t_t bMaxPower;
} __attribute__((packed));
struct usb_interface_descriptor {
uint8_t_t bLength;
uint8_t_t bDescriptorType;
uint8_t_t bInterfaceNumber;
uint8_t_t bAlternateSetting;
uint8_t_t bNumEndpoints;
uint8_t_t bInterfaceClass;
uint8_t_t bInterfaceSubClass;
uint8_t_t bInterfaceProtocol;
uint8_t_t iInterface;
} __attribute__((packed));
struct usb_ctrlrequest {
uint8_t_t bRequestType;
uint8_t_t bRequest;
uint16_t_t wValue;
uint16_t_t wIndex;
uint16_t_t wLength;
} __attribute__((packed));
struct usb_qualifier_descriptor {
uint8_t_t bLength;
uint8_t_t bDescriptorType;
uint16_t_t bcdUSB;
uint8_t_t bDeviceClass;
uint8_t_t bDeviceSubClass;
uint8_t_t bDeviceProtocol;
uint8_t_t bMaxPacketSize0;
uint8_t_t bNumConfigurations;
uint8_t_t bRESERVED;
} __attribute__((packed));
#define USB_TYPE_MASK (0x03 << 5)
#define USB_TYPE_STANDARD (0x00 << 5)
#define USB_TYPE_CLASS (0x01 << 5)
#define USB_TYPE_VENDOR (0x02 << 5)
#define USB_TYPE_RESERVED (0x03 << 5)
#define USB_DT_DEVICE 0x01
#define USB_DT_CONFIG 0x02
#define USB_DT_STRING 0x03
#define USB_DT_INTERFACE 0x04
#define USB_DT_ENDPOINT 0x05
#define USB_DT_DEVICE_QUALIFIER 0x06
#define USB_DT_OTHER_SPEED_CONFIG 0x07
#define USB_DT_INTERFACE_POWER 0x08
#define USB_DT_OTG 0x09
#define USB_DT_DEBUG 0x0a
#define USB_DT_INTERFACE_ASSOCIATION 0x0b
#define USB_DT_SECURITY 0x0c
#define USB_DT_KEY 0x0d
#define USB_DT_ENCRYPTION_TYPE 0x0e
#define USB_DT_BOS 0x0f
#define USB_DT_DEVICE_CAPABILITY 0x10
#define USB_DT_WIRELESS_ENDPOINT_COMP 0x11
#define USB_DT_WIRE_ADAPTER 0x21
#define USB_DT_RPIPE 0x22
#define USB_DT_CS_RADIO_CONTROL 0x23
#define USB_DT_PIPE_USAGE 0x24
#define USB_DT_SS_ENDPOINT_COMP 0x30
#define USB_DT_SSP_ISOC_ENDPOINT_COMP 0x31
#define USB_REQ_GET_STATUS 0x00
#define USB_REQ_CLEAR_FEATURE 0x01
#define USB_REQ_SET_FEATURE 0x03
#define USB_REQ_SET_ADDRESS 0x05
#define USB_REQ_GET_DESCRIPTOR 0x06
#define USB_REQ_SET_DESCRIPTOR 0x07
#define USB_REQ_GET_CONFIGURATION 0x08
#define USB_REQ_SET_CONFIGURATION 0x09
#define USB_REQ_GET_INTERFACE 0x0A
#define USB_REQ_SET_INTERFACE 0x0B
#define USB_REQ_SYNCH_FRAME 0x0C
#define USB_REQ_SET_SEL 0x30
#define USB_REQ_SET_ISOCH_DELAY 0x31
#define USB_REQ_SET_ENCRYPTION 0x0D
#define USB_REQ_GET_ENCRYPTION 0x0E
#define USB_REQ_RPIPE_ABORT 0x0E
#define USB_REQ_SET_HANDSHAKE 0x0F
#define USB_REQ_RPIPE_RESET 0x0F
#define USB_REQ_GET_HANDSHAKE 0x10
#define USB_REQ_SET_CONNECTION 0x11
#define USB_REQ_SET_SECURITY_DATA 0x12
#define USB_REQ_GET_SECURITY_DATA 0x13
#define USB_REQ_SET_WUSB_DATA 0x14
#define USB_REQ_LOOPBACK_DATA_WRITE 0x15
#define USB_REQ_LOOPBACK_DATA_READ 0x16
#define USB_REQ_SET_INTERFACE_DS 0x17
#define USB_REQ_GET_PARTNER_PDO 20
#define USB_REQ_GET_BATTERY_STATUS 21
#define USB_REQ_SET_PDO 22
#define USB_REQ_GET_VDM 23
#define USB_REQ_SEND_VDM 24
#define USB_MAX_IFACE_NUM 4
#define USB_MAX_EP_NUM 32
#define USB_MAX_FDS 6
struct usb_endpoint_index {
struct usb_endpoint_descriptor desc;
int handle;
};
struct usb_iface_index {
struct usb_interface_descriptor* iface;
uint8_t bInterfaceNumber;
uint8_t bAlternateSetting;
uint8_t bInterfaceClass;
struct usb_endpoint_index eps[USB_MAX_EP_NUM];
int eps_num;
};
struct usb_device_index {
struct usb_device_descriptor* dev;
struct usb_config_descriptor* config;
uint8_t bDeviceClass;
uint8_t bMaxPower;
int config_length;
struct usb_iface_index ifaces[USB_MAX_IFACE_NUM];
int ifaces_num;
int iface_cur;
};
struct usb_info {
int fd;
struct usb_device_index index;
};
static struct usb_info usb_devices[USB_MAX_FDS];
static int usb_devices_num;
static bool parse_usb_descriptor(const char* buffer, size_t length, struct usb_device_index* index)
{
if (length < sizeof(*index->dev) + sizeof(*index->config))
return false;
memset(index, 0, sizeof(*index));
index->dev = (struct usb_device_descriptor*)buffer;
index->config = (struct usb_config_descriptor*)(buffer + sizeof(*index->dev));
index->bDeviceClass = index->dev->bDeviceClass;
index->bMaxPower = index->config->bMaxPower;
index->config_length = length - sizeof(*index->dev);
index->iface_cur = -1;
size_t offset = 0;
while (true) {
if (offset + 1 >= length)
break;
uint8_t desc_length = buffer[offset];
uint8_t desc_type = buffer[offset + 1];
if (desc_length <= 2)
break;
if (offset + desc_length > length)
break;
if (desc_type == USB_DT_INTERFACE && index->ifaces_num < USB_MAX_IFACE_NUM) {
struct usb_interface_descriptor* iface = (struct usb_interface_descriptor*)(buffer + offset);
index->ifaces[index->ifaces_num].iface = iface;
index->ifaces[index->ifaces_num].bInterfaceNumber = iface->bInterfaceNumber;
index->ifaces[index->ifaces_num].bAlternateSetting = iface->bAlternateSetting;
index->ifaces[index->ifaces_num].bInterfaceClass = iface->bInterfaceClass;
index->ifaces_num++;
}
if (desc_type == USB_DT_ENDPOINT && index->ifaces_num > 0) {
struct usb_iface_index* iface = &index->ifaces[index->ifaces_num - 1];
if (iface->eps_num < USB_MAX_EP_NUM) {
memcpy(&iface->eps[iface->eps_num].desc, buffer + offset, sizeof(iface->eps[iface->eps_num].desc));
iface->eps_num++;
}
}
offset += desc_length;
}
return true;
}
static struct usb_device_index* add_usb_index(int fd, const char* dev, size_t dev_len)
{
int i = __atomic_fetch_add(&usb_devices_num, 1, __ATOMIC_RELAXED);
if (i >= USB_MAX_FDS)
return NULL;
int rv = 0;
rv = parse_usb_descriptor(dev, dev_len, &usb_devices[i].index);
if (!rv)
return NULL;
__atomic_store_n(&usb_devices[i].fd, fd, __ATOMIC_RELEASE);
return &usb_devices[i].index;
}
static struct usb_device_index* lookup_usb_index(int fd)
{
int i;
for (i = 0; i < USB_MAX_FDS; i++) {
if (__atomic_load_n(&usb_devices[i].fd, __ATOMIC_ACQUIRE) == fd) {
return &usb_devices[i].index;
}
}
return NULL;
}
struct vusb_connect_string_descriptor {
uint32_t len;
char* str;
} __attribute__((packed));
struct vusb_connect_descriptors {
uint32_t qual_len;
char* qual;
uint32_t bos_len;
char* bos;
uint32_t strs_len;
struct vusb_connect_string_descriptor strs[0];
} __attribute__((packed));
static const char default_string[] = {
8, USB_DT_STRING,
's', 0, 'y', 0, 'z', 0
};
static const char default_lang_id[] = {
4, USB_DT_STRING,
0x09, 0x04
};
static bool lookup_connect_response_in(int fd, const struct vusb_connect_descriptors* descs,
const struct usb_ctrlrequest* ctrl,
char** response_data, uint32_t* response_length)
{
struct usb_device_index* index = lookup_usb_index(fd);
uint8_t str_idx;
if (!index)
return false;
switch (ctrl->bRequestType & USB_TYPE_MASK) {
case USB_TYPE_STANDARD:
switch (ctrl->bRequest) {
case USB_REQ_GET_DESCRIPTOR:
switch (ctrl->wValue >> 8) {
case USB_DT_DEVICE:
*response_data = (char*)index->dev;
*response_length = sizeof(*index->dev);
return true;
case USB_DT_CONFIG:
*response_data = (char*)index->config;
*response_length = index->config_length;
return true;
case USB_DT_STRING:
str_idx = (uint8_t)ctrl->wValue;
if (descs && str_idx < descs->strs_len) {
*response_data = descs->strs[str_idx].str;
*response_length = descs->strs[str_idx].len;
return true;
}
if (str_idx == 0) {
*response_data = (char*)&default_lang_id[0];
*response_length = default_lang_id[0];
return true;
}
*response_data = (char*)&default_string[0];
*response_length = default_string[0];
return true;
case USB_DT_BOS:
*response_data = descs->bos;
*response_length = descs->bos_len;
return true;
case USB_DT_DEVICE_QUALIFIER:
if (!descs->qual) {
struct usb_qualifier_descriptor* qual =
(struct usb_qualifier_descriptor*)response_data;
qual->bLength = sizeof(*qual);
qual->bDescriptorType = USB_DT_DEVICE_QUALIFIER;
qual->bcdUSB = index->dev->bcdUSB;
qual->bDeviceClass = index->dev->bDeviceClass;
qual->bDeviceSubClass = index->dev->bDeviceSubClass;
qual->bDeviceProtocol = index->dev->bDeviceProtocol;
qual->bMaxPacketSize0 = index->dev->bMaxPacketSize0;
qual->bNumConfigurations = index->dev->bNumConfigurations;
qual->bRESERVED = 0;
*response_length = sizeof(*qual);
return true;
}
*response_data = descs->qual;
*response_length = descs->qual_len;
return true;
default:
break;
}
break;
default:
break;
}
break;
default:
break;
}
return false;
}
typedef bool (*lookup_connect_out_response_t)(int fd, const struct vusb_connect_descriptors* descs,
const struct usb_ctrlrequest* ctrl, bool* done);
static bool lookup_connect_response_out_generic(int fd, const struct vusb_connect_descriptors* descs,
const struct usb_ctrlrequest* ctrl, bool* done)
{
switch (ctrl->bRequestType & USB_TYPE_MASK) {
case USB_TYPE_STANDARD:
switch (ctrl->bRequest) {
case USB_REQ_SET_CONFIGURATION:
*done = true;
return true;
default:
break;
}
break;
}
return false;
}
/* -------------------------------------------------------------------------- */
static int vhci_open(void)
{
return open("/dev/vhci", O_RDWR);
}
static int vhci_setport(int fd, u_int port)
{
struct vhci_ioc_set_port args;
args.port = port;
return ioctl(fd, VHCI_IOC_SET_PORT, &args);
}
static int vhci_usb_attach(int fd)
{
return ioctl(fd, VHCI_IOC_USB_ATTACH, NULL);
}
static int vhci_usb_recv(int fd, void* buf, size_t size)
{
uint8_t_t* ptr = (uint8_t_t*)buf;
ssize_t done;
while (1) {
done = read(fd, ptr, size);
if (done < 0)
return -1;
if ((size_t)done == size)
return 0;
size -= done;
ptr += done;
}
}
static int vhci_usb_send(int fd, void* buf, size_t size)
{
uint8_t_t* ptr = (uint8_t_t*)buf;
ssize_t done;
while (1) {
done = write(fd, ptr, size);
if (done <= 0)
return -1;
if ((size_t)done == size)
return 0;
size -= done;
ptr += done;
}
}
/* -------------------------------------------------------------------------- */
static volatile long syz_usb_connect_impl(uint64_t speed, uint64_t dev_len,
const char* dev, const struct vusb_connect_descriptors* descs,
lookup_connect_out_response_t lookup_connect_response_out)
{
struct usb_device_index* index;
int portnum, fd, rv;
bool done;
portnum = procid + 1;
if (!dev) {
return -1;
}
if (portnum != 1) {
/* For now, we support only one proc. */
return -1;
}
fd = vhci_open();
if (fd < 0) {
return -1;
}
index = add_usb_index(fd, dev, dev_len);
if (!index) {
goto err;
}
rv = vhci_setport(fd, portnum);
if (rv != 0) {
goto err;
}
rv = vhci_usb_attach(fd);
if (rv != 0) {
goto err;
}
done = false;
while (!done) {
vhci_request_t req;
rv = vhci_usb_recv(fd, &req, sizeof(req));
if (rv != 0) {
goto err;
}
if (req.type != VHCI_REQ_CTRL) {
goto err;
}
char* response_data = NULL;
uint32_t response_length = 0;
char data[4096];
if (req.u.ctrl.bmRequestType & UE_DIR_IN) {
bool response_found = false;
response_found = lookup_connect_response_in(fd, descs, (const usb_ctrlrequest*)&req.u.ctrl, &response_data, &response_length);
if (!response_found) {
goto err;
}
} else {
if (!lookup_connect_response_out(fd, descs, (const usb_ctrlrequest*)&req.u.ctrl, &done)) {
goto err;
}
response_data = NULL;
response_length = UGETW(req.u.ctrl.wLength);
}
if ((req.u.ctrl.bmRequestType & USB_TYPE_MASK) == USB_TYPE_STANDARD &&
req.u.ctrl.bRequest == USB_REQ_SET_CONFIGURATION) {
/* TODO: possibly revisit */
}
if (response_length > sizeof(data))
response_length = 0;
if ((uint32_t_t)UGETW(req.u.ctrl.wLength) < response_length)
response_length = UGETW(req.u.ctrl.wLength);
if (response_data)
memcpy(data, response_data, response_length);
else
memset(data, 0, response_length);
if (req.u.ctrl.bmRequestType & UE_DIR_IN) {
if (response_length > 0) {
vhci_response_t res;
res.size = response_length;
rv = vhci_usb_send(fd, &res, sizeof(res));
if (rv == 0)
rv = vhci_usb_send(fd, data, response_length);
}
} else {
rv = vhci_usb_recv(fd, data, response_length);
}
if (rv < 0) {
goto err;
}
}
sleep_ms(200);
return fd;
err:
close(fd);
return -1;
}
static volatile long syz_usb_connect(volatile long a0, volatile long a1,
volatile long a2, volatile long a3)
{
uint64_t speed = a0;
uint64_t dev_len = a1;
const char* dev = (const char*)a2;
const struct vusb_connect_descriptors* descs = (const struct vusb_connect_descriptors*)a3;
return syz_usb_connect_impl(speed, dev_len, dev, descs,
&lookup_connect_response_out_generic);
}
static volatile long syz_usb_disconnect(volatile long a0)
{
int fd = a0;
int rv = close(fd);
sleep_ms(200);
return rv;
}
static void setup_usb(void)
{
if (chmod("/dev/vhci", 0666))
exit(1);
}
static void sandbox_common()
{
if (setsid() == -1)
exit(1);
struct rlimit rlim;
rlim.rlim_cur = rlim.rlim_max = 8 << 20;
setrlimit(RLIMIT_MEMLOCK, &rlim);
rlim.rlim_cur = rlim.rlim_max = 1 << 20;
setrlimit(RLIMIT_FSIZE, &rlim);
rlim.rlim_cur = rlim.rlim_max = 1 << 20;
setrlimit(RLIMIT_STACK, &rlim);
rlim.rlim_cur = rlim.rlim_max = 0;
setrlimit(RLIMIT_CORE, &rlim);
rlim.rlim_cur = rlim.rlim_max = 256;
setrlimit(RLIMIT_NOFILE, &rlim);
}
static void loop();
static int do_sandbox_none(void)
{
sandbox_common();
loop();
return 0;
}
static long syz_execute_func(volatile long text)
{
volatile long p[8] = {0};
(void)p;
asm volatile("" ::"r"(0l), "r"(1l), "r"(2l), "r"(3l), "r"(4l), "r"(5l), "r"(6l),
"r"(7l), "r"(8l), "r"(9l), "r"(10l), "r"(11l), "r"(12l), "r"(13l));
((void (*)(void))(text))();
return 0;
}
struct thread_t {
int created, call;
event_t ready, done;
};
static struct thread_t threads[16];
static void execute_call(int call);
static int running;
static void* thr(void* arg)
{
struct thread_t* th = (struct thread_t*)arg;
for (;;) {
event_wait(&th->ready);
event_reset(&th->ready);
execute_call(th->call);
__atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED);
event_set(&th->done);
}
return 0;
}
static void execute_one(void)
{
fprintf(stderr, "### start\n");
int i, call, thread;
for (call = 0; call < 16; call++) {
for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0])); thread++) {
struct thread_t* th = &threads[thread];
if (!th->created) {
th->created = 1;
event_init(&th->ready);
event_init(&th->done);
event_set(&th->done);
thread_start(thr, th);
}
if (!event_isset(&th->done))
continue;
event_reset(&th->done);
th->call = call;
__atomic_fetch_add(&running, 1, __ATOMIC_RELAXED);
event_set(&th->ready);
event_timedwait(&th->done, 45 + (call == 13 ? 3000 : 0) + (call == 14 ? 3000 : 0) + (call == 15 ? 300 : 0));
break;
}
}
for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++)
sleep_ms(1);
}
static void execute_one(void);
#define WAIT_FLAGS 0
static void loop(void)
{
int iter;
for (iter = 0;; iter++) {
char cwdbuf[32];
sprintf(cwdbuf, "./%d", iter);
if (mkdir(cwdbuf, 0777))
exit(1);
int pid = fork();
if (pid < 0)
exit(1);
if (pid == 0) {
if (chdir(cwdbuf))
exit(1);
execute_one();
exit(0);
}
int status = 0;
uint64_t start = current_time_ms();
for (;;) {
if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
break;
sleep_ms(1);
if (current_time_ms() - start < 5 * 1000)
continue;
kill_and_wait(pid, &status);
break;
}
remove_dir(cwdbuf);
}
}
#ifndef SYS_dup2
#define SYS_dup2 90
#endif
#ifndef SYS_getgid
#define SYS_getgid 47
#endif
#ifndef SYS_getgroups
#define SYS_getgroups 79
#endif
#ifndef SYS_getsockopt
#define SYS_getsockopt 118
#endif
#ifndef SYS_mmap
#define SYS_mmap 197
#endif
#ifndef SYS_semctl
#define SYS_semctl 442
#endif
#ifndef SYS_semget
#define SYS_semget 221
#endif
#ifndef SYS_seteuid
#define SYS_seteuid 183
#endif
#ifndef SYS_setregid
#define SYS_setregid 127
#endif
#ifndef SYS_stat
#define SYS_stat 439
#endif
#ifndef SYS_writev
#define SYS_writev 121
#endif
uint64_t r[7] = {0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff};
void execute_call(int call)
{
intptr_t res = 0;
switch (call) {
case 0:
res = syscall(SYS_dup2, -1, 0xffffff9c);
fprintf(stderr, "### call=0 errno=%u\n", res == -1 ? errno : 0);
if (res != -1)
r[0] = res;
break;
case 1:
*(uint64_t*)0x200002c0 = 0x20000000;
memcpy((void*)0x20000000, "\x25\xc5\xf6\x76\x86\x92\xf1\x6a\x6b\x02\x33\x7b\xc5\xf2\x4e\x95\xc2\xe5\x74\xf7\xbd\x23\xda\x78\xff\x22\x41\x43\x9c\xac\xed\x12\x2e\x33\xab\x16\xd3\x77\x84\x34\x15\x78\x1f\xa5\x08\xcd\x63\x5f\x2f\xd0\x41\x13\x20\x4e\xd9\xbd\xa7\x39\x6e\x99\xa3\x8a\x2f\x10\xe9\xc7\x39\x8b\x5a\x64\xc4\x9d\x98\x66\x4b\xd1\x49\x75\xbe\x70\x76\xa8\x36\x38\xa7\xda\x30\x95\xf0\xe0\x27\xbd\x16\x1c\xcd\x5c\x99\x4f\x8b\x31\xd5\x35\xa3\xce\x4c\x57\x81\x2d\x96\x82\xf3\xeb\xb1\x0e\x05\xa7\x14\x22\x10\x51\x5b\x66\x8d\x13\x57\xd9\x1a\xaa\xbb\x6a\xd8\x8a\xed\x6b\x9f\x21\x43\xd0\x62\xe0\xb5", 141);
*(uint64_t*)0x200002c8 = 0x8d;
*(uint64_t*)0x200002d0 = 0x200000c0;
memcpy((void*)0x200000c0, "\xe8\x98\x7e\x8f\x86\x4e\x9d\x38\xb5\x56\x15\xb6\x59\xd1\x4c\xae\x9e\x91\xa9\x53\x22\x13\xff\xb4\x65\xb6\x1b", 27);
*(uint64_t*)0x200002d8 = 0x1b;
*(uint64_t*)0x200002e0 = 0x20000100;
memcpy((void*)0x20000100, "\x3f\x97\x99\x2c\x94\x0f\xba\x89\x36\xa6\xb4", 11);
*(uint64_t*)0x200002e8 = 0xb;
*(uint64_t*)0x200002f0 = 0x20000140;
memcpy((void*)0x20000140, "\xc9\x9a\xb6\x04\xeb\x2e\x44\xeb\xf7\xbf\xb7\xb0\x4c\x08\x43\x21\xa3\x0f\x43\x51\xae\xb0\x67\x6b\xb2\x1a\xef\xc3\xbc\x23\x22\xd9\x9a\x5b\x03\x4f\x88\x0a\xa2\x5d\x61\xae\x40\x76\x39\x7c\x30\x35\x7b\x22\xcc\xb7\x79\xeb\xd3\x20\x6a\xc6\x48\xfa\xb9\x08\x36\xdd\x4d\x9e\x73\xdc\x3c\x07\x72\x70\xb5\x7d\xc3\x22\x22\x84\xdd\x3c\xae\x47\x37\x95\x7d\x94\x7d\x76\x5a\x5e\x0e\x91\x9c\xbd\x3e\xf2\xd3\xd9\x52\x2a\x82\x7f\x3f\xe6\x0d\xdc", 106);
*(uint64_t*)0x200002f8 = 0x6a;
*(uint64_t*)0x20000300 = 0x200001c0;
memcpy((void*)0x200001c0, "\x2b\xc5\xa9\xfd\x6c\xc3\x45\x00\x82\x40\x5a\xb6\x07\xa0\xf5\x62\x7b\x40\x58\x9a\x69\x0a\xc5\x91\x58\xac\xf1\x0f\x2a\x1c\xc4\x61\x52\xfa\x5f\x49\x3a\x85\x99\xcc\x6e\xaa\xb5\xd9\x69\x68\xbe\xf1\xa2\x7f\x62\xda\xcf\x64\xd0\x6c\x80\xcf\xb5\xb3\x20\xb9\x77\xc9\x43\x2c\x44\x6f\xa6\xf6\x55\x14\x44\xee\x4c\x59\x98\x85\x32\x60\xd6\x5d\x2c\xb3\xc7\x78\xf4\x4f\xe2\x70\x36\x3b\x4e\xb3\x09\xe2\x4f\xc4\x77\x97\xb5\xbd\x45\x4b\xf4\xd3\xd4\x65\x6f\xa0\x78\xff\x56\xb3\x0f\x4f\x0e\x9d\x5e\x6e\x89\x43\x83\x0a\xd6\xd3\x42\x96\x8c\x22\x4f\x7c\x35\xaf\x01\xa6\x1d\x10\xe1\x55\xfe\xe7\xe0\x22\x7c\xd7\x9a\x79\x77\xb3\xf4\x03\x51\xca\x01\x83\x48\x40\xab\xba\x55\x7d\x36\xbc\x8a\x42\x08\xf9\x0d\xc5\xf5\x1e\x3f\x3d\x44\x5c\x5f\xee\xa7\x93\x68\x16\x4e\xde\xf0\x5d\x24\x74\x8c\xe9\xf0\xa5\x84\x51\xb4\x3d\x98\x91\x90\x2b\xc4\x5e\xc6\x7d\x00\xdf\x1d\xeb\x74\xe6\x5b\x29\xc0\xd0\x95\xdb\xdd\x5b\x9a\x7c", 220);
*(uint64_t*)0x20000308 = 0xdc;
res = syscall(SYS_writev, r[0], 0x200002c0ul, 5ul);
fprintf(stderr, "### call=1 errno=%u\n", res == -1 ? errno : 0);
break;
case 2:
*(uint32_t*)0x20000340 = 0;
*(uint32_t*)0x20000344 = -1;
*(uint32_t*)0x20000348 = 0;
res = syscall(SYS_getgroups, 3ul, 0x20000340ul);
fprintf(stderr, "### call=2 errno=%u\n", res == -1 ? errno : 0);
if (res != -1)
r[1] = *(uint32_t*)0x20000348;
break;
case 3:
*(uint32_t*)0x200003c0 = 0xc;
res = syscall(SYS_getsockopt, -1, 0xffff, 0x11, 0x20000380ul, 0x200003c0ul);
fprintf(stderr, "### call=3 errno=%u\n", res == -1 ? errno : 0);
if (res != -1)
r[2] = *(uint32_t*)0x20000388;
break;
case 4:
res = syscall(SYS_setregid, r[1], r[2]);
fprintf(stderr, "### call=4 errno=%u\n", res == -1 ? errno : 0);
break;
case 5:
res = syscall(SYS_semget, 0x798e2634ul, 0ul, 0xb2603d964b180ce8ul);
fprintf(stderr, "### call=5 errno=%u\n", res == -1 ? errno : 0);
if (res != -1)
r[3] = res;
break;
case 6:
memcpy((void*)0x20000400, "./file0\000", 8);
res = syscall(SYS_stat, 0x20000400ul, 0x20000440ul);
fprintf(stderr, "### call=6 errno=%u\n", res == -1 ? errno : 0);
if (res != -1)
r[4] = *(uint32_t*)0x2000045c;
break;
case 7:
res = syscall(SYS_getgid);
fprintf(stderr, "### call=7 errno=%u\n", res == -1 ? errno : 0);
if (res != -1)
r[5] = res;
break;
case 8:
*(uint32_t*)0x20000500 = 0xfffff834;
*(uint32_t*)0x20000504 = r[4];
*(uint32_t*)0x20000508 = r[5];
*(uint32_t*)0x2000050c = -1;
*(uint32_t*)0x20000510 = 0;
*(uint32_t*)0x20000514 = 3;
*(uint16_t*)0x20000518 = 9;
*(uint16_t*)0x2000051a = 0;
*(uint64_t*)0x20000520 = 0;
*(uint64_t*)0x20000528 = 0;
*(uint64_t*)0x20000530 = 0xfffffffffffffffd;
*(uint64_t*)0x20000538 = 0x4535;
*(uint64_t*)0x20000540 = 2;
*(uint64_t*)0x20000548 = 0;
*(uint64_t*)0x20000550 = 0;
res = syscall(SYS_semctl, r[3], 0ul, 1ul, 0x20000500ul);
fprintf(stderr, "### call=8 errno=%u\n", res == -1 ? errno : 0);
break;
case 9:
res = syscall(SYS_seteuid, 0);
fprintf(stderr, "### call=9 errno=%u\n", res == -1 ? errno : 0);
break;
case 10:
memcpy((void*)0x20000000, "\xbf\x5b\xc2\xc4\xdd\xcd\x9b\xaa\x7f\x7c\x66\xf9\x17\x26\xa8\xc4\x90\xf6\x91\x85\x14\x0b\x5b\x42\x51\xe8\x67\x01\xc6\xc5\xa6\x0d\x84\x80\x2d\x38\x2a\x0c\x38\xdf\x4a\x28\xfd\x84\x0d\x7e\x14\x06\xa5\xc2\xeb\x5d\x3b\x6b\xc3\x23\xbd\x49\x38\x6c\x4a\x92\x49\x50\x31\x4f\xe6\x17\xf8\xcd\x34\x37\xa4\xaa\x6d\x1c\x6d\x62\x64\x03\x09\xf9\xde\x23\x93\x99\x9b\x11\x47\x68\xd5\x10\xd7\x34\xfd\x72\xd1\x98\xb2\x61\xbd\x61\x81\x14\xbf\x3f\xa3\xe2\xfe\x84\xff\xe6\x5c\x80\xe4\x72\x12\xc4\x9e\x47\xbb\x3a\xaa\x86\x89\x46\x2f\x21\xd5\x18\x80\xd9\x7c\xb4\x45\xd3", 136);
(void)res;
break;
case 11:
memcpy((void*)0x200000c0, "\xc4\xa1\x84\x58\x2c\xaa\x26\x44\x0f\xae\x04\xc4\x41\x0f\x74\xab\x00\x00\x01\x00\xc4\x23\xf5\x78\x4c\xe9\x9d\x40\x44\xdf\x34\x59\x26\x41\x0f\xae\x41\x01\x64\x64\x66\x44\x0f\xe5\xb9\x4e\x9a\xb0\xc4\xc4\x22\x7d\x47\x0f\x41\x0f\x45\x7f\x56\x66\x0f\xdd\xe8", 63);
res = syz_execute_func(0x200000c0);
fprintf(stderr, "### call=11 errno=%u\n", res == -1 ? errno : 0);
break;
case 12:
(void)res;
break;
case 13:
memcpy((void*)0x20000140, "\x64\xd3\x2f\x16\xeb\xd8\x17\xd0\x04\xdc\xb8\x01\x71\x82\x05\xbc\xa1\xd8\x6d\xad\x3c\xb1\x32\xa2\x86\x60\x92\x14\xb7\x39\x5a\x97\xa0\xe8\xfe\xda\x5f\xad\x02\xcc\xe9\xde\xea\x94\xd5\x5a\x75\x0c\x17\xb2\x34\x07\x50\x02\xb9\xdf\x62\x9f\xa6\x8e\x3f\x7d\xa9\x7e\x9c\x2a\x2e\x0a\x95\xd1\x5d\x35\x95\x61\xb1\x47\x74\x40\x34\x2c\xd7\x9c\x7c\xeb\xd6\xbf\x00\x8a\xcd\x1c\x7f\xf1\x46\xa6\xfe\x22\x01\x36\x61\xd8\xc8\xce\x8e\xb1\x7f\x5c\xf3\x89\x2a\xe0\x8b\xba\x46\x54\x5b\x2b\x69\x0a\xb7\xe0\x36\x8a\xec\x4d\x32\xb7\x6d\x7f\xc1\x5d\xd7\xc2\xab\xa1\x84\xd4\x1a\x5e\x5a\xbb\x8d\x71\x6f\x5e\x64\x5e\x17\x67\x13\x8e\xd7\x38\xf3\x15\x79\x5a\xc9\x9e\x22\xfd\x44\xdb\x06\x09\x63\x13\xf4\x72\x9c\xe0\xd3\xbd\x93\x8f\x5b\x65\x20\xef\x93\x76\xfa\x90\x9d\xf6\xb2\x05\xc2\xd3\xf5\x2e\xe4\x3e\x3f\x59\xea\x44\x1b\x7c\x4e\x4d\x5c", 201);
memcpy((void*)0x20000240, "\xc1\xb0\x1d\x40\x73\x99\x35\xb1\x21\x7d\x0e\x39\x3c\xdd\x4f\xa4\xef\x8b\xbd\x99\x57\xee\x99\x68\x77\xe4\xca\x15\x5c\x19\x5d\xc1\x66\xf9\x48\x6a\xc4\xdb\x17\xf7\x54\xc4\x89\x38\xa4\x34\x19\xf0\x82\xa8\xc3\x0e\xff\xbe\xf0\x64\xf6\xc8\xb8\x7b\xc9\x30\xe4\x39\xc7\x19\xec\x0a\x11\x99\x04\x0b\x86\x28\x6d\x27\x1f\x25\xaf\x26\xeb\xed\x3f\x55\xc3\x2e\x68\xac\x70\x33\x0d\xf7\x69\x31\xbf\x55\xfa\xe8\x80\x25\x6b\x74\xa9\x23\xf8\xa3\x02\x2c\x31\x0f\x94\xcc\x0c\x62\x33\x02\xa5\xd1\x4b\x3f\x8e\x18\xf4\x15\x99\x88\x28\x66\xea\x02\x42\x86\x4b\x37\xd5\xae\x87\xfb\xcb\x74\x5c\x3e\x26\x42\x3d\x05\xc5\x48\x38\x33\xdf\xcd\xd4\x3d\xc0\xc6\x50\x73\x29\x03\x72\x73\xde\x28\x2e\x3a\x16\xac\x00\xc5\x53\x9c\x30\x94\x63\x98\x4b\x15\x3e\xc6\x25\x0a\x78\x19\x75\xa2\x77\x01\x72\x80\xdb\x1e\x9c\x18\xce\x66\x4d\xf5\x94\x7c\x6c\x18\xbe\xf2\x36\x7e\x61\x63\xb4\x6b\x95\x03\xf7\x00\x70\x5f\xd0\xe8\x9e\xae\x6d\xf0\x88\x4b\xf2\x7c\x00\xe0\x5f\xc5\xef\xc6\x49\x07", 234);
res = syz_usb_connect(0, 0xc9, 0x20000140, 0x20000240);
fprintf(stderr, "### call=13 errno=%u\n", res == -1 ? errno : 0);
break;
case 14:
memcpy((void*)0x20000340, "\x36\x4f\xb1\xa4\x17\x26\x3d\xe2\x27\x97\xec\x76\x08\x61\xf3\x85\x2c\xf2\x4f\x79\xe2\xb7\xa5\xc6\x2a\xfa\xd7\xd6\xd4\xd0\x9d\x86\x2f\x8e\xcc\xd0\x2e\x1b\xb9\x89\xe0\xf8\xa8\xad\x91\x54\x42\x01\x64\x04\xc9\x82\x6a\x5c\x0a\x28\x4f\xc7\xa8\x40\x30\x47\x59\xb6\x84\xf3\x57\xb2\xe6\xfe\xcf\xb3\xcc\x81\x57\xc0\x08\xff\x0d\xcf\xf2\x10\x89\x84\x54\x8a\x2a\xd6\x95\xfa\xd9\x51\x2f\x06\xfd\x12\xd6\x6b\xc4\x43\x04\x75\x12\xab\x4e\xf3\x05\x8a\xe6\xc0\xc6\xec\x3f\xd6\x27\xe3\x70\xa1\x51\xae\x71\x9b\x8e\x3a\x77\xd6\x82\xdc\x06\xa9\x3b\xe9\xc2\xaa\x80\x18\xb5\x8a\x94\x92\xcb\x39\x03\x1b\xb5\xab\xf3\x12\x4e\xaa\xb8\x53\x30\xf1\x81\xfc\xcc\xa7\x59\x7b\x4e\xc0\x87\x9f\xcb\xcf\x51\x14\x3f\x98\xc4\x43\xc1\x67\x20\xa6\xe0\x1b\x7e\x07\xdf\x47\x27\xe2\x88\xe1\x3d\xcc\x0b\x7e\x11", 191);
memcpy((void*)0x20000400, "\x59\x03\x92\x3c\x7a\x1b\x28\x38\xf3\xc1\x21\x56\x78\x5a\x11\xc8\x1b\x2e\x82\xd9\xa1\x19\x0e\x1b\x9c\x45\x97\x6a\x91\x7c\x00\x29\x4d\xc9\x4d\x53\x54\xe8\xc5\xd6\xa4\xe8\x98\x6d\xa0\x74\xeb\x46\x1e\xd0\x73\x6b\xcb\xed\xe2\xce\xf1\xf1\x9e\x02\x16\xc0\x9e\xb7\x94\xd8\xb9\x75\x4f\xea\x26\xf1\x10\xc8\x32\x48\xc2\x86\xea\xa0\x5a\x69\x84\x4e\xb1\x29\x2f\x59\x4f\x59\xf6\xc9\xbe\xca\x47\xd8\x94\xd4\x4d\xfd\x15\xff\x81\xb7\x6b\x46\x35\x39\x2e\xb5\xed\x43\x1c\xa3\x09\x22\x30", 117);
res = syz_usb_connect(4, 0xbf, 0x20000340, 0x20000400);
fprintf(stderr, "### call=14 errno=%u\n", res == -1 ? errno : 0);
if (res != -1)
r[6] = res;
break;
case 15:
res = syz_usb_disconnect(r[6]);
fprintf(stderr, "### call=15 errno=%u\n", res == -1 ? errno : 0);
break;
}
}
int main(void)
{
syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 3ul, 0x1012ul, -1, 0ul, 0ul);
use_temporary_dir();
do_sandbox_none();
return 0;
}
<stdin>:187:2: error: unknown type name 'uint8_t_t'
<stdin>:188:2: error: unknown type name 'uint8_t_t'
<stdin>:189:2: error: unknown type name 'uint8_t_t'
<stdin>:190:2: error: unknown type name 'uint8_t_t'
<stdin>:191:2: error: unknown type name 'uint16_t_t'
<stdin>:192:2: error: unknown type name 'uint8_t_t'
<stdin>:193:2: error: unknown type name 'uint8_t_t'
<stdin>:194:2: error: unknown type name 'uint8_t_t'
<stdin>:198:2: error: unknown type name 'uint8_t_t'
<stdin>:199:2: error: unknown type name 'uint8_t_t'
<stdin>:200:2: error: unknown type name 'uint16_t_t'
<stdin>:201:2: error: unknown type name 'uint8_t_t'
<stdin>:202:2: error: unknown type name 'uint8_t_t'
<stdin>:203:2: error: unknown type name 'uint8_t_t'
<stdin>:204:2: error: unknown type name 'uint8_t_t'
<stdin>:205:2: error: unknown type name 'uint16_t_t'
<stdin>:206:2: error: unknown type name 'uint16_t_t'
<stdin>:207:2: error: unknown type name 'uint16_t_t'
<stdin>:208:2: error: unknown type name 'uint8_t_t'
<stdin>:209:2: error: unknown type name 'uint8_t_t'
<stdin>:210:2: error: unknown type name 'uint8_t_t'
<stdin>:211:2: error: unknown type name 'uint8_t_t'
<stdin>:215:2: error: unknown type name 'uint8_t_t'
<stdin>:216:2: error: unknown type name 'uint8_t_t'
<stdin>:217:2: error: unknown type name 'uint16_t_t'
<stdin>:218:2: error: unknown type name 'uint8_t_t'
<stdin>:219:2: error: unknown type name 'uint8_t_t'
<stdin>:220:2: error: unknown type name 'uint8_t_t'
<stdin>:221:2: error: unknown type name 'uint8_t_t'
<stdin>:222:2: error: unknown type name 'uint8_t_t'
<stdin>:226:2: error: unknown type name 'uint8_t_t'
<stdin>:227:2: error: unknown type name 'uint8_t_t'
<stdin>:228:2: error: unknown type name 'uint8_t_t'
<stdin>:229:2: error: unknown type name 'uint8_t_t'
<stdin>:230:2: error: unknown type name 'uint8_t_t'
<stdin>:231:2: error: unknown type name 'uint8_t_t'
<stdin>:232:2: error: unknown type name 'uint8_t_t'
<stdin>:233:2: error: unknown type name 'uint8_t_t'
<stdin>:234:2: error: unknown type name 'uint8_t_t'
<stdin>:238:2: error: unknown type name 'uint8_t_t'
<stdin>:239:2: error: unknown type name 'uint8_t_t'
<stdin>:240:2: error: unknown type name 'uint16_t_t'
<stdin>:241:2: error: unknown type name 'uint16_t_t'
<stdin>:242:2: error: unknown type name 'uint16_t_t'
<stdin>:246:2: error: unknown type name 'uint8_t_t'
<stdin>:247:2: error: unknown type name 'uint8_t_t'
<stdin>:248:2: error: unknown type name 'uint16_t_t'
<stdin>:249:2: error: unknown type name 'uint8_t_t'
<stdin>:250:2: error: unknown type name 'uint8_t_t'
<stdin>:251:2: error: unknown type name 'uint8_t_t'
<stdin>:252:2: error: unknown type name 'uint8_t_t'
<stdin>:253:2: error: unknown type name 'uint8_t_t'
<stdin>:254:2: error: unknown type name 'uint8_t_t'
<stdin>: In function 'vhci_usb_recv':
<stdin>:561:2: error: unknown type name 'uint8_t_t'; did you mean 'uint8_t'?
<stdin>:561:20: error: 'uint8_t_t' undeclared (first use in this function); did you mean 'uint8_t'?
<stdin>:561:20: note: each undeclared identifier is reported only once for each function it appears in
<stdin>:561:30: error: expected expression before ')' token
<stdin>: In function 'vhci_usb_send':
<stdin>:576:2: error: unknown type name 'uint8_t_t'; did you mean 'uint8_t'?
<stdin>:576:20: error: 'uint8_t_t' undeclared (first use in this function); did you mean 'uint8_t'?
<stdin>:576:30: error: expected expression before ')' token
<stdin>: In function 'syz_usb_connect_impl':
<stdin>:637:63: error: unknown type name 'usb_ctrlrequest'
<stdin>:642:55: error: unknown type name 'usb_ctrlrequest'
<stdin>:654:8: error: 'uint32_t_t' undeclared (first use in this function); did you mean 'uint32_t'?
At top level:
<stdin>:702:13: error: 'setup_usb' defined but not used [-Werror=unused-function]
cc1: all warnings being treated as errors
compiler invocation: /syzkaller/netbsd/src/../tools/bin/x86_64--netbsd-g++ [-o /tmp/syz-executor381236982 -DGOOS_netbsd=1 -DGOARCH_amd64=1 -DHOSTGOOS_linux=1 -x c - -m64 --sysroot /syzkaller/netbsd/src/../dest/ -O2 -pthread -Wall -Werror -Wparentheses -Wframe-larger-than=16384]
--- FAIL: TestGenerate/netbsd/amd64/14 (0.77s)
csource_test.go:123: opts: {Threaded:true Collide:true Repeat:true RepeatTimes:0 Procs:2 Sandbox:none Fault:false FaultCall:0 FaultNth:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false USB:false UseTmpDir:true HandleSegv:false Repro:true Trace:false}
program:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
writev(r0, &(0x7f00000002c0)=[{&(0x7f0000000000)="25c5f6768692f16a6b02337bc5f24e95c2e574f7bd23da78ff2241439caced122e33ab16d377843415781fa508cd635f2fd04113204ed9bda7396e99a38a2f10e9c7398b5a64c49d98664bd14975be7076a83638a7da3095f0e027bd161ccd5c994f8b31d535a3ce4c57812d9682f3ebb10e05a7142210515b668d1357d91aaabb6ad88aed6b9f2143d062e0b5", 0x8d}, {&(0x7f00000000c0)="e8987e8f864e9d38b55615b659d14cae9e91a9532213ffb465b61b", 0x1b}, {&(0x7f0000000100)="3f97992c940fba8936a6b4", 0xb}, {&(0x7f0000000140)="c99ab604eb2e44ebf7bfb7b04c084321a30f4351aeb0676bb21aefc3bc2322d99a5b034f880aa25d61ae4076397c30357b22ccb779ebd3206ac648fab90836dd4d9e73dc3c077270b57dc3222284dd3cae4737957d947d765a5e0e919cbd3ef2d3d9522a827f3fe60ddc", 0x6a}, {&(0x7f00000001c0)="2bc5a9fd6cc3450082405ab607a0f5627b40589a690ac59158acf10f2a1cc46152fa5f493a8599cc6eaab5d96968bef1a27f62dacf64d06c80cfb5b320b977c9432c446fa6f6551444ee4c5998853260d65d2cb3c778f44fe270363b4eb309e24fc47797b5bd454bf4d3d4656fa078ff56b30f4f0e9d5e6e8943830ad6d342968c224f7c35af01a61d10e155fee7e0227cd79a7977b3f40351ca01834840abba557d36bc8a4208f90dc5f51e3f3d445c5feea79368164edef05d24748ce9f0a58451b43d9891902bc45ec67d00df1deb74e65b29c0d095dbdd5b9a7c", 0xdc}], 0x5)
getgroups(0x3, &(0x7f0000000340)=[0x0, 0xffffffffffffffff, <r1=>0x0])
getsockopt$sock_cred(0xffffffffffffffff, 0xffff, 0x11, &(0x7f0000000380)={0x0, 0x0, <r2=>0x0}, &(0x7f00000003c0)=0xc)
setregid(r1, r2)
r3 = semget(0x1, 0x0, 0xb2603d964b180ce8)
stat(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, <r4=>0x0})
r5 = getgid()
semctl$IPC_SET(r3, 0x0, 0x1, &(0x7f0000000500)={{0xfffff834, r4, r5, 0xffffffffffffffff, 0x0, 0x3, 0x9}, 0xfffffffffffffffd, 0x4535, 0x2})
seteuid(0x0)
syz_emit_ethernet(0x88, &(0x7f0000000000)="bf5bc2c4ddcd9baa7f7c66f91726a8c490f69185140b5b4251e86701c6c5a60d84802d382a0c38df4a28fd840d7e1406a5c2eb5d3b6bc323bd49386c4a924950314fe617f8cd3437a4aa6d1c6d62640309f9de2393999b114768d510d734fd72d198b261bd618114bf3fa3e2fe84ffe65c80e47212c49e47bb3aaa8689462f21d51880d97cb445d3")
syz_execute_func(&(0x7f00000000c0)="c4a184582caa26440fae04c4410f74ab00000100c423f5784ce99d4044df345926410fae4101646466440fe5b94e9ab0c4c4227d470f410f457f56660fdde8")
syz_extract_tcp_res(&(0x7f0000000100), 0x6, 0x1)
syz_usb_connect(0x0, 0xc9, &(0x7f0000000140)="64d32f16ebd817d004dcb801718205bca1d86dad3cb132a286609214b7395a97a0e8feda5fad02cce9deea94d55a750c17b234075002b9df629fa68e3f7da97e9c2a2e0a95d15d359561b1477440342cd79c7cebd6bf008acd1c7ff146a6fe22013661d8c8ce8eb17f5cf3892ae08bba46545b2b690ab7e0368aec4d32b76d7fc15dd7c2aba184d41a5e5abb8d716f5e645e1767138ed738f315795ac99e22fd44db06096313f4729ce0d3bd938f5b6520ef9376fa909df6b205c2d3f52ee43e3f59ea441b7c4e4d5c", &(0x7f0000000240)="c1b01d40739935b1217d0e393cdd4fa4ef8bbd9957ee996877e4ca155c195dc166f9486ac4db17f754c48938a43419f082a8c30effbef064f6c8b87bc930e439c719ec0a1199040b86286d271f25af26ebed3f55c32e68ac70330df76931bf55fae880256b74a923f8a3022c310f94cc0c623302a5d14b3f8e18f41599882866ea0242864b37d5ae87fbcb745c3e26423d05c5483833dfcdd43dc0c6507329037273de282e3a16ac00c5539c309463984b153ec6250a781975a277017280db1e9c18ce664df5947c6c18bef2367e6163b46b9503f700705fd0e89eae6df0884bf27c00e05fc5efc64907")
r6 = syz_usb_connect(0x4, 0xbf, &(0x7f0000000340)="364fb1a417263de22797ec760861f3852cf24f79e2b7a5c62afad7d6d4d09d862f8eccd02e1bb989e0f8a8ad915442016404c9826a5c0a284fc7a840304759b684f357b2e6fecfb3cc8157c008ff0dcff2108984548a2ad695fad9512f06fd12d66bc443047512ab4ef3058ae6c0c6ec3fd627e370a151ae719b8e3a77d682dc06a93be9c2aa8018b58a9492cb39031bb5abf3124eaab85330f181fccca7597b4ec0879fcbcf51143f98c443c16720a6e01b7e07df4727e288e13dcc0b7e11", &(0x7f0000000400)="5903923c7a1b2838f3c12156785a11c81b2e82d9a1190e1b9c45976a917c00294dc94d5354e8c5d6a4e8986da074eb461ed0736bcbede2cef1f19e0216c09eb794d8b9754fea26f110c83248c286eaa05a69844eb1292f594f59f6c9beca47d894d44dfd15ff81b76b4635392eb5ed431ca3092230")
syz_usb_disconnect(r6)
csource_test.go:124: failed to build program:
// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <dev/usb/usb.h>
#include <dev/usb/usbhid.h>
#include <dev/usb/vhci.h>
#include <dirent.h>
#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <pthread.h>
#include <pwd.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ioctl.h>
#include <sys/resource.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>
static unsigned long long procid;
static void kill_and_wait(int pid, int* status)
{
kill(pid, SIGKILL);
while (waitpid(-1, status, 0) != pid) {
}
}
static void sleep_ms(uint64_t ms)
{
usleep(ms * 1000);
}
static uint64_t current_time_ms(void)
{
struct timespec ts;
if (clock_gettime(CLOCK_MONOTONIC, &ts))
exit(1);
return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}
static void use_temporary_dir(void)
{
char tmpdir_template[] = "./syzkaller.XXXXXX";
char* tmpdir = mkdtemp(tmpdir_template);
if (!tmpdir)
exit(1);
if (chmod(tmpdir, 0777))
exit(1);
if (chdir(tmpdir))
exit(1);
}
static void remove_dir(const char* dir)
{
DIR* dp;
struct dirent* ep;
dp = opendir(dir);
if (dp == NULL)
exit(1);
while ((ep = readdir(dp))) {
if (strcmp(ep->d_name, ".") == 0 || strcmp(ep->d_name, "..") == 0)
continue;
char filename[FILENAME_MAX];
snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name);
struct stat st;
if (lstat(filename, &st))
exit(1);
if (S_ISDIR(st.st_mode)) {
remove_dir(filename);
continue;
}
if (unlink(filename))
exit(1);
}
closedir(dp);
if (rmdir(dir))
exit(1);
}
static void thread_start(void* (*fn)(void*), void* arg)
{
pthread_t th;
pthread_attr_t attr;
pthread_attr_init(&attr);
pthread_attr_setstacksize(&attr, 128 << 10);
int i;
for (i = 0; i < 100; i++) {
if (pthread_create(&th, &attr, fn, arg) == 0) {
pthread_attr_destroy(&attr);
return;
}
if (errno == EAGAIN) {
usleep(50);
continue;
}
break;
}
exit(1);
}
typedef struct {
pthread_mutex_t mu;
pthread_cond_t cv;
int state;
} event_t;
static void event_init(event_t* ev)
{
if (pthread_mutex_init(&ev->mu, 0))
exit(1);
if (pthread_cond_init(&ev->cv, 0))
exit(1);
ev->state = 0;
}
static void event_reset(event_t* ev)
{
ev->state = 0;
}
static void event_set(event_t* ev)
{
pthread_mutex_lock(&ev->mu);
if (ev->state)
exit(1);
ev->state = 1;
pthread_mutex_unlock(&ev->mu);
pthread_cond_broadcast(&ev->cv);
}
static void event_wait(event_t* ev)
{
pthread_mutex_lock(&ev->mu);
while (!ev->state)
pthread_cond_wait(&ev->cv, &ev->mu);
pthread_mutex_unlock(&ev->mu);
}
static int event_isset(event_t* ev)
{
pthread_mutex_lock(&ev->mu);
int res = ev->state;
pthread_mutex_unlock(&ev->mu);
return res;
}
static int event_timedwait(event_t* ev, uint64_t timeout)
{
uint64_t start = current_time_ms();
uint64_t now = start;
pthread_mutex_lock(&ev->mu);
for (;;) {
if (ev->state)
break;
uint64_t remain = timeout - (now - start);
struct timespec ts;
ts.tv_sec = remain / 1000;
ts.tv_nsec = (remain % 1000) * 1000 * 1000;
pthread_cond_timedwait(&ev->cv, &ev->mu, &ts);
now = current_time_ms();
if (now - start > timeout)
break;
}
int res = ev->state;
pthread_mutex_unlock(&ev->mu);
return res;
}
/* -------------------------------------------------------------------------- */
/*
* Redefinitions to match the linux types used in common_usb.h.
*/
struct usb_endpoint_descriptor {
uint8_t_t bLength;
uint8_t_t bDescriptorType;
uint8_t_t bEndpointAddress;
uint8_t_t bmAttributes;
uint16_t_t wMaxPacketSize;
uint8_t_t bInterval;
uint8_t_t bRefresh;
uint8_t_t bSynchAddress;
} __attribute__((packed));
struct usb_device_descriptor {
uint8_t_t bLength;
uint8_t_t bDescriptorType;
uint16_t_t bcdUSB;
uint8_t_t bDeviceClass;
uint8_t_t bDeviceSubClass;
uint8_t_t bDeviceProtocol;
uint8_t_t bMaxPacketSize0;
uint16_t_t idVendor;
uint16_t_t idProduct;
uint16_t_t bcdDevice;
uint8_t_t iManufacturer;
uint8_t_t iProduct;
uint8_t_t iSerialNumber;
uint8_t_t bNumConfigurations;
} __attribute__((packed));
struct usb_config_descriptor {
uint8_t_t bLength;
uint8_t_t bDescriptorType;
uint16_t_t wTotalLength;
uint8_t_t bNumInterfaces;
uint8_t_t bConfigurationValue;
uint8_t_t iConfiguration;
uint8_t_t bmAttributes;
uint8_t_t bMaxPower;
} __attribute__((packed));
struct usb_interface_descriptor {
uint8_t_t bLength;
uint8_t_t bDescriptorType;
uint8_t_t bInterfaceNumber;
uint8_t_t bAlternateSetting;
uint8_t_t bNumEndpoints;
uint8_t_t bInterfaceClass;
uint8_t_t bInterfaceSubClass;
uint8_t_t bInterfaceProtocol;
uint8_t_t iInterface;
} __attribute__((packed));
struct usb_ctrlrequest {
uint8_t_t bRequestType;
uint8_t_t bRequest;
uint16_t_t wValue;
uint16_t_t wIndex;
uint16_t_t wLength;
} __attribute__((packed));
struct usb_qualifier_descriptor {
uint8_t_t bLength;
uint8_t_t bDescriptorType;
uint16_t_t bcdUSB;
uint8_t_t bDeviceClass;
uint8_t_t bDeviceSubClass;
uint8_t_t bDeviceProtocol;
uint8_t_t bMaxPacketSize0;
uint8_t_t bNumConfigurations;
uint8_t_t bRESERVED;
} __attribute__((packed));
#define USB_TYPE_MASK (0x03 << 5)
#define USB_TYPE_STANDARD (0x00 << 5)
#define USB_TYPE_CLASS (0x01 << 5)
#define USB_TYPE_VENDOR (0x02 << 5)
#define USB_TYPE_RESERVED (0x03 << 5)
#define USB_DT_DEVICE 0x01
#define USB_DT_CONFIG 0x02
#define USB_DT_STRING 0x03
#define USB_DT_INTERFACE 0x04
#define USB_DT_ENDPOINT 0x05
#define USB_DT_DEVICE_QUALIFIER 0x06
#define USB_DT_OTHER_SPEED_CONFIG 0x07
#define USB_DT_INTERFACE_POWER 0x08
#define USB_DT_OTG 0x09
#define USB_DT_DEBUG 0x0a
#define USB_DT_INTERFACE_ASSOCIATION 0x0b
#define USB_DT_SECURITY 0x0c
#define USB_DT_KEY 0x0d
#define USB_DT_ENCRYPTION_TYPE 0x0e
#define USB_DT_BOS 0x0f
#define USB_DT_DEVICE_CAPABILITY 0x10
#define USB_DT_WIRELESS_ENDPOINT_COMP 0x11
#define USB_DT_WIRE_ADAPTER 0x21
#define USB_DT_RPIPE 0x22
#define USB_DT_CS_RADIO_CONTROL 0x23
#define USB_DT_PIPE_USAGE 0x24
#define USB_DT_SS_ENDPOINT_COMP 0x30
#define USB_DT_SSP_ISOC_ENDPOINT_COMP 0x31
#define USB_REQ_GET_STATUS 0x00
#define USB_REQ_CLEAR_FEATURE 0x01
#define USB_REQ_SET_FEATURE 0x03
#define USB_REQ_SET_ADDRESS 0x05
#define USB_REQ_GET_DESCRIPTOR 0x06
#define USB_REQ_SET_DESCRIPTOR 0x07
#define USB_REQ_GET_CONFIGURATION 0x08
#define USB_REQ_SET_CONFIGURATION 0x09
#define USB_REQ_GET_INTERFACE 0x0A
#define USB_REQ_SET_INTERFACE 0x0B
#define USB_REQ_SYNCH_FRAME 0x0C
#define USB_REQ_SET_SEL 0x30
#define USB_REQ_SET_ISOCH_DELAY 0x31
#define USB_REQ_SET_ENCRYPTION 0x0D
#define USB_REQ_GET_ENCRYPTION 0x0E
#define USB_REQ_RPIPE_ABORT 0x0E
#define USB_REQ_SET_HANDSHAKE 0x0F
#define USB_REQ_RPIPE_RESET 0x0F
#define USB_REQ_GET_HANDSHAKE 0x10
#define USB_REQ_SET_CONNECTION 0x11
#define USB_REQ_SET_SECURITY_DATA 0x12
#define USB_REQ_GET_SECURITY_DATA 0x13
#define USB_REQ_SET_WUSB_DATA 0x14
#define USB_REQ_LOOPBACK_DATA_WRITE 0x15
#define USB_REQ_LOOPBACK_DATA_READ 0x16
#define USB_REQ_SET_INTERFACE_DS 0x17
#define USB_REQ_GET_PARTNER_PDO 20
#define USB_REQ_GET_BATTERY_STATUS 21
#define USB_REQ_SET_PDO 22
#define USB_REQ_GET_VDM 23
#define USB_REQ_SEND_VDM 24
#define USB_MAX_IFACE_NUM 4
#define USB_MAX_EP_NUM 32
#define USB_MAX_FDS 6
struct usb_endpoint_index {
struct usb_endpoint_descriptor desc;
int handle;
};
struct usb_iface_index {
struct usb_interface_descriptor* iface;
uint8_t bInterfaceNumber;
uint8_t bAlternateSetting;
uint8_t bInterfaceClass;
struct usb_endpoint_index eps[USB_MAX_EP_NUM];
int eps_num;
};
struct usb_device_index {
struct usb_device_descriptor* dev;
struct usb_config_descriptor* config;
uint8_t bDeviceClass;
uint8_t bMaxPower;
int config_length;
struct usb_iface_index ifaces[USB_MAX_IFACE_NUM];
int ifaces_num;
int iface_cur;
};
struct usb_info {
int fd;
struct usb_device_index index;
};
static struct usb_info usb_devices[USB_MAX_FDS];
static int usb_devices_num;
static bool parse_usb_descriptor(const char* buffer, size_t length, struct usb_device_index* index)
{
if (length < sizeof(*index->dev) + sizeof(*index->config))
return false;
memset(index, 0, sizeof(*index));
index->dev = (struct usb_device_descriptor*)buffer;
index->config = (struct usb_config_descriptor*)(buffer + sizeof(*index->dev));
index->bDeviceClass = index->dev->bDeviceClass;
index->bMaxPower = index->config->bMaxPower;
index->config_length = length - sizeof(*index->dev);
index->iface_cur = -1;
size_t offset = 0;
while (true) {
if (offset + 1 >= length)
break;
uint8_t desc_length = buffer[offset];
uint8_t desc_type = buffer[offset + 1];
if (desc_length <= 2)
break;
if (offset + desc_length > length)
break;
if (desc_type == USB_DT_INTERFACE && index->ifaces_num < USB_MAX_IFACE_NUM) {
struct usb_interface_descriptor* iface = (struct usb_interface_descriptor*)(buffer + offset);
index->ifaces[index->ifaces_num].iface = iface;
index->ifaces[index->ifaces_num].bInterfaceNumber = iface->bInterfaceNumber;
index->ifaces[index->ifaces_num].bAlternateSetting = iface->bAlternateSetting;
index->ifaces[index->ifaces_num].bInterfaceClass = iface->bInterfaceClass;
index->ifaces_num++;
}
if (desc_type == USB_DT_ENDPOINT && index->ifaces_num > 0) {
struct usb_iface_index* iface = &index->ifaces[index->ifaces_num - 1];
if (iface->eps_num < USB_MAX_EP_NUM) {
memcpy(&iface->eps[iface->eps_num].desc, buffer + offset, sizeof(iface->eps[iface->eps_num].desc));
iface->eps_num++;
}
}
offset += desc_length;
}
return true;
}
static struct usb_device_index* add_usb_index(int fd, const char* dev, size_t dev_len)
{
int i = __atomic_fetch_add(&usb_devices_num, 1, __ATOMIC_RELAXED);
if (i >= USB_MAX_FDS)
return NULL;
int rv = 0;
rv = parse_usb_descriptor(dev, dev_len, &usb_devices[i].index);
if (!rv)
return NULL;
__atomic_store_n(&usb_devices[i].fd, fd, __ATOMIC_RELEASE);
return &usb_devices[i].index;
}
static struct usb_device_index* lookup_usb_index(int fd)
{
int i;
for (i = 0; i < USB_MAX_FDS; i++) {
if (__atomic_load_n(&usb_devices[i].fd, __ATOMIC_ACQUIRE) == fd) {
return &usb_devices[i].index;
}
}
return NULL;
}
struct vusb_connect_string_descriptor {
uint32_t len;
char* str;
} __attribute__((packed));
struct vusb_connect_descriptors {
uint32_t qual_len;
char* qual;
uint32_t bos_len;
char* bos;
uint32_t strs_len;
struct vusb_connect_string_descriptor strs[0];
} __attribute__((packed));
static const char default_string[] = {
8, USB_DT_STRING,
's', 0, 'y', 0, 'z', 0
};
static const char default_lang_id[] = {
4, USB_DT_STRING,
0x09, 0x04
};
static bool lookup_connect_response_in(int fd, const struct vusb_connect_descriptors* descs,
const struct usb_ctrlrequest* ctrl,
char** response_data, uint32_t* response_length)
{
struct usb_device_index* index = lookup_usb_index(fd);
uint8_t str_idx;
if (!index)
return false;
switch (ctrl->bRequestType & USB_TYPE_MASK) {
case USB_TYPE_STANDARD:
switch (ctrl->bRequest) {
case USB_REQ_GET_DESCRIPTOR:
switch (ctrl->wValue >> 8) {
case USB_DT_DEVICE:
*response_data = (char*)index->dev;
*response_length = sizeof(*index->dev);
return true;
case USB_DT_CONFIG:
*response_data = (char*)index->config;
*response_length = index->config_length;
return true;
case USB_DT_STRING:
str_idx = (uint8_t)ctrl->wValue;
if (descs && str_idx < descs->strs_len) {
*response_data = descs->strs[str_idx].str;
*response_length = descs->strs[str_idx].len;
return true;
}
if (str_idx == 0) {
*response_data = (char*)&default_lang_id[0];
*response_length = default_lang_id[0];
return true;
}
*response_data = (char*)&default_string[0];
*response_length = default_string[0];
return true;
case USB_DT_BOS:
*response_data = descs->bos;
*response_length = descs->bos_len;
return true;
case USB_DT_DEVICE_QUALIFIER:
if (!descs->qual) {
struct usb_qualifier_descriptor* qual =
(struct usb_qualifier_descriptor*)response_data;
qual->bLength = sizeof(*qual);
qual->bDescriptorType = USB_DT_DEVICE_QUALIFIER;
qual->bcdUSB = index->dev->bcdUSB;
qual->bDeviceClass = index->dev->bDeviceClass;
qual->bDeviceSubClass = index->dev->bDeviceSubClass;
qual->bDeviceProtocol = index->dev->bDeviceProtocol;
qual->bMaxPacketSize0 = index->dev->bMaxPacketSize0;
qual->bNumConfigurations = index->dev->bNumConfigurations;
qual->bRESERVED = 0;
*response_length = sizeof(*qual);
return true;
}
*response_data = descs->qual;
*response_length = descs->qual_len;
return true;
default:
break;
}
break;
default:
break;
}
break;
default:
break;
}
return false;
}
typedef bool (*lookup_connect_out_response_t)(int fd, const struct vusb_connect_descriptors* descs,
const struct usb_ctrlrequest* ctrl, bool* done);
static bool lookup_connect_response_out_generic(int fd, const struct vusb_connect_descriptors* descs,
const struct usb_ctrlrequest* ctrl, bool* done)
{
switch (ctrl->bRequestType & USB_TYPE_MASK) {
case USB_TYPE_STANDARD:
switch (ctrl->bRequest) {
case USB_REQ_SET_CONFIGURATION:
*done = true;
return true;
default:
break;
}
break;
}
return false;
}
/* -------------------------------------------------------------------------- */
static int vhci_open(void)
{
return open("/dev/vhci", O_RDWR);
}
static int vhci_setport(int fd, u_int port)
{
struct vhci_ioc_set_port args;
args.port = port;
return ioctl(fd, VHCI_IOC_SET_PORT, &args);
}
static int vhci_usb_attach(int fd)
{
return ioctl(fd, VHCI_IOC_USB_ATTACH, NULL);
}
static int vhci_usb_recv(int fd, void* buf, size_t size)
{
uint8_t_t* ptr = (uint8_t_t*)buf;
ssize_t done;
while (1) {
done = read(fd, ptr, size);
if (done < 0)
return -1;
if ((size_t)done == size)
return 0;
size -= done;
ptr += done;
}
}
static int vhci_usb_send(int fd, void* buf, size_t size)
{
uint8_t_t* ptr = (uint8_t_t*)buf;
ssize_t done;
while (1) {
done = write(fd, ptr, size);
if (done <= 0)
return -1;
if ((size_t)done == size)
return 0;
size -= done;
ptr += done;
}
}
/* -------------------------------------------------------------------------- */
static volatile long syz_usb_connect_impl(uint64_t speed, uint64_t dev_len,
const char* dev, const struct vusb_connect_descriptors* descs,
lookup_connect_out_response_t lookup_connect_response_out)
{
struct usb_device_index* index;
int portnum, fd, rv;
bool done;
portnum = procid + 1;
if (!dev) {
return -1;
}
if (portnum != 1) {
/* For now, we support only one proc. */
return -1;
}
fd = vhci_open();
if (fd < 0) {
return -1;
}
index = add_usb_index(fd, dev, dev_len);
if (!index) {
goto err;
}
rv = vhci_setport(fd, portnum);
if (rv != 0) {
goto err;
}
rv = vhci_usb_attach(fd);
if (rv != 0) {
goto err;
}
done = false;
while (!done) {
vhci_request_t req;
rv = vhci_usb_recv(fd, &req, sizeof(req));
if (rv != 0) {
goto err;
}
if (req.type != VHCI_REQ_CTRL) {
goto err;
}
char* response_data = NULL;
uint32_t response_length = 0;
char data[4096];
if (req.u.ctrl.bmRequestType & UE_DIR_IN) {
bool response_found = false;
response_found = lookup_connect_response_in(fd, descs, (const usb_ctrlrequest*)&req.u.ctrl, &response_data, &response_length);
if (!response_found) {
goto err;
}
} else {
if (!lookup_connect_response_out(fd, descs, (const usb_ctrlrequest*)&req.u.ctrl, &done)) {
goto err;
}
response_data = NULL;
response_length = UGETW(req.u.ctrl.wLength);
}
if ((req.u.ctrl.bmRequestType & USB_TYPE_MASK) == USB_TYPE_STANDARD &&
req.u.ctrl.bRequest == USB_REQ_SET_CONFIGURATION) {
/* TODO: possibly revisit */
}
if (response_length > sizeof(data))
response_length = 0;
if ((uint32_t_t)UGETW(req.u.ctrl.wLength) < response_length)
response_length = UGETW(req.u.ctrl.wLength);
if (response_data)
memcpy(data, response_data, response_length);
else
memset(data, 0, response_length);
if (req.u.ctrl.bmRequestType & UE_DIR_IN) {
if (response_length > 0) {
vhci_response_t res;
res.size = response_length;
rv = vhci_usb_send(fd, &res, sizeof(res));
if (rv == 0)
rv = vhci_usb_send(fd, data, response_length);
}
} else {
rv = vhci_usb_recv(fd, data, response_length);
}
if (rv < 0) {
goto err;
}
}
sleep_ms(200);
return fd;
err:
close(fd);
return -1;
}
static volatile long syz_usb_connect(volatile long a0, volatile long a1,
volatile long a2, volatile long a3)
{
uint64_t speed = a0;
uint64_t dev_len = a1;
const char* dev = (const char*)a2;
const struct vusb_connect_descriptors* descs = (const struct vusb_connect_descriptors*)a3;
return syz_usb_connect_impl(speed, dev_len, dev, descs,
&lookup_connect_response_out_generic);
}
static volatile long syz_usb_disconnect(volatile long a0)
{
int fd = a0;
int rv = close(fd);
sleep_ms(200);
return rv;
}
static void setup_usb(void)
{
if (chmod("/dev/vhci", 0666))
exit(1);
}
static void sandbox_common()
{
if (setsid() == -1)
exit(1);
struct rlimit rlim;
rlim.rlim_cur = rlim.rlim_max = 8 << 20;
setrlimit(RLIMIT_MEMLOCK, &rlim);
rlim.rlim_cur = rlim.rlim_max = 1 << 20;
setrlimit(RLIMIT_FSIZE, &rlim);
rlim.rlim_cur = rlim.rlim_max = 1 << 20;
setrlimit(RLIMIT_STACK, &rlim);
rlim.rlim_cur = rlim.rlim_max = 0;
setrlimit(RLIMIT_CORE, &rlim);
rlim.rlim_cur = rlim.rlim_max = 256;
setrlimit(RLIMIT_NOFILE, &rlim);
}
static void loop();
static int do_sandbox_none(void)
{
sandbox_common();
loop();
return 0;
}
static long syz_execute_func(volatile long text)
{
volatile long p[8] = {0};
(void)p;
asm volatile("" ::"r"(0l), "r"(1l), "r"(2l), "r"(3l), "r"(4l), "r"(5l), "r"(6l),
"r"(7l), "r"(8l), "r"(9l), "r"(10l), "r"(11l), "r"(12l), "r"(13l));
((void (*)(void))(text))();
return 0;
}
struct thread_t {
int created, call;
event_t ready, done;
};
static struct thread_t threads[16];
static void execute_call(int call);
static int running;
static void* thr(void* arg)
{
struct thread_t* th = (struct thread_t*)arg;
for (;;) {
event_wait(&th->ready);
event_reset(&th->ready);
execute_call(th->call);
__atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED);
event_set(&th->done);
}
return 0;
}
static void execute_one(void)
{
if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {
}
int i, call, thread;
int collide = 0;
again:
for (call = 0; call < 16; call++) {
for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0])); thread++) {
struct thread_t* th = &threads[thread];
if (!th->created) {
th->created = 1;
event_init(&th->ready);
event_init(&th->done);
event_set(&th->done);
thread_start(thr, th);
}
if (!event_isset(&th->done))
continue;
event_reset(&th->done);
th->call = call;
__atomic_fetch_add(&running, 1, __ATOMIC_RELAXED);
event_set(&th->ready);
if (collide && (call % 2) == 0)
break;
event_timedwait(&th->done, 45 + (call == 13 ? 3000 : 0) + (call == 14 ? 3000 : 0) + (call == 15 ? 300 : 0));
break;
}
}
for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++)
sleep_ms(1);
if (!collide) {
collide = 1;
goto again;
}
}
static void execute_one(void);
#define WAIT_FLAGS 0
static void loop(void)
{
int iter;
for (iter = 0;; iter++) {
char cwdbuf[32];
sprintf(cwdbuf, "./%d", iter);
if (mkdir(cwdbuf, 0777))
exit(1);
int pid = fork();
if (pid < 0)
exit(1);
if (pid == 0) {
if (chdir(cwdbuf))
exit(1);
execute_one();
exit(0);
}
int status = 0;
uint64_t start = current_time_ms();
for (;;) {
if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
break;
sleep_ms(1);
if (current_time_ms() - start < 5 * 1000)
continue;
kill_and_wait(pid, &status);
break;
}
remove_dir(cwdbuf);
}
}
#ifndef SYS_dup2
#define SYS_dup2 90
#endif
#ifndef SYS_getgid
#define SYS_getgid 47
#endif
#ifndef SYS_getgroups
#define SYS_getgroups 79
#endif
#ifndef SYS_getsockopt
#define SYS_getsockopt 118
#endif
#ifndef SYS_mmap
#define SYS_mmap 197
#endif
#ifndef SYS_semctl
#define SYS_semctl 442
#endif
#ifndef SYS_semget
#define SYS_semget 221
#endif
#ifndef SYS_seteuid
#define SYS_seteuid 183
#endif
#ifndef SYS_setregid
#define SYS_setregid 127
#endif
#ifndef SYS_stat
#define SYS_stat 439
#endif
#ifndef SYS_writev
#define SYS_writev 121
#endif
uint64_t r[7] = {0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff};
void execute_call(int call)
{
intptr_t res = 0;
switch (call) {
case 0:
res = syscall(SYS_dup2, -1, 0xffffff9c);
if (res != -1)
r[0] = res;
break;
case 1:
*(uint64_t*)0x200002c0 = 0x20000000;
memcpy((void*)0x20000000, "\x25\xc5\xf6\x76\x86\x92\xf1\x6a\x6b\x02\x33\x7b\xc5\xf2\x4e\x95\xc2\xe5\x74\xf7\xbd\x23\xda\x78\xff\x22\x41\x43\x9c\xac\xed\x12\x2e\x33\xab\x16\xd3\x77\x84\x34\x15\x78\x1f\xa5\x08\xcd\x63\x5f\x2f\xd0\x41\x13\x20\x4e\xd9\xbd\xa7\x39\x6e\x99\xa3\x8a\x2f\x10\xe9\xc7\x39\x8b\x5a\x64\xc4\x9d\x98\x66\x4b\xd1\x49\x75\xbe\x70\x76\xa8\x36\x38\xa7\xda\x30\x95\xf0\xe0\x27\xbd\x16\x1c\xcd\x5c\x99\x4f\x8b\x31\xd5\x35\xa3\xce\x4c\x57\x81\x2d\x96\x82\xf3\xeb\xb1\x0e\x05\xa7\x14\x22\x10\x51\x5b\x66\x8d\x13\x57\xd9\x1a\xaa\xbb\x6a\xd8\x8a\xed\x6b\x9f\x21\x43\xd0\x62\xe0\xb5", 141);
*(uint64_t*)0x200002c8 = 0x8d;
*(uint64_t*)0x200002d0 = 0x200000c0;
memcpy((void*)0x200000c0, "\xe8\x98\x7e\x8f\x86\x4e\x9d\x38\xb5\x56\x15\xb6\x59\xd1\x4c\xae\x9e\x91\xa9\x53\x22\x13\xff\xb4\x65\xb6\x1b", 27);
*(uint64_t*)0x200002d8 = 0x1b;
*(uint64_t*)0x200002e0 = 0x20000100;
memcpy((void*)0x20000100, "\x3f\x97\x99\x2c\x94\x0f\xba\x89\x36\xa6\xb4", 11);
*(uint64_t*)0x200002e8 = 0xb;
*(uint64_t*)0x200002f0 = 0x20000140;
memcpy((void*)0x20000140, "\xc9\x9a\xb6\x04\xeb\x2e\x44\xeb\xf7\xbf\xb7\xb0\x4c\x08\x43\x21\xa3\x0f\x43\x51\xae\xb0\x67\x6b\xb2\x1a\xef\xc3\xbc\x23\x22\xd9\x9a\x5b\x03\x4f\x88\x0a\xa2\x5d\x61\xae\x40\x76\x39\x7c\x30\x35\x7b\x22\xcc\xb7\x79\xeb\xd3\x20\x6a\xc6\x48\xfa\xb9\x08\x36\xdd\x4d\x9e\x73\xdc\x3c\x07\x72\x70\xb5\x7d\xc3\x22\x22\x84\xdd\x3c\xae\x47\x37\x95\x7d\x94\x7d\x76\x5a\x5e\x0e\x91\x9c\xbd\x3e\xf2\xd3\xd9\x52\x2a\x82\x7f\x3f\xe6\x0d\xdc", 106);
*(uint64_t*)0x200002f8 = 0x6a;
*(uint64_t*)0x20000300 = 0x200001c0;
memcpy((void*)0x200001c0, "\x2b\xc5\xa9\xfd\x6c\xc3\x45\x00\x82\x40\x5a\xb6\x07\xa0\xf5\x62\x7b\x40\x58\x9a\x69\x0a\xc5\x91\x58\xac\xf1\x0f\x2a\x1c\xc4\x61\x52\xfa\x5f\x49\x3a\x85\x99\xcc\x6e\xaa\xb5\xd9\x69\x68\xbe\xf1\xa2\x7f\x62\xda\xcf\x64\xd0\x6c\x80\xcf\xb5\xb3\x20\xb9\x77\xc9\x43\x2c\x44\x6f\xa6\xf6\x55\x14\x44\xee\x4c\x59\x98\x85\x32\x60\xd6\x5d\x2c\xb3\xc7\x78\xf4\x4f\xe2\x70\x36\x3b\x4e\xb3\x09\xe2\x4f\xc4\x77\x97\xb5\xbd\x45\x4b\xf4\xd3\xd4\x65\x6f\xa0\x78\xff\x56\xb3\x0f\x4f\x0e\x9d\x5e\x6e\x89\x43\x83\x0a\xd6\xd3\x42\x96\x8c\x22\x4f\x7c\x35\xaf\x01\xa6\x1d\x10\xe1\x55\xfe\xe7\xe0\x22\x7c\xd7\x9a\x79\x77\xb3\xf4\x03\x51\xca\x01\x83\x48\x40\xab\xba\x55\x7d\x36\xbc\x8a\x42\x08\xf9\x0d\xc5\xf5\x1e\x3f\x3d\x44\x5c\x5f\xee\xa7\x93\x68\x16\x4e\xde\xf0\x5d\x24\x74\x8c\xe9\xf0\xa5\x84\x51\xb4\x3d\x98\x91\x90\x2b\xc4\x5e\xc6\x7d\x00\xdf\x1d\xeb\x74\xe6\x5b\x29\xc0\xd0\x95\xdb\xdd\x5b\x9a\x7c", 220);
*(uint64_t*)0x20000308 = 0xdc;
syscall(SYS_writev, r[0], 0x200002c0ul, 5ul);
break;
case 2:
*(uint32_t*)0x20000340 = 0;
*(uint32_t*)0x20000344 = -1;
*(uint32_t*)0x20000348 = 0;
res = syscall(SYS_getgroups, 3ul, 0x20000340ul);
if (res != -1)
r[1] = *(uint32_t*)0x20000348;
break;
case 3:
*(uint32_t*)0x200003c0 = 0xc;
res = syscall(SYS_getsockopt, -1, 0xffff, 0x11, 0x20000380ul, 0x200003c0ul);
if (res != -1)
r[2] = *(uint32_t*)0x20000388;
break;
case 4:
syscall(SYS_setregid, r[1], r[2]);
break;
case 5:
res = syscall(SYS_semget, 0x798e2634ul + procid*4, 0ul, 0xb2603d964b180ce8ul);
if (res != -1)
r[3] = res;
break;
case 6:
memcpy((void*)0x20000400, "./file0\000", 8);
res = syscall(SYS_stat, 0x20000400ul, 0x20000440ul);
if (res != -1)
r[4] = *(uint32_t*)0x2000045c;
break;
case 7:
res = syscall(SYS_getgid);
if (res != -1)
r[5] = res;
break;
case 8:
*(uint32_t*)0x20000500 = 0xfffff834;
*(uint32_t*)0x20000504 = r[4];
*(uint32_t*)0x20000508 = r[5];
*(uint32_t*)0x2000050c = -1;
*(uint32_t*)0x20000510 = 0;
*(uint32_t*)0x20000514 = 3;
*(uint16_t*)0x20000518 = 9;
*(uint16_t*)0x2000051a = 0;
*(uint64_t*)0x20000520 = 0;
*(uint64_t*)0x20000528 = 0;
*(uint64_t*)0x20000530 = 0xfffffffffffffffd;
*(uint64_t*)0x20000538 = 0x4535;
*(uint64_t*)0x20000540 = 2;
*(uint64_t*)0x20000548 = 0;
*(uint64_t*)0x20000550 = 0;
syscall(SYS_semctl, r[3], 0ul, 1ul, 0x20000500ul);
break;
case 9:
syscall(SYS_seteuid, 0);
break;
case 10:
memcpy((void*)0x20000000, "\xbf\x5b\xc2\xc4\xdd\xcd\x9b\xaa\x7f\x7c\x66\xf9\x17\x26\xa8\xc4\x90\xf6\x91\x85\x14\x0b\x5b\x42\x51\xe8\x67\x01\xc6\xc5\xa6\x0d\x84\x80\x2d\x38\x2a\x0c\x38\xdf\x4a\x28\xfd\x84\x0d\x7e\x14\x06\xa5\xc2\xeb\x5d\x3b\x6b\xc3\x23\xbd\x49\x38\x6c\x4a\x92\x49\x50\x31\x4f\xe6\x17\xf8\xcd\x34\x37\xa4\xaa\x6d\x1c\x6d\x62\x64\x03\x09\xf9\xde\x23\x93\x99\x9b\x11\x47\x68\xd5\x10\xd7\x34\xfd\x72\xd1\x98\xb2\x61\xbd\x61\x81\x14\xbf\x3f\xa3\xe2\xfe\x84\xff\xe6\x5c\x80\xe4\x72\x12\xc4\x9e\x47\xbb\x3a\xaa\x86\x89\x46\x2f\x21\xd5\x18\x80\xd9\x7c\xb4\x45\xd3", 136);
break;
case 11:
memcpy((void*)0x200000c0, "\xc4\xa1\x84\x58\x2c\xaa\x26\x44\x0f\xae\x04\xc4\x41\x0f\x74\xab\x00\x00\x01\x00\xc4\x23\xf5\x78\x4c\xe9\x9d\x40\x44\xdf\x34\x59\x26\x41\x0f\xae\x41\x01\x64\x64\x66\x44\x0f\xe5\xb9\x4e\x9a\xb0\xc4\xc4\x22\x7d\x47\x0f\x41\x0f\x45\x7f\x56\x66\x0f\xdd\xe8", 63);
syz_execute_func(0x200000c0);
break;
case 12:
break;
case 13:
memcpy((void*)0x20000140, "\x64\xd3\x2f\x16\xeb\xd8\x17\xd0\x04\xdc\xb8\x01\x71\x82\x05\xbc\xa1\xd8\x6d\xad\x3c\xb1\x32\xa2\x86\x60\x92\x14\xb7\x39\x5a\x97\xa0\xe8\xfe\xda\x5f\xad\x02\xcc\xe9\xde\xea\x94\xd5\x5a\x75\x0c\x17\xb2\x34\x07\x50\x02\xb9\xdf\x62\x9f\xa6\x8e\x3f\x7d\xa9\x7e\x9c\x2a\x2e\x0a\x95\xd1\x5d\x35\x95\x61\xb1\x47\x74\x40\x34\x2c\xd7\x9c\x7c\xeb\xd6\xbf\x00\x8a\xcd\x1c\x7f\xf1\x46\xa6\xfe\x22\x01\x36\x61\xd8\xc8\xce\x8e\xb1\x7f\x5c\xf3\x89\x2a\xe0\x8b\xba\x46\x54\x5b\x2b\x69\x0a\xb7\xe0\x36\x8a\xec\x4d\x32\xb7\x6d\x7f\xc1\x5d\xd7\xc2\xab\xa1\x84\xd4\x1a\x5e\x5a\xbb\x8d\x71\x6f\x5e\x64\x5e\x17\x67\x13\x8e\xd7\x38\xf3\x15\x79\x5a\xc9\x9e\x22\xfd\x44\xdb\x06\x09\x63\x13\xf4\x72\x9c\xe0\xd3\xbd\x93\x8f\x5b\x65\x20\xef\x93\x76\xfa\x90\x9d\xf6\xb2\x05\xc2\xd3\xf5\x2e\xe4\x3e\x3f\x59\xea\x44\x1b\x7c\x4e\x4d\x5c", 201);
memcpy((void*)0x20000240, "\xc1\xb0\x1d\x40\x73\x99\x35\xb1\x21\x7d\x0e\x39\x3c\xdd\x4f\xa4\xef\x8b\xbd\x99\x57\xee\x99\x68\x77\xe4\xca\x15\x5c\x19\x5d\xc1\x66\xf9\x48\x6a\xc4\xdb\x17\xf7\x54\xc4\x89\x38\xa4\x34\x19\xf0\x82\xa8\xc3\x0e\xff\xbe\xf0\x64\xf6\xc8\xb8\x7b\xc9\x30\xe4\x39\xc7\x19\xec\x0a\x11\x99\x04\x0b\x86\x28\x6d\x27\x1f\x25\xaf\x26\xeb\xed\x3f\x55\xc3\x2e\x68\xac\x70\x33\x0d\xf7\x69\x31\xbf\x55\xfa\xe8\x80\x25\x6b\x74\xa9\x23\xf8\xa3\x02\x2c\x31\x0f\x94\xcc\x0c\x62\x33\x02\xa5\xd1\x4b\x3f\x8e\x18\xf4\x15\x99\x88\x28\x66\xea\x02\x42\x86\x4b\x37\xd5\xae\x87\xfb\xcb\x74\x5c\x3e\x26\x42\x3d\x05\xc5\x48\x38\x33\xdf\xcd\xd4\x3d\xc0\xc6\x50\x73\x29\x03\x72\x73\xde\x28\x2e\x3a\x16\xac\x00\xc5\x53\x9c\x30\x94\x63\x98\x4b\x15\x3e\xc6\x25\x0a\x78\x19\x75\xa2\x77\x01\x72\x80\xdb\x1e\x9c\x18\xce\x66\x4d\xf5\x94\x7c\x6c\x18\xbe\xf2\x36\x7e\x61\x63\xb4\x6b\x95\x03\xf7\x00\x70\x5f\xd0\xe8\x9e\xae\x6d\xf0\x88\x4b\xf2\x7c\x00\xe0\x5f\xc5\xef\xc6\x49\x07", 234);
syz_usb_connect(0, 0xc9, 0x20000140, 0x20000240);
break;
case 14:
memcpy((void*)0x20000340, "\x36\x4f\xb1\xa4\x17\x26\x3d\xe2\x27\x97\xec\x76\x08\x61\xf3\x85\x2c\xf2\x4f\x79\xe2\xb7\xa5\xc6\x2a\xfa\xd7\xd6\xd4\xd0\x9d\x86\x2f\x8e\xcc\xd0\x2e\x1b\xb9\x89\xe0\xf8\xa8\xad\x91\x54\x42\x01\x64\x04\xc9\x82\x6a\x5c\x0a\x28\x4f\xc7\xa8\x40\x30\x47\x59\xb6\x84\xf3\x57\xb2\xe6\xfe\xcf\xb3\xcc\x81\x57\xc0\x08\xff\x0d\xcf\xf2\x10\x89\x84\x54\x8a\x2a\xd6\x95\xfa\xd9\x51\x2f\x06\xfd\x12\xd6\x6b\xc4\x43\x04\x75\x12\xab\x4e\xf3\x05\x8a\xe6\xc0\xc6\xec\x3f\xd6\x27\xe3\x70\xa1\x51\xae\x71\x9b\x8e\x3a\x77\xd6\x82\xdc\x06\xa9\x3b\xe9\xc2\xaa\x80\x18\xb5\x8a\x94\x92\xcb\x39\x03\x1b\xb5\xab\xf3\x12\x4e\xaa\xb8\x53\x30\xf1\x81\xfc\xcc\xa7\x59\x7b\x4e\xc0\x87\x9f\xcb\xcf\x51\x14\x3f\x98\xc4\x43\xc1\x67\x20\xa6\xe0\x1b\x7e\x07\xdf\x47\x27\xe2\x88\xe1\x3d\xcc\x0b\x7e\x11", 191);
memcpy((void*)0x20000400, "\x59\x03\x92\x3c\x7a\x1b\x28\x38\xf3\xc1\x21\x56\x78\x5a\x11\xc8\x1b\x2e\x82\xd9\xa1\x19\x0e\x1b\x9c\x45\x97\x6a\x91\x7c\x00\x29\x4d\xc9\x4d\x53\x54\xe8\xc5\xd6\xa4\xe8\x98\x6d\xa0\x74\xeb\x46\x1e\xd0\x73\x6b\xcb\xed\xe2\xce\xf1\xf1\x9e\x02\x16\xc0\x9e\xb7\x94\xd8\xb9\x75\x4f\xea\x26\xf1\x10\xc8\x32\x48\xc2\x86\xea\xa0\x5a\x69\x84\x4e\xb1\x29\x2f\x59\x4f\x59\xf6\xc9\xbe\xca\x47\xd8\x94\xd4\x4d\xfd\x15\xff\x81\xb7\x6b\x46\x35\x39\x2e\xb5\xed\x43\x1c\xa3\x09\x22\x30", 117);
res = syz_usb_connect(4, 0xbf, 0x20000340, 0x20000400);
if (res != -1)
r[6] = res;
break;
case 15:
syz_usb_disconnect(r[6]);
break;
}
}
int main(void)
{
syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 3ul, 0x1012ul, -1, 0ul, 0ul);
for (procid = 0; procid < 2; procid++) {
if (fork() == 0) {
use_temporary_dir();
do_sandbox_none();
}
}
sleep(1000000);
return 0;
}
<stdin>:187:2: error: unknown type name 'uint8_t_t'
<stdin>:188:2: error: unknown type name 'uint8_t_t'
<stdin>:189:2: error: unknown type name 'uint8_t_t'
<stdin>:190:2: error: unknown type name 'uint8_t_t'
<stdin>:191:2: error: unknown type name 'uint16_t_t'
<stdin>:192:2: error: unknown type name 'uint8_t_t'
<stdin>:193:2: error: unknown type name 'uint8_t_t'
<stdin>:194:2: error: unknown type name 'uint8_t_t'
<stdin>:198:2: error: unknown type name 'uint8_t_t'
<stdin>:199:2: error: unknown type name 'uint8_t_t'
<stdin>:200:2: error: unknown type name 'uint16_t_t'
<stdin>:201:2: error: unknown type name 'uint8_t_t'
<stdin>:202:2: error: unknown type name 'uint8_t_t'
<stdin>:203:2: error: unknown type name 'uint8_t_t'
<stdin>:204:2: error: unknown type name 'uint8_t_t'
<stdin>:205:2: error: unknown type name 'uint16_t_t'
<stdin>:206:2: error: unknown type name 'uint16_t_t'
<stdin>:207:2: error: unknown type name 'uint16_t_t'
<stdin>:208:2: error: unknown type name 'uint8_t_t'
<stdin>:209:2: error: unknown type name 'uint8_t_t'
<stdin>:210:2: error: unknown type name 'uint8_t_t'
<stdin>:211:2: error: unknown type name 'uint8_t_t'
<stdin>:215:2: error: unknown type name 'uint8_t_t'
<stdin>:216:2: error: unknown type name 'uint8_t_t'
<stdin>:217:2: error: unknown type name 'uint16_t_t'
<stdin>:218:2: error: unknown type name 'uint8_t_t'
<stdin>:219:2: error: unknown type name 'uint8_t_t'
<stdin>:220:2: error: unknown type name 'uint8_t_t'
<stdin>:221:2: error: unknown type name 'uint8_t_t'
<stdin>:222:2: error: unknown type name 'uint8_t_t'
<stdin>:226:2: error: unknown type name 'uint8_t_t'
<stdin>:227:2: error: unknown type name 'uint8_t_t'
<stdin>:228:2: error: unknown type name 'uint8_t_t'
<stdin>:229:2: error: unknown type name 'uint8_t_t'
<stdin>:230:2: error: unknown type name 'uint8_t_t'
<stdin>:231:2: error: unknown type name 'uint8_t_t'
<stdin>:232:2: error: unknown type name 'uint8_t_t'
<stdin>:233:2: error: unknown type name 'uint8_t_t'
<stdin>:234:2: error: unknown type name 'uint8_t_t'
<stdin>:238:2: error: unknown type name 'uint8_t_t'
<stdin>:239:2: error: unknown type name 'uint8_t_t'
<stdin>:240:2: error: unknown type name 'uint16_t_t'
<stdin>:241:2: error: unknown type name 'uint16_t_t'
<stdin>:242:2: error: unknown type name 'uint16_t_t'
<stdin>:246:2: error: unknown type name 'uint8_t_t'
<stdin>:247:2: error: unknown type name 'uint8_t_t'
<stdin>:248:2: error: unknown type name 'uint16_t_t'
<stdin>:249:2: error: unknown type name 'uint8_t_t'
<stdin>:250:2: error: unknown type name 'uint8_t_t'
<stdin>:251:2: error: unknown type name 'uint8_t_t'
<stdin>:252:2: error: unknown type name 'uint8_t_t'
<stdin>:253:2: error: unknown type name 'uint8_t_t'
<stdin>:254:2: error: unknown type name 'uint8_t_t'
<stdin>: In function 'vhci_usb_recv':
<stdin>:561:2: error: unknown type name 'uint8_t_t'; did you mean 'uint8_t'?
<stdin>:561:20: error: 'uint8_t_t' undeclared (first use in this function); did you mean 'uint8_t'?
<stdin>:561:20: note: each undeclared identifier is reported only once for each function it appears in
<stdin>:561:30: error: expected expression before ')' token
<stdin>: In function 'vhci_usb_send':
<stdin>:576:2: error: unknown type name 'uint8_t_t'; did you mean 'uint8_t'?
<stdin>:576:20: error: 'uint8_t_t' undeclared (first use in this function); did you mean 'uint8_t'?
<stdin>:576:30: error: expected expression before ')' token
<stdin>: In function 'syz_usb_connect_impl':
<stdin>:637:63: error: unknown type name 'usb_ctrlrequest'
<stdin>:642:55: error: unknown type name 'usb_ctrlrequest'
<stdin>:654:8: error: 'uint32_t_t' undeclared (first use in this function); did you mean 'uint32_t'?
At top level:
<stdin>:702:13: error: 'setup_usb' defined but not used [-Werror=unused-function]
cc1: all warnings being treated as errors
compiler invocation: /syzkaller/netbsd/src/../tools/bin/x86_64--netbsd-g++ [-o /tmp/syz-executor765215906 -DGOOS_netbsd=1 -DGOARCH_amd64=1 -DHOSTGOOS_linux=1 -x c - -m64 --sysroot /syzkaller/netbsd/src/../dest/ -O2 -pthread -Wall -Werror -Wparentheses -Wframe-larger-than=16384]
--- FAIL: TestGenerate/netbsd/amd64/5 (0.51s)
csource_test.go:121:
--- FAIL: TestGenerate/netbsd/amd64/3 (0.45s)
csource_test.go:121:
--- FAIL: TestGenerate/netbsd/amd64/2 (0.49s)
csource_test.go:121:
--- FAIL: TestGenerate/netbsd/amd64/4 (0.54s)
csource_test.go:121:
--- FAIL: TestGenerate/netbsd/amd64/7 (0.53s)
csource_test.go:121:
--- FAIL: TestGenerate/netbsd/amd64/9 (0.43s)
csource_test.go:123: opts: {Threaded:true Collide:false Repeat:true RepeatTimes:0 Procs:0 Sandbox:none Fault:false FaultCall:0 FaultNth:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false USB:false UseTmpDir:true HandleSegv:false Repro:false Trace:false}
program:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
writev(r0, &(0x7f00000002c0)=[{&(0x7f0000000000)="25c5f6768692f16a6b02337bc5f24e95c2e574f7bd23da78ff2241439caced122e33ab16d377843415781fa508cd635f2fd04113204ed9bda7396e99a38a2f10e9c7398b5a64c49d98664bd14975be7076a83638a7da3095f0e027bd161ccd5c994f8b31d535a3ce4c57812d9682f3ebb10e05a7142210515b668d1357d91aaabb6ad88aed6b9f2143d062e0b5", 0x8d}, {&(0x7f00000000c0)="e8987e8f864e9d38b55615b659d14cae9e91a9532213ffb465b61b", 0x1b}, {&(0x7f0000000100)="3f97992c940fba8936a6b4", 0xb}, {&(0x7f0000000140)="c99ab604eb2e44ebf7bfb7b04c084321a30f4351aeb0676bb21aefc3bc2322d99a5b034f880aa25d61ae4076397c30357b22ccb779ebd3206ac648fab90836dd4d9e73dc3c077270b57dc3222284dd3cae4737957d947d765a5e0e919cbd3ef2d3d9522a827f3fe60ddc", 0x6a}, {&(0x7f00000001c0)="2bc5a9fd6cc3450082405ab607a0f5627b40589a690ac59158acf10f2a1cc46152fa5f493a8599cc6eaab5d96968bef1a27f62dacf64d06c80cfb5b320b977c9432c446fa6f6551444ee4c5998853260d65d2cb3c778f44fe270363b4eb309e24fc47797b5bd454bf4d3d4656fa078ff56b30f4f0e9d5e6e8943830ad6d342968c224f7c35af01a61d10e155fee7e0227cd79a7977b3f40351ca01834840abba557d36bc8a4208f90dc5f51e3f3d445c5feea79368164edef05d24748ce9f0a58451b43d9891902bc45ec67d00df1deb74e65b29c0d095dbdd5b9a7c", 0xdc}], 0x5)
getgroups(0x3, &(0x7f0000000340)=[0x0, 0xffffffffffffffff, <r1=>0x0])
getsockopt$sock_cred(0xffffffffffffffff, 0xffff, 0x11, &(0x7f0000000380)={0x0, 0x0, <r2=>0x0}, &(0x7f00000003c0)=0xc)
setregid(r1, r2)
r3 = semget(0x1, 0x0, 0xb2603d964b180ce8)
stat(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, <r4=>0x0})
r5 = getgid()
semctl$IPC_SET(r3, 0x0, 0x1, &(0x7f0000000500)={{0xfffff834, r4, r5, 0xffffffffffffffff, 0x0, 0x3, 0x9}, 0xfffffffffffffffd, 0x4535, 0x2})
seteuid(0x0)
syz_emit_ethernet(0x88, &(0x7f0000000000)="bf5bc2c4ddcd9baa7f7c66f91726a8c490f69185140b5b4251e86701c6c5a60d84802d382a0c38df4a28fd840d7e1406a5c2eb5d3b6bc323bd49386c4a924950314fe617f8cd3437a4aa6d1c6d62640309f9de2393999b114768d510d734fd72d198b261bd618114bf3fa3e2fe84ffe65c80e47212c49e47bb3aaa8689462f21d51880d97cb445d3")
syz_execute_func(&(0x7f00000000c0)="c4a184582caa26440fae04c4410f74ab00000100c423f5784ce99d4044df345926410fae4101646466440fe5b94e9ab0c4c4227d470f410f457f56660fdde8")
syz_extract_tcp_res(&(0x7f0000000100), 0x6, 0x1)
syz_usb_connect(0x0, 0xc9, &(0x7f0000000140)="64d32f16ebd817d004dcb801718205bca1d86dad3cb132a286609214b7395a97a0e8feda5fad02cce9deea94d55a750c17b234075002b9df629fa68e3f7da97e9c2a2e0a95d15d359561b1477440342cd79c7cebd6bf008acd1c7ff146a6fe22013661d8c8ce8eb17f5cf3892ae08bba46545b2b690ab7e0368aec4d32b76d7fc15dd7c2aba184d41a5e5abb8d716f5e645e1767138ed738f315795ac99e22fd44db06096313f4729ce0d3bd938f5b6520ef9376fa909df6b205c2d3f52ee43e3f59ea441b7c4e4d5c", &(0x7f0000000240)="c1b01d40739935b1217d0e393cdd4fa4ef8bbd9957ee996877e4ca155c195dc166f9486ac4db17f754c48938a43419f082a8c30effbef064f6c8b87bc930e439c719ec0a1199040b86286d271f25af26ebed3f55c32e68ac70330df76931bf55fae880256b74a923f8a3022c310f94cc0c623302a5d14b3f8e18f41599882866ea0242864b37d5ae87fbcb745c3e26423d05c5483833dfcdd43dc0c6507329037273de282e3a16ac00c5539c309463984b153ec6250a781975a277017280db1e9c18ce664df5947c6c18bef2367e6163b46b9503f700705fd0e89eae6df0884bf27c00e05fc5efc64907")
r6 = syz_usb_connect(0x4, 0xbf, &(0x7f0000000340)="364fb1a417263de22797ec760861f3852cf24f79e2b7a5c62afad7d6d4d09d862f8eccd02e1bb989e0f8a8ad915442016404c9826a5c0a284fc7a840304759b684f357b2e6fecfb3cc8157c008ff0dcff2108984548a2ad695fad9512f06fd12d66bc443047512ab4ef3058ae6c0c6ec3fd627e370a151ae719b8e3a77d682dc06a93be9c2aa8018b58a9492cb39031bb5abf3124eaab85330f181fccca7597b4ec0879fcbcf51143f98c443c16720a6e01b7e07df4727e288e13dcc0b7e11", &(0x7f0000000400)="5903923c7a1b2838f3c12156785a11c81b2e82d9a1190e1b9c45976a917c00294dc94d5354e8c5d6a4e8986da074eb461ed0736bcbede2cef1f19e0216c09eb794d8b9754fea26f110c83248c286eaa05a69844eb1292f594f59f6c9beca47d894d44dfd15ff81b76b4635392eb5ed431ca3092230")
syz_usb_disconnect(r6)
csource_test.go:124: failed to build program:
// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <dev/usb/usb.h>
#include <dev/usb/usbhid.h>
#include <dev/usb/vhci.h>
#include <dirent.h>
#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <net/ethertypes.h>
#include <net/if.h>
#include <net/if_arp.h>
#include <net/if_tun.h>
#include <netinet/in.h>
#include <netinet/ip.h>
#include <netinet/ip6.h>
#include <netinet/tcp.h>
#include <pthread.h>
#include <pwd.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ioctl.h>
#include <sys/resource.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <sys/uio.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>
#include <netinet/if_ether.h>
static unsigned long long procid;
static void kill_and_wait(int pid, int* status)
{
kill(pid, SIGKILL);
while (waitpid(-1, status, 0) != pid) {
}
}
static void sleep_ms(uint64_t ms)
{
usleep(ms * 1000);
}
static uint64_t current_time_ms(void)
{
struct timespec ts;
if (clock_gettime(CLOCK_MONOTONIC, &ts))
exit(1);
return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}
static void use_temporary_dir(void)
{
char tmpdir_template[] = "./syzkaller.XXXXXX";
char* tmpdir = mkdtemp(tmpdir_template);
if (!tmpdir)
exit(1);
if (chmod(tmpdir, 0777))
exit(1);
if (chdir(tmpdir))
exit(1);
}
static void remove_dir(const char* dir)
{
DIR* dp;
struct dirent* ep;
dp = opendir(dir);
if (dp == NULL)
exit(1);
while ((ep = readdir(dp))) {
if (strcmp(ep->d_name, ".") == 0 || strcmp(ep->d_name, "..") == 0)
continue;
char filename[FILENAME_MAX];
snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name);
struct stat st;
if (lstat(filename, &st))
exit(1);
if (S_ISDIR(st.st_mode)) {
remove_dir(filename);
continue;
}
if (unlink(filename))
exit(1);
}
closedir(dp);
if (rmdir(dir))
exit(1);
}
static void thread_start(void* (*fn)(void*), void* arg)
{
pthread_t th;
pthread_attr_t attr;
pthread_attr_init(&attr);
pthread_attr_setstacksize(&attr, 128 << 10);
int i;
for (i = 0; i < 100; i++) {
if (pthread_create(&th, &attr, fn, arg) == 0) {
pthread_attr_destroy(&attr);
return;
}
if (errno == EAGAIN) {
usleep(50);
continue;
}
break;
}
exit(1);
}
typedef struct {
pthread_mutex_t mu;
pthread_cond_t cv;
int state;
} event_t;
static void event_init(event_t* ev)
{
if (pthread_mutex_init(&ev->mu, 0))
exit(1);
if (pthread_cond_init(&ev->cv, 0))
exit(1);
ev->state = 0;
}
static void event_reset(event_t* ev)
{
ev->state = 0;
}
static void event_set(event_t* ev)
{
pthread_mutex_lock(&ev->mu);
if (ev->state)
exit(1);
ev->state = 1;
pthread_mutex_unlock(&ev->mu);
pthread_cond_broadcast(&ev->cv);
}
static void event_wait(event_t* ev)
{
pthread_mutex_lock(&ev->mu);
while (!ev->state)
pthread_cond_wait(&ev->cv, &ev->mu);
pthread_mutex_unlock(&ev->mu);
}
static int event_isset(event_t* ev)
{
pthread_mutex_lock(&ev->mu);
int res = ev->state;
pthread_mutex_unlock(&ev->mu);
return res;
}
static int event_timedwait(event_t* ev, uint64_t timeout)
{
uint64_t start = current_time_ms();
uint64_t now = start;
pthread_mutex_lock(&ev->mu);
for (;;) {
if (ev->state)
break;
uint64_t remain = timeout - (now - start);
struct timespec ts;
ts.tv_sec = remain / 1000;
ts.tv_nsec = (remain % 1000) * 1000 * 1000;
pthread_cond_timedwait(&ev->cv, &ev->mu, &ts);
now = current_time_ms();
if (now - start > timeout)
break;
}
int res = ev->state;
pthread_mutex_unlock(&ev->mu);
return res;
}
/* -------------------------------------------------------------------------- */
/*
* Redefinitions to match the linux types used in common_usb.h.
*/
struct usb_endpoint_descriptor {
uint8_t_t bLength;
uint8_t_t bDescriptorType;
uint8_t_t bEndpointAddress;
uint8_t_t bmAttributes;
uint16_t_t wMaxPacketSize;
uint8_t_t bInterval;
uint8_t_t bRefresh;
uint8_t_t bSynchAddress;
} __attribute__((packed));
struct usb_device_descriptor {
uint8_t_t bLength;
uint8_t_t bDescriptorType;
uint16_t_t bcdUSB;
uint8_t_t bDeviceClass;
uint8_t_t bDeviceSubClass;
uint8_t_t bDeviceProtocol;
uint8_t_t bMaxPacketSize0;
uint16_t_t idVendor;
uint16_t_t idProduct;
uint16_t_t bcdDevice;
uint8_t_t iManufacturer;
uint8_t_t iProduct;
uint8_t_t iSerialNumber;
uint8_t_t bNumConfigurations;
} __attribute__((packed));
struct usb_config_descriptor {
uint8_t_t bLength;
uint8_t_t bDescriptorType;
uint16_t_t wTotalLength;
uint8_t_t bNumInterfaces;
uint8_t_t bConfigurationValue;
uint8_t_t iConfiguration;
uint8_t_t bmAttributes;
uint8_t_t bMaxPower;
} __attribute__((packed));
struct usb_interface_descriptor {
uint8_t_t bLength;
uint8_t_t bDescriptorType;
uint8_t_t bInterfaceNumber;
uint8_t_t bAlternateSetting;
uint8_t_t bNumEndpoints;
uint8_t_t bInterfaceClass;
uint8_t_t bInterfaceSubClass;
uint8_t_t bInterfaceProtocol;
uint8_t_t iInterface;
} __attribute__((packed));
struct usb_ctrlrequest {
uint8_t_t bRequestType;
uint8_t_t bRequest;
uint16_t_t wValue;
uint16_t_t wIndex;
uint16_t_t wLength;
} __attribute__((packed));
struct usb_qualifier_descriptor {
uint8_t_t bLength;
uint8_t_t bDescriptorType;
uint16_t_t bcdUSB;
uint8_t_t bDeviceClass;
uint8_t_t bDeviceSubClass;
uint8_t_t bDeviceProtocol;
uint8_t_t bMaxPacketSize0;
uint8_t_t bNumConfigurations;
uint8_t_t bRESERVED;
} __attribute__((packed));
#define USB_TYPE_MASK (0x03 << 5)
#define USB_TYPE_STANDARD (0x00 << 5)
#define USB_TYPE_CLASS (0x01 << 5)
#define USB_TYPE_VENDOR (0x02 << 5)
#define USB_TYPE_RESERVED (0x03 << 5)
#define USB_DT_DEVICE 0x01
#define USB_DT_CONFIG 0x02
#define USB_DT_STRING 0x03
#define USB_DT_INTERFACE 0x04
#define USB_DT_ENDPOINT 0x05
#define USB_DT_DEVICE_QUALIFIER 0x06
#define USB_DT_OTHER_SPEED_CONFIG 0x07
#define USB_DT_INTERFACE_POWER 0x08
#define USB_DT_OTG 0x09
#define USB_DT_DEBUG 0x0a
#define USB_DT_INTERFACE_ASSOCIATION 0x0b
#define USB_DT_SECURITY 0x0c
#define USB_DT_KEY 0x0d
#define USB_DT_ENCRYPTION_TYPE 0x0e
#define USB_DT_BOS 0x0f
#define USB_DT_DEVICE_CAPABILITY 0x10
#define USB_DT_WIRELESS_ENDPOINT_COMP 0x11
#define USB_DT_WIRE_ADAPTER 0x21
#define USB_DT_RPIPE 0x22
#define USB_DT_CS_RADIO_CONTROL 0x23
#define USB_DT_PIPE_USAGE 0x24
#define USB_DT_SS_ENDPOINT_COMP 0x30
#define USB_DT_SSP_ISOC_ENDPOINT_COMP 0x31
#define USB_REQ_GET_STATUS 0x00
#define USB_REQ_CLEAR_FEATURE 0x01
#define USB_REQ_SET_FEATURE 0x03
#define USB_REQ_SET_ADDRESS 0x05
#define USB_REQ_GET_DESCRIPTOR 0x06
#define USB_REQ_SET_DESCRIPTOR 0x07
#define USB_REQ_GET_CONFIGURATION 0x08
#define USB_REQ_SET_CONFIGURATION 0x09
#define USB_REQ_GET_INTERFACE 0x0A
#define USB_REQ_SET_INTERFACE 0x0B
#define USB_REQ_SYNCH_FRAME 0x0C
#define USB_REQ_SET_SEL 0x30
#define USB_REQ_SET_ISOCH_DELAY 0x31
#define USB_REQ_SET_ENCRYPTION 0x0D
#define USB_REQ_GET_ENCRYPTION 0x0E
#define USB_REQ_RPIPE_ABORT 0x0E
#define USB_REQ_SET_HANDSHAKE 0x0F
#define USB_REQ_RPIPE_RESET 0x0F
#define USB_REQ_GET_HANDSHAKE 0x10
#define USB_REQ_SET_CONNECTION 0x11
#define USB_REQ_SET_SECURITY_DATA 0x12
#define USB_REQ_GET_SECURITY_DATA 0x13
#define USB_REQ_SET_WUSB_DATA 0x14
#define USB_REQ_LOOPBACK_DATA_WRITE 0x15
#define USB_REQ_LOOPBACK_DATA_READ 0x16
#define USB_REQ_SET_INTERFACE_DS 0x17
#define USB_REQ_GET_PARTNER_PDO 20
#define USB_REQ_GET_BATTERY_STATUS 21
#define USB_REQ_SET_PDO 22
#define USB_REQ_GET_VDM 23
#define USB_REQ_SEND_VDM 24
#define USB_MAX_IFACE_NUM 4
#define USB_MAX_EP_NUM 32
#define USB_MAX_FDS 6
struct usb_endpoint_index {
struct usb_endpoint_descriptor desc;
int handle;
};
struct usb_iface_index {
struct usb_interface_descriptor* iface;
uint8_t bInterfaceNumber;
uint8_t bAlternateSetting;
uint8_t bInterfaceClass;
struct usb_endpoint_index eps[USB_MAX_EP_NUM];
int eps_num;
};
struct usb_device_index {
struct usb_device_descriptor* dev;
struct usb_config_descriptor* config;
uint8_t bDeviceClass;
uint8_t bMaxPower;
int config_length;
struct usb_iface_index ifaces[USB_MAX_IFACE_NUM];
int ifaces_num;
int iface_cur;
};
struct usb_info {
int fd;
struct usb_device_index index;
};
static struct usb_info usb_devices[USB_MAX_FDS];
static int usb_devices_num;
static bool parse_usb_descriptor(const char* buffer, size_t length, struct usb_device_index* index)
{
if (length < sizeof(*index->dev) + sizeof(*index->config))
return false;
memset(index, 0, sizeof(*index));
index->dev = (struct usb_device_descriptor*)buffer;
index->config = (struct usb_config_descriptor*)(buffer + sizeof(*index->dev));
index->bDeviceClass = index->dev->bDeviceClass;
index->bMaxPower = index->config->bMaxPower;
index->config_length = length - sizeof(*index->dev);
index->iface_cur = -1;
size_t offset = 0;
while (true) {
if (offset + 1 >= length)
break;
uint8_t desc_length = buffer[offset];
uint8_t desc_type = buffer[offset + 1];
if (desc_length <= 2)
break;
if (offset + desc_length > length)
break;
if (desc_type == USB_DT_INTERFACE && index->ifaces_num < USB_MAX_IFACE_NUM) {
struct usb_interface_descriptor* iface = (struct usb_interface_descriptor*)(buffer + offset);
index->ifaces[index->ifaces_num].iface = iface;
index->ifaces[index->ifaces_num].bInterfaceNumber = iface->bInterfaceNumber;
index->ifaces[index->ifaces_num].bAlternateSetting = iface->bAlternateSetting;
index->ifaces[index->ifaces_num].bInterfaceClass = iface->bInterfaceClass;
index->ifaces_num++;
}
if (desc_type == USB_DT_ENDPOINT && index->ifaces_num > 0) {
struct usb_iface_index* iface = &index->ifaces[index->ifaces_num - 1];
if (iface->eps_num < USB_MAX_EP_NUM) {
memcpy(&iface->eps[iface->eps_num].desc, buffer + offset, sizeof(iface->eps[iface->eps_num].desc));
iface->eps_num++;
}
}
offset += desc_length;
}
return true;
}
static struct usb_device_index* add_usb_index(int fd, const char* dev, size_t dev_len)
{
int i = __atomic_fetch_add(&usb_devices_num, 1, __ATOMIC_RELAXED);
if (i >= USB_MAX_FDS)
return NULL;
int rv = 0;
rv = parse_usb_descriptor(dev, dev_len, &usb_devices[i].index);
if (!rv)
return NULL;
__atomic_store_n(&usb_devices[i].fd, fd, __ATOMIC_RELEASE);
return &usb_devices[i].index;
}
static struct usb_device_index* lookup_usb_index(int fd)
{
int i;
for (i = 0; i < USB_MAX_FDS; i++) {
if (__atomic_load_n(&usb_devices[i].fd, __ATOMIC_ACQUIRE) == fd) {
return &usb_devices[i].index;
}
}
return NULL;
}
struct vusb_connect_string_descriptor {
uint32_t len;
char* str;
} __attribute__((packed));
struct vusb_connect_descriptors {
uint32_t qual_len;
char* qual;
uint32_t bos_len;
char* bos;
uint32_t strs_len;
struct vusb_connect_string_descriptor strs[0];
} __attribute__((packed));
static const char default_string[] = {
8, USB_DT_STRING,
's', 0, 'y', 0, 'z', 0
};
static const char default_lang_id[] = {
4, USB_DT_STRING,
0x09, 0x04
};
static bool lookup_connect_response_in(int fd, const struct vusb_connect_descriptors* descs,
const struct usb_ctrlrequest* ctrl,
char** response_data, uint32_t* response_length)
{
struct usb_device_index* index = lookup_usb_index(fd);
uint8_t str_idx;
if (!index)
return false;
switch (ctrl->bRequestType & USB_TYPE_MASK) {
case USB_TYPE_STANDARD:
switch (ctrl->bRequest) {
case USB_REQ_GET_DESCRIPTOR:
switch (ctrl->wValue >> 8) {
case USB_DT_DEVICE:
*response_data = (char*)index->dev;
*response_length = sizeof(*index->dev);
return true;
case USB_DT_CONFIG:
*response_data = (char*)index->config;
*response_length = index->config_length;
return true;
case USB_DT_STRING:
str_idx = (uint8_t)ctrl->wValue;
if (descs && str_idx < descs->strs_len) {
*response_data = descs->strs[str_idx].str;
*response_length = descs->strs[str_idx].len;
return true;
}
if (str_idx == 0) {
*response_data = (char*)&default_lang_id[0];
*response_length = default_lang_id[0];
return true;
}
*response_data = (char*)&default_string[0];
*response_length = default_string[0];
return true;
case USB_DT_BOS:
*response_data = descs->bos;
*response_length = descs->bos_len;
return true;
case USB_DT_DEVICE_QUALIFIER:
if (!descs->qual) {
struct usb_qualifier_descriptor* qual =
(struct usb_qualifier_descriptor*)response_data;
qual->bLength = sizeof(*qual);
qual->bDescriptorType = USB_DT_DEVICE_QUALIFIER;
qual->bcdUSB = index->dev->bcdUSB;
qual->bDeviceClass = index->dev->bDeviceClass;
qual->bDeviceSubClass = index->dev->bDeviceSubClass;
qual->bDeviceProtocol = index->dev->bDeviceProtocol;
qual->bMaxPacketSize0 = index->dev->bMaxPacketSize0;
qual->bNumConfigurations = index->dev->bNumConfigurations;
qual->bRESERVED = 0;
*response_length = sizeof(*qual);
return true;
}
*response_data = descs->qual;
*response_length = descs->qual_len;
return true;
default:
break;
}
break;
default:
break;
}
break;
default:
break;
}
return false;
}
typedef bool (*lookup_connect_out_response_t)(int fd, const struct vusb_connect_descriptors* descs,
const struct usb_ctrlrequest* ctrl, bool* done);
static bool lookup_connect_response_out_generic(int fd, const struct vusb_connect_descriptors* descs,
const struct usb_ctrlrequest* ctrl, bool* done)
{
switch (ctrl->bRequestType & USB_TYPE_MASK) {
case USB_TYPE_STANDARD:
switch (ctrl->bRequest) {
case USB_REQ_SET_CONFIGURATION:
*done = true;
return true;
default:
break;
}
break;
}
return false;
}
/* -------------------------------------------------------------------------- */
static int vhci_open(void)
{
return open("/dev/vhci", O_RDWR);
}
static int vhci_setport(int fd, u_int port)
{
struct vhci_ioc_set_port args;
args.port = port;
return ioctl(fd, VHCI_IOC_SET_PORT, &args);
}
static int vhci_usb_attach(int fd)
{
return ioctl(fd, VHCI_IOC_USB_ATTACH, NULL);
}
static int vhci_usb_recv(int fd, void* buf, size_t size)
{
uint8_t_t* ptr = (uint8_t_t*)buf;
ssize_t done;
while (1) {
done = read(fd, ptr, size);
if (done < 0)
return -1;
if ((size_t)done == size)
return 0;
size -= done;
ptr += done;
}
}
static int vhci_usb_send(int fd, void* buf, size_t size)
{
uint8_t_t* ptr = (uint8_t_t*)buf;
ssize_t done;
while (1) {
done = write(fd, ptr, size);
if (done <= 0)
return -1;
if ((size_t)done == size)
return 0;
size -= done;
ptr += done;
}
}
/* -------------------------------------------------------------------------- */
static volatile long syz_usb_connect_impl(uint64_t speed, uint64_t dev_len,
const char* dev, const struct vusb_connect_descriptors* descs,
lookup_connect_out_response_t lookup_connect_response_out)
{
struct usb_device_index* index;
int portnum, fd, rv;
bool done;
portnum = procid + 1;
if (!dev) {
return -1;
}
if (portnum != 1) {
/* For now, we support only one proc. */
return -1;
}
fd = vhci_open();
if (fd < 0) {
return -1;
}
index = add_usb_index(fd, dev, dev_len);
if (!index) {
goto err;
}
rv = vhci_setport(fd, portnum);
if (rv != 0) {
goto err;
}
rv = vhci_usb_attach(fd);
if (rv != 0) {
goto err;
}
done = false;
while (!done) {
vhci_request_t req;
rv = vhci_usb_recv(fd, &req, sizeof(req));
if (rv != 0) {
goto err;
}
if (req.type != VHCI_REQ_CTRL) {
goto err;
}
char* response_data = NULL;
uint32_t response_length = 0;
char data[4096];
if (req.u.ctrl.bmRequestType & UE_DIR_IN) {
bool response_found = false;
response_found = lookup_connect_response_in(fd, descs, (const usb_ctrlrequest*)&req.u.ctrl, &response_data, &response_length);
if (!response_found) {
goto err;
}
} else {
if (!lookup_connect_response_out(fd, descs, (const usb_ctrlrequest*)&req.u.ctrl, &done)) {
goto err;
}
response_data = NULL;
response_length = UGETW(req.u.ctrl.wLength);
}
if ((req.u.ctrl.bmRequestType & USB_TYPE_MASK) == USB_TYPE_STANDARD &&
req.u.ctrl.bRequest == USB_REQ_SET_CONFIGURATION) {
/* TODO: possibly revisit */
}
if (response_length > sizeof(data))
response_length = 0;
if ((uint32_t_t)UGETW(req.u.ctrl.wLength) < response_length)
response_length = UGETW(req.u.ctrl.wLength);
if (response_data)
memcpy(data, response_data, response_length);
else
memset(data, 0, response_length);
if (req.u.ctrl.bmRequestType & UE_DIR_IN) {
if (response_length > 0) {
vhci_response_t res;
res.size = response_length;
rv = vhci_usb_send(fd, &res, sizeof(res));
if (rv == 0)
rv = vhci_usb_send(fd, data, response_length);
}
} else {
rv = vhci_usb_recv(fd, data, response_length);
}
if (rv < 0) {
goto err;
}
}
sleep_ms(200);
return fd;
err:
close(fd);
return -1;
}
static volatile long syz_usb_connect(volatile long a0, volatile long a1,
volatile long a2, volatile long a3)
{
uint64_t speed = a0;
uint64_t dev_len = a1;
const char* dev = (const char*)a2;
const struct vusb_connect_descriptors* descs = (const struct vusb_connect_descriptors*)a3;
return syz_usb_connect_impl(speed, dev_len, dev, descs,
&lookup_connect_response_out_generic);
}
static volatile long syz_usb_disconnect(volatile long a0)
{
int fd = a0;
int rv = close(fd);
sleep_ms(200);
return rv;
}
static void setup_usb(void)
{
if (chmod("/dev/vhci", 0666))
exit(1);
}
static int tunfd = -1;
#define MAX_TUN 64
#define TUN_IFACE "tap%d"
#define TUN_DEVICE "/dev/tap%d"
#define LOCAL_MAC "aa:aa:aa:aa:aa:aa"
#define REMOTE_MAC "aa:aa:aa:aa:aa:bb"
#define LOCAL_IPV4 "172.20.%d.170"
#define REMOTE_IPV4 "172.20.%d.187"
#define LOCAL_IPV6 "fe80::%02hxaa"
#define REMOTE_IPV6 "fe80::%02hxbb"
static void vsnprintf_check(char* str, size_t size, const char* format, va_list args)
{
int rv;
rv = vsnprintf(str, size, format, args);
if (rv < 0)
exit(1);
if ((size_t)rv >= size)
exit(1);
}
static void snprintf_check(char* str, size_t size, const char* format, ...)
{
va_list args;
va_start(args, format);
vsnprintf_check(str, size, format, args);
va_end(args);
}
#define COMMAND_MAX_LEN 128
#define PATH_PREFIX "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin "
#define PATH_PREFIX_LEN (sizeof(PATH_PREFIX) - 1)
static void execute_command(bool panic, const char* format, ...)
{
va_list args;
char command[PATH_PREFIX_LEN + COMMAND_MAX_LEN];
int rv;
va_start(args, format);
memcpy(command, PATH_PREFIX, PATH_PREFIX_LEN);
vsnprintf_check(command + PATH_PREFIX_LEN, COMMAND_MAX_LEN, format, args);
va_end(args);
rv = system(command);
if (rv) {
if (panic)
exit(1);
}
}
static void initialize_tun(int tun_id)
{
if (tun_id < 0 || tun_id >= MAX_TUN) {
exit(1);
}
char tun_device[sizeof(TUN_DEVICE)];
snprintf_check(tun_device, sizeof(tun_device), TUN_DEVICE, tun_id);
char tun_iface[sizeof(TUN_IFACE)];
snprintf_check(tun_iface, sizeof(tun_iface), TUN_IFACE, tun_id);
execute_command(0, "ifconfig %s destroy", tun_iface);
execute_command(0, "ifconfig %s create", tun_iface);
tunfd = open(tun_device, O_RDWR | O_NONBLOCK);
if (tunfd == -1) {
printf("tun: can't open %s: errno=%d\n", tun_device, errno);
return;
}
const int kTunFd = 240;
if (dup2(tunfd, kTunFd) < 0)
exit(1);
close(tunfd);
tunfd = kTunFd;
char local_mac[sizeof(LOCAL_MAC)];
snprintf_check(local_mac, sizeof(local_mac), LOCAL_MAC);
execute_command(1, "ifconfig %s link %s", tun_iface, local_mac);
char local_ipv4[sizeof(LOCAL_IPV4)];
snprintf_check(local_ipv4, sizeof(local_ipv4), LOCAL_IPV4, tun_id);
execute_command(1, "ifconfig %s inet %s netmask 255.255.255.0", tun_iface, local_ipv4);
char remote_mac[sizeof(REMOTE_MAC)];
char remote_ipv4[sizeof(REMOTE_IPV4)];
snprintf_check(remote_mac, sizeof(remote_mac), REMOTE_MAC);
snprintf_check(remote_ipv4, sizeof(remote_ipv4), REMOTE_IPV4, tun_id);
execute_command(0, "arp -s %s %s", remote_ipv4, remote_mac);
char local_ipv6[sizeof(LOCAL_IPV6)];
snprintf_check(local_ipv6, sizeof(local_ipv6), LOCAL_IPV6, tun_id);
execute_command(1, "ifconfig %s inet6 %s", tun_iface, local_ipv6);
char remote_ipv6[sizeof(REMOTE_IPV6)];
snprintf_check(remote_ipv6, sizeof(remote_ipv6), REMOTE_IPV6, tun_id);
execute_command(0, "ndp -s %s%%%s %s", remote_ipv6, tun_iface, remote_mac);
}
static long syz_emit_ethernet(volatile long a0, volatile long a1)
{
if (tunfd < 0)
return (uintptr_t)-1;
size_t length = a0;
const char* data = (char*)a1;
return write(tunfd, data, length);
}
static int read_tun(char* data, int size)
{
if (tunfd < 0)
return -1;
int rv = read(tunfd, data, size);
if (rv < 0) {
if (errno == EAGAIN)
return -1;
exit(1);
}
return rv;
}
struct tcp_resources {
uint32_t seq;
uint32_t ack;
};
static long syz_extract_tcp_res(volatile long a0, volatile long a1, volatile long a2)
{
if (tunfd < 0)
return (uintptr_t)-1;
char data[1000];
int rv = read_tun(&data[0], sizeof(data));
if (rv == -1)
return (uintptr_t)-1;
size_t length = rv;
struct tcphdr* tcphdr;
if (length < sizeof(struct ether_header))
return (uintptr_t)-1;
struct ether_header* ethhdr = (struct ether_header*)&data[0];
if (ethhdr->ether_type == htons(ETHERTYPE_IP)) {
if (length < sizeof(struct ether_header) + sizeof(struct ip))
return (uintptr_t)-1;
struct ip* iphdr = (struct ip*)&data[sizeof(struct ether_header)];
if (iphdr->ip_p != IPPROTO_TCP)
return (uintptr_t)-1;
if (length < sizeof(struct ether_header) + iphdr->ip_hl * 4 + sizeof(struct tcphdr))
return (uintptr_t)-1;
tcphdr = (struct tcphdr*)&data[sizeof(struct ether_header) + iphdr->ip_hl * 4];
} else {
if (length < sizeof(struct ether_header) + sizeof(struct ip6_hdr))
return (uintptr_t)-1;
struct ip6_hdr* ipv6hdr = (struct ip6_hdr*)&data[sizeof(struct ether_header)];
if (ipv6hdr->ip6_nxt != IPPROTO_TCP)
return (uintptr_t)-1;
if (length < sizeof(struct ether_header) + sizeof(struct ip6_hdr) + sizeof(struct tcphdr))
return (uintptr_t)-1;
tcphdr = (struct tcphdr*)&data[sizeof(struct ether_header) + sizeof(struct ip6_hdr)];
}
struct tcp_resources* res = (struct tcp_resources*)a0;
res->seq = htonl((ntohl(tcphdr->th_seq) + (uint32_t)a1));
res->ack = htonl((ntohl(tcphdr->th_ack) + (uint32_t)a2));
return 0;
}
static void sandbox_common()
{
if (setsid() == -1)
exit(1);
struct rlimit rlim;
rlim.rlim_cur = rlim.rlim_max = 8 << 20;
setrlimit(RLIMIT_MEMLOCK, &rlim);
rlim.rlim_cur = rlim.rlim_max = 1 << 20;
setrlimit(RLIMIT_FSIZE, &rlim);
rlim.rlim_cur = rlim.rlim_max = 1 << 20;
setrlimit(RLIMIT_STACK, &rlim);
rlim.rlim_cur = rlim.rlim_max = 0;
setrlimit(RLIMIT_CORE, &rlim);
rlim.rlim_cur = rlim.rlim_max = 256;
setrlimit(RLIMIT_NOFILE, &rlim);
}
static void loop();
static int do_sandbox_none(void)
{
sandbox_common();
initialize_tun(procid);
loop();
return 0;
}
static long syz_execute_func(volatile long text)
{
volatile long p[8] = {0};
(void)p;
asm volatile("" ::"r"(0l), "r"(1l), "r"(2l), "r"(3l), "r"(4l), "r"(5l), "r"(6l),
"r"(7l), "r"(8l), "r"(9l), "r"(10l), "r"(11l), "r"(12l), "r"(13l));
((void (*)(void))(text))();
return 0;
}
struct thread_t {
int created, call;
event_t ready, done;
};
static struct thread_t threads[16];
static void execute_call(int call);
static int running;
static void* thr(void* arg)
{
struct thread_t* th = (struct thread_t*)arg;
for (;;) {
event_wait(&th->ready);
event_reset(&th->ready);
execute_call(th->call);
__atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED);
event_set(&th->done);
}
return 0;
}
static void execute_one(void)
{
int i, call, thread;
for (call = 0; call < 16; call++) {
for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0])); thread++) {
struct thread_t* th = &threads[thread];
if (!th->created) {
th->created = 1;
event_init(&th->ready);
event_init(&th->done);
event_set(&th->done);
thread_start(thr, th);
}
if (!event_isset(&th->done))
continue;
event_reset(&th->done);
th->call = call;
__atomic_fetch_add(&running, 1, __ATOMIC_RELAXED);
event_set(&th->ready);
event_timedwait(&th->done, 45 + (call == 13 ? 3000 : 0) + (call == 14 ? 3000 : 0) + (call == 15 ? 300 : 0));
break;
}
}
for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++)
sleep_ms(1);
}
static void execute_one(void);
#define WAIT_FLAGS 0
static void loop(void)
{
int iter;
for (iter = 0;; iter++) {
char cwdbuf[32];
sprintf(cwdbuf, "./%d", iter);
if (mkdir(cwdbuf, 0777))
exit(1);
int pid = fork();
if (pid < 0)
exit(1);
if (pid == 0) {
if (chdir(cwdbuf))
exit(1);
execute_one();
exit(0);
}
int status = 0;
uint64_t start = current_time_ms();
for (;;) {
if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
break;
sleep_ms(1);
if (current_time_ms() - start < 5 * 1000)
continue;
kill_and_wait(pid, &status);
break;
}
remove_dir(cwdbuf);
}
}
#ifndef SYS_dup2
#define SYS_dup2 90
#endif
#ifndef SYS_getgid
#define SYS_getgid 47
#endif
#ifndef SYS_getgroups
#define SYS_getgroups 79
#endif
#ifndef SYS_getsockopt
#define SYS_getsockopt 118
#endif
#ifndef SYS_mmap
#define SYS_mmap 197
#endif
#ifndef SYS_semctl
#define SYS_semctl 442
#endif
#ifndef SYS_semget
#define SYS_semget 221
#endif
#ifndef SYS_seteuid
#define SYS_seteuid 183
#endif
#ifndef SYS_setregid
#define SYS_setregid 127
#endif
#ifndef SYS_stat
#define SYS_stat 439
#endif
#ifndef SYS_writev
#define SYS_writev 121
#endif
uint64_t r[7] = {0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff};
void execute_call(int call)
{
intptr_t res = 0;
switch (call) {
case 0:
res = syscall(SYS_dup2, -1, 0xffffff9c);
if (res != -1)
r[0] = res;
break;
case 1:
*(uint64_t*)0x200002c0 = 0x20000000;
memcpy((void*)0x20000000, "\x25\xc5\xf6\x76\x86\x92\xf1\x6a\x6b\x02\x33\x7b\xc5\xf2\x4e\x95\xc2\xe5\x74\xf7\xbd\x23\xda\x78\xff\x22\x41\x43\x9c\xac\xed\x12\x2e\x33\xab\x16\xd3\x77\x84\x34\x15\x78\x1f\xa5\x08\xcd\x63\x5f\x2f\xd0\x41\x13\x20\x4e\xd9\xbd\xa7\x39\x6e\x99\xa3\x8a\x2f\x10\xe9\xc7\x39\x8b\x5a\x64\xc4\x9d\x98\x66\x4b\xd1\x49\x75\xbe\x70\x76\xa8\x36\x38\xa7\xda\x30\x95\xf0\xe0\x27\xbd\x16\x1c\xcd\x5c\x99\x4f\x8b\x31\xd5\x35\xa3\xce\x4c\x57\x81\x2d\x96\x82\xf3\xeb\xb1\x0e\x05\xa7\x14\x22\x10\x51\x5b\x66\x8d\x13\x57\xd9\x1a\xaa\xbb\x6a\xd8\x8a\xed\x6b\x9f\x21\x43\xd0\x62\xe0\xb5", 141);
*(uint64_t*)0x200002c8 = 0x8d;
*(uint64_t*)0x200002d0 = 0x200000c0;
memcpy((void*)0x200000c0, "\xe8\x98\x7e\x8f\x86\x4e\x9d\x38\xb5\x56\x15\xb6\x59\xd1\x4c\xae\x9e\x91\xa9\x53\x22\x13\xff\xb4\x65\xb6\x1b", 27);
*(uint64_t*)0x200002d8 = 0x1b;
*(uint64_t*)0x200002e0 = 0x20000100;
memcpy((void*)0x20000100, "\x3f\x97\x99\x2c\x94\x0f\xba\x89\x36\xa6\xb4", 11);
*(uint64_t*)0x200002e8 = 0xb;
*(uint64_t*)0x200002f0 = 0x20000140;
memcpy((void*)0x20000140, "\xc9\x9a\xb6\x04\xeb\x2e\x44\xeb\xf7\xbf\xb7\xb0\x4c\x08\x43\x21\xa3\x0f\x43\x51\xae\xb0\x67\x6b\xb2\x1a\xef\xc3\xbc\x23\x22\xd9\x9a\x5b\x03\x4f\x88\x0a\xa2\x5d\x61\xae\x40\x76\x39\x7c\x30\x35\x7b\x22\xcc\xb7\x79\xeb\xd3\x20\x6a\xc6\x48\xfa\xb9\x08\x36\xdd\x4d\x9e\x73\xdc\x3c\x07\x72\x70\xb5\x7d\xc3\x22\x22\x84\xdd\x3c\xae\x47\x37\x95\x7d\x94\x7d\x76\x5a\x5e\x0e\x91\x9c\xbd\x3e\xf2\xd3\xd9\x52\x2a\x82\x7f\x3f\xe6\x0d\xdc", 106);
*(uint64_t*)0x200002f8 = 0x6a;
*(uint64_t*)0x20000300 = 0x200001c0;
memcpy((void*)0x200001c0, "\x2b\xc5\xa9\xfd\x6c\xc3\x45\x00\x82\x40\x5a\xb6\x07\xa0\xf5\x62\x7b\x40\x58\x9a\x69\x0a\xc5\x91\x58\xac\xf1\x0f\x2a\x1c\xc4\x61\x52\xfa\x5f\x49\x3a\x85\x99\xcc\x6e\xaa\xb5\xd9\x69\x68\xbe\xf1\xa2\x7f\x62\xda\xcf\x64\xd0\x6c\x80\xcf\xb5\xb3\x20\xb9\x77\xc9\x43\x2c\x44\x6f\xa6\xf6\x55\x14\x44\xee\x4c\x59\x98\x85\x32\x60\xd6\x5d\x2c\xb3\xc7\x78\xf4\x4f\xe2\x70\x36\x3b\x4e\xb3\x09\xe2\x4f\xc4\x77\x97\xb5\xbd\x45\x4b\xf4\xd3\xd4\x65\x6f\xa0\x78\xff\x56\xb3\x0f\x4f\x0e\x9d\x5e\x6e\x89\x43\x83\x0a\xd6\xd3\x42\x96\x8c\x22\x4f\x7c\x35\xaf\x01\xa6\x1d\x10\xe1\x55\xfe\xe7\xe0\x22\x7c\xd7\x9a\x79\x77\xb3\xf4\x03\x51\xca\x01\x83\x48\x40\xab\xba\x55\x7d\x36\xbc\x8a\x42\x08\xf9\x0d\xc5\xf5\x1e\x3f\x3d\x44\x5c\x5f\xee\xa7\x93\x68\x16\x4e\xde\xf0\x5d\x24\x74\x8c\xe9\xf0\xa5\x84\x51\xb4\x3d\x98\x91\x90\x2b\xc4\x5e\xc6\x7d\x00\xdf\x1d\xeb\x74\xe6\x5b\x29\xc0\xd0\x95\xdb\xdd\x5b\x9a\x7c", 220);
*(uint64_t*)0x20000308 = 0xdc;
syscall(SYS_writev, r[0], 0x200002c0ul, 5ul);
break;
case 2:
*(uint32_t*)0x20000340 = 0;
*(uint32_t*)0x20000344 = -1;
*(uint32_t*)0x20000348 = 0;
res = syscall(SYS_getgroups, 3ul, 0x20000340ul);
if (res != -1)
r[1] = *(uint32_t*)0x20000348;
break;
case 3:
*(uint32_t*)0x200003c0 = 0xc;
res = syscall(SYS_getsockopt, -1, 0xffff, 0x11, 0x20000380ul, 0x200003c0ul);
if (res != -1)
r[2] = *(uint32_t*)0x20000388;
break;
case 4:
syscall(SYS_setregid, r[1], r[2]);
break;
case 5:
res = syscall(SYS_semget, 0x798e2634ul, 0ul, 0xb2603d964b180ce8ul);
if (res != -1)
r[3] = res;
break;
case 6:
memcpy((void*)0x20000400, "./file0\000", 8);
res = syscall(SYS_stat, 0x20000400ul, 0x20000440ul);
if (res != -1)
r[4] = *(uint32_t*)0x2000045c;
break;
case 7:
res = syscall(SYS_getgid);
if (res != -1)
r[5] = res;
break;
case 8:
*(uint32_t*)0x20000500 = 0xfffff834;
*(uint32_t*)0x20000504 = r[4];
*(uint32_t*)0x20000508 = r[5];
*(uint32_t*)0x2000050c = -1;
*(uint32_t*)0x20000510 = 0;
*(uint32_t*)0x20000514 = 3;
*(uint16_t*)0x20000518 = 9;
*(uint16_t*)0x2000051a = 0;
*(uint64_t*)0x20000520 = 0;
*(uint64_t*)0x20000528 = 0;
*(uint64_t*)0x20000530 = 0xfffffffffffffffd;
*(uint64_t*)0x20000538 = 0x4535;
*(uint64_t*)0x20000540 = 2;
*(uint64_t*)0x20000548 = 0;
*(uint64_t*)0x20000550 = 0;
syscall(SYS_semctl, r[3], 0ul, 1ul, 0x20000500ul);
break;
case 9:
syscall(SYS_seteuid, 0);
break;
case 10:
memcpy((void*)0x20000000, "\xbf\x5b\xc2\xc4\xdd\xcd\x9b\xaa\x7f\x7c\x66\xf9\x17\x26\xa8\xc4\x90\xf6\x91\x85\x14\x0b\x5b\x42\x51\xe8\x67\x01\xc6\xc5\xa6\x0d\x84\x80\x2d\x38\x2a\x0c\x38\xdf\x4a\x28\xfd\x84\x0d\x7e\x14\x06\xa5\xc2\xeb\x5d\x3b\x6b\xc3\x23\xbd\x49\x38\x6c\x4a\x92\x49\x50\x31\x4f\xe6\x17\xf8\xcd\x34\x37\xa4\xaa\x6d\x1c\x6d\x62\x64\x03\x09\xf9\xde\x23\x93\x99\x9b\x11\x47\x68\xd5\x10\xd7\x34\xfd\x72\xd1\x98\xb2\x61\xbd\x61\x81\x14\xbf\x3f\xa3\xe2\xfe\x84\xff\xe6\x5c\x80\xe4\x72\x12\xc4\x9e\x47\xbb\x3a\xaa\x86\x89\x46\x2f\x21\xd5\x18\x80\xd9\x7c\xb4\x45\xd3", 136);
syz_emit_ethernet(0x88, 0x20000000);
break;
case 11:
memcpy((void*)0x200000c0, "\xc4\xa1\x84\x58\x2c\xaa\x26\x44\x0f\xae\x04\xc4\x41\x0f\x74\xab\x00\x00\x01\x00\xc4\x23\xf5\x78\x4c\xe9\x9d\x40\x44\xdf\x34\x59\x26\x41\x0f\xae\x41\x01\x64\x64\x66\x44\x0f\xe5\xb9\x4e\x9a\xb0\xc4\xc4\x22\x7d\x47\x0f\x41\x0f\x45\x7f\x56\x66\x0f\xdd\xe8", 63);
syz_execute_func(0x200000c0);
break;
case 12:
syz_extract_tcp_res(0x20000100, 6, 1);
break;
case 13:
memcpy((void*)0x20000140, "\x64\xd3\x2f\x16\xeb\xd8\x17\xd0\x04\xdc\xb8\x01\x71\x82\x05\xbc\xa1\xd8\x6d\xad\x3c\xb1\x32\xa2\x86\x60\x92\x14\xb7\x39\x5a\x97\xa0\xe8\xfe\xda\x5f\xad\x02\xcc\xe9\xde\xea\x94\xd5\x5a\x75\x0c\x17\xb2\x34\x07\x50\x02\xb9\xdf\x62\x9f\xa6\x8e\x3f\x7d\xa9\x7e\x9c\x2a\x2e\x0a\x95\xd1\x5d\x35\x95\x61\xb1\x47\x74\x40\x34\x2c\xd7\x9c\x7c\xeb\xd6\xbf\x00\x8a\xcd\x1c\x7f\xf1\x46\xa6\xfe\x22\x01\x36\x61\xd8\xc8\xce\x8e\xb1\x7f\x5c\xf3\x89\x2a\xe0\x8b\xba\x46\x54\x5b\x2b\x69\x0a\xb7\xe0\x36\x8a\xec\x4d\x32\xb7\x6d\x7f\xc1\x5d\xd7\xc2\xab\xa1\x84\xd4\x1a\x5e\x5a\xbb\x8d\x71\x6f\x5e\x64\x5e\x17\x67\x13\x8e\xd7\x38\xf3\x15\x79\x5a\xc9\x9e\x22\xfd\x44\xdb\x06\x09\x63\x13\xf4\x72\x9c\xe0\xd3\xbd\x93\x8f\x5b\x65\x20\xef\x93\x76\xfa\x90\x9d\xf6\xb2\x05\xc2\xd3\xf5\x2e\xe4\x3e\x3f\x59\xea\x44\x1b\x7c\x4e\x4d\x5c", 201);
memcpy((void*)0x20000240, "\xc1\xb0\x1d\x40\x73\x99\x35\xb1\x21\x7d\x0e\x39\x3c\xdd\x4f\xa4\xef\x8b\xbd\x99\x57\xee\x99\x68\x77\xe4\xca\x15\x5c\x19\x5d\xc1\x66\xf9\x48\x6a\xc4\xdb\x17\xf7\x54\xc4\x89\x38\xa4\x34\x19\xf0\x82\xa8\xc3\x0e\xff\xbe\xf0\x64\xf6\xc8\xb8\x7b\xc9\x30\xe4\x39\xc7\x19\xec\x0a\x11\x99\x04\x0b\x86\x28\x6d\x27\x1f\x25\xaf\x26\xeb\xed\x3f\x55\xc3\x2e\x68\xac\x70\x33\x0d\xf7\x69\x31\xbf\x55\xfa\xe8\x80\x25\x6b\x74\xa9\x23\xf8\xa3\x02\x2c\x31\x0f\x94\xcc\x0c\x62\x33\x02\xa5\xd1\x4b\x3f\x8e\x18\xf4\x15\x99\x88\x28\x66\xea\x02\x42\x86\x4b\x37\xd5\xae\x87\xfb\xcb\x74\x5c\x3e\x26\x42\x3d\x05\xc5\x48\x38\x33\xdf\xcd\xd4\x3d\xc0\xc6\x50\x73\x29\x03\x72\x73\xde\x28\x2e\x3a\x16\xac\x00\xc5\x53\x9c\x30\x94\x63\x98\x4b\x15\x3e\xc6\x25\x0a\x78\x19\x75\xa2\x77\x01\x72\x80\xdb\x1e\x9c\x18\xce\x66\x4d\xf5\x94\x7c\x6c\x18\xbe\xf2\x36\x7e\x61\x63\xb4\x6b\x95\x03\xf7\x00\x70\x5f\xd0\xe8\x9e\xae\x6d\xf0\x88\x4b\xf2\x7c\x00\xe0\x5f\xc5\xef\xc6\x49\x07", 234);
syz_usb_connect(0, 0xc9, 0x20000140, 0x20000240);
break;
case 14:
memcpy((void*)0x20000340, "\x36\x4f\xb1\xa4\x17\x26\x3d\xe2\x27\x97\xec\x76\x08\x61\xf3\x85\x2c\xf2\x4f\x79\xe2\xb7\xa5\xc6\x2a\xfa\xd7\xd6\xd4\xd0\x9d\x86\x2f\x8e\xcc\xd0\x2e\x1b\xb9\x89\xe0\xf8\xa8\xad\x91\x54\x42\x01\x64\x04\xc9\x82\x6a\x5c\x0a\x28\x4f\xc7\xa8\x40\x30\x47\x59\xb6\x84\xf3\x57\xb2\xe6\xfe\xcf\xb3\xcc\x81\x57\xc0\x08\xff\x0d\xcf\xf2\x10\x89\x84\x54\x8a\x2a\xd6\x95\xfa\xd9\x51\x2f\x06\xfd\x12\xd6\x6b\xc4\x43\x04\x75\x12\xab\x4e\xf3\x05\x8a\xe6\xc0\xc6\xec\x3f\xd6\x27\xe3\x70\xa1\x51\xae\x71\x9b\x8e\x3a\x77\xd6\x82\xdc\x06\xa9\x3b\xe9\xc2\xaa\x80\x18\xb5\x8a\x94\x92\xcb\x39\x03\x1b\xb5\xab\xf3\x12\x4e\xaa\xb8\x53\x30\xf1\x81\xfc\xcc\xa7\x59\x7b\x4e\xc0\x87\x9f\xcb\xcf\x51\x14\x3f\x98\xc4\x43\xc1\x67\x20\xa6\xe0\x1b\x7e\x07\xdf\x47\x27\xe2\x88\xe1\x3d\xcc\x0b\x7e\x11", 191);
memcpy((void*)0x20000400, "\x59\x03\x92\x3c\x7a\x1b\x28\x38\xf3\xc1\x21\x56\x78\x5a\x11\xc8\x1b\x2e\x82\xd9\xa1\x19\x0e\x1b\x9c\x45\x97\x6a\x91\x7c\x00\x29\x4d\xc9\x4d\x53\x54\xe8\xc5\xd6\xa4\xe8\x98\x6d\xa0\x74\xeb\x46\x1e\xd0\x73\x6b\xcb\xed\xe2\xce\xf1\xf1\x9e\x02\x16\xc0\x9e\xb7\x94\xd8\xb9\x75\x4f\xea\x26\xf1\x10\xc8\x32\x48\xc2\x86\xea\xa0\x5a\x69\x84\x4e\xb1\x29\x2f\x59\x4f\x59\xf6\xc9\xbe\xca\x47\xd8\x94\xd4\x4d\xfd\x15\xff\x81\xb7\x6b\x46\x35\x39\x2e\xb5\xed\x43\x1c\xa3\x09\x22\x30", 117);
res = syz_usb_connect(4, 0xbf, 0x20000340, 0x20000400);
if (res != -1)
r[6] = res;
break;
case 15:
syz_usb_disconnect(r[6]);
break;
}
}
int main(void)
{
syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 3ul, 0x1012ul, -1, 0ul, 0ul);
use_temporary_dir();
do_sandbox_none();
return 0;
}
<stdin>:198:2: error: unknown type name 'uint8_t_t'
<stdin>:199:2: error: unknown type name 'uint8_t_t'
<stdin>:200:2: error: unknown type name 'uint8_t_t'
<stdin>:201:2: error: unknown type name 'uint8_t_t'
<stdin>:202:2: error: unknown type name 'uint16_t_t'
<stdin>:203:2: error: unknown type name 'uint8_t_t'
<stdin>:204:2: error: unknown type name 'uint8_t_t'
<stdin>:205:2: error: unknown type name 'uint8_t_t'
<stdin>:209:2: error: unknown type name 'uint8_t_t'
<stdin>:210:2: error: unknown type name 'uint8_t_t'
<stdin>:211:2: error: unknown type name 'uint16_t_t'
<stdin>:212:2: error: unknown type name 'uint8_t_t'
<stdin>:213:2: error: unknown type name 'uint8_t_t'
<stdin>:214:2: error: unknown type name 'uint8_t_t'
<stdin>:215:2: error: unknown type name 'uint8_t_t'
<stdin>:216:2: error: unknown type name 'uint16_t_t'
<stdin>:217:2: error: unknown type name 'uint16_t_t'
<stdin>:218:2: error: unknown type name 'uint16_t_t'
<stdin>:219:2: error: unknown type name 'uint8_t_t'
<stdin>:220:2: error: unknown type name 'uint8_t_t'
<stdin>:221:2: error: unknown type name 'uint8_t_t'
<stdin>:222:2: error: unknown type name 'uint8_t_t'
<stdin>:226:2: error: unknown type name 'uint8_t_t'
<stdin>:227:2: error: unknown type name 'uint8_t_t'
<stdin>:228:2: error: unknown type name 'uint16_t_t'
<stdin>:229:2: error: unknown type name 'uint8_t_t'
<stdin>:230:2: error: unknown type name 'uint8_t_t'
<stdin>:231:2: error: unknown type name 'uint8_t_t'
<stdin>:232:2: error: unknown type name 'uint8_t_t'
<stdin>:233:2: error: unknown type name 'uint8_t_t'
<stdin>:237:2: error: unknown type name 'uint8_t_t'
<stdin>:238:2: error: unknown type name 'uint8_t_t'
<stdin>:239:2: error: unknown type name 'uint8_t_t'
<stdin>:240:2: error: unknown type name 'uint8_t_t'
<stdin>:241:2: error: unknown type name 'uint8_t_t'
<stdin>:242:2: error: unknown type name 'uint8_t_t'
<stdin>:243:2: error: unknown type name 'uint8_t_t'
<stdin>:244:2: error: unknown type name 'uint8_t_t'
<stdin>:245:2: error: unknown type name 'uint8_t_t'
<stdin>:249:2: error: unknown type name 'uint8_t_t'
<stdin>:250:2: error: unknown type name 'uint8_t_t'
<stdin>:251:2: error: unknown type name 'uint16_t_t'
<stdin>:252:2: error: unknown type name 'uint16_t_t'
<stdin>:253:2: error: unknown type name 'uint16_t_t'
<stdin>:257:2: error: unknown type name 'uint8_t_t'
<stdin>:258:2: error: unknown type name 'uint8_t_t'
<stdin>:259:2: error: unknown type name 'uint16_t_t'
<stdin>:260:2: error: unknown type name 'uint8_t_t'
<stdin>:261:2: error: unknown type name 'uint8_t_t'
<stdin>:262:2: error: unknown type name 'uint8_t_t'
<stdin>:263:2: error: unknown type name 'uint8_t_t'
<stdin>:264:2: error: unknown type name 'uint8_t_t'
<stdin>:265:2: error: unknown type name 'uint8_t_t'
<stdin>: In function 'vhci_usb_recv':
<stdin>:572:2: error: unknown type name 'uint8_t_t'; did you mean 'uint8_t'?
<stdin>:572:20: error: 'uint8_t_t' undeclared (first use in this function); did you mean 'uint8_t'?
<stdin>:572:20: note: each undeclared identifier is reported only once for each function it appears in
<stdin>:572:30: error: expected expression before ')' token
<stdin>: In function 'vhci_usb_send':
<stdin>:587:2: error: unknown type name 'uint8_t_t'; did you mean 'uint8_t'?
<stdin>:587:20: error: 'uint8_t_t' undeclared (first use in this function); did you mean 'uint8_t'?
<stdin>:587:30: error: expected expression before ')' token
<stdin>: In function 'syz_usb_connect_impl':
<stdin>:648:63: error: unknown type name 'usb_ctrlrequest'
<stdin>:653:55: error: unknown type name 'usb_ctrlrequest'
<stdin>:665:8: error: 'uint32_t_t' undeclared (first use in this function); did you mean 'uint32_t'?
At top level:
<stdin>:713:13: error: 'setup_usb' defined but not used [-Werror=unused-function]
cc1: all warnings being treated as errors
compiler invocation: /syzkaller/netbsd/src/../tools/bin/x86_64--netbsd-g++ [-o /tmp/syz-executor147115301 -DGOOS_netbsd=1 -DGOARCH_amd64=1 -DHOSTGOOS_linux=1 -x c - -m64 --sysroot /syzkaller/netbsd/src/../dest/ -O2 -pthread -Wall -Werror -Wparentheses -Wframe-larger-than=16384]
--- FAIL: TestGenerate/netbsd/amd64/1 (0.44s)
csource_test.go:123: opts: {Threaded:true Collide:false Repeat:true RepeatTimes:0 Procs:0 Sandbox:none Fault:false FaultCall:0 FaultNth:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false USB:false UseTmpDir:true HandleSegv:false Repro:false Trace:false}
program:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
writev(r0, &(0x7f00000002c0)=[{&(0x7f0000000000)="25c5f6768692f16a6b02337bc5f24e95c2e574f7bd23da78ff2241439caced122e33ab16d377843415781fa508cd635f2fd04113204ed9bda7396e99a38a2f10e9c7398b5a64c49d98664bd14975be7076a83638a7da3095f0e027bd161ccd5c994f8b31d535a3ce4c57812d9682f3ebb10e05a7142210515b668d1357d91aaabb6ad88aed6b9f2143d062e0b5", 0x8d}, {&(0x7f00000000c0)="e8987e8f864e9d38b55615b659d14cae9e91a9532213ffb465b61b", 0x1b}, {&(0x7f0000000100)="3f97992c940fba8936a6b4", 0xb}, {&(0x7f0000000140)="c99ab604eb2e44ebf7bfb7b04c084321a30f4351aeb0676bb21aefc3bc2322d99a5b034f880aa25d61ae4076397c30357b22ccb779ebd3206ac648fab90836dd4d9e73dc3c077270b57dc3222284dd3cae4737957d947d765a5e0e919cbd3ef2d3d9522a827f3fe60ddc", 0x6a}, {&(0x7f00000001c0)="2bc5a9fd6cc3450082405ab607a0f5627b40589a690ac59158acf10f2a1cc46152fa5f493a8599cc6eaab5d96968bef1a27f62dacf64d06c80cfb5b320b977c9432c446fa6f6551444ee4c5998853260d65d2cb3c778f44fe270363b4eb309e24fc47797b5bd454bf4d3d4656fa078ff56b30f4f0e9d5e6e8943830ad6d342968c224f7c35af01a61d10e155fee7e0227cd79a7977b3f40351ca01834840abba557d36bc8a4208f90dc5f51e3f3d445c5feea79368164edef05d24748ce9f0a58451b43d9891902bc45ec67d00df1deb74e65b29c0d095dbdd5b9a7c", 0xdc}], 0x5)
getgroups(0x3, &(0x7f0000000340)=[0x0, 0xffffffffffffffff, <r1=>0x0])
getsockopt$sock_cred(0xffffffffffffffff, 0xffff, 0x11, &(0x7f0000000380)={0x0, 0x0, <r2=>0x0}, &(0x7f00000003c0)=0xc)
setregid(r1, r2)
r3 = semget(0x1, 0x0, 0xb2603d964b180ce8)
stat(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, <r4=>0x0})
r5 = getgid()
semctl$IPC_SET(r3, 0x0, 0x1, &(0x7f0000000500)={{0xfffff834, r4, r5, 0xffffffffffffffff, 0x0, 0x3, 0x9}, 0xfffffffffffffffd, 0x4535, 0x2})
seteuid(0x0)
syz_emit_ethernet(0x88, &(0x7f0000000000)="bf5bc2c4ddcd9baa7f7c66f91726a8c490f69185140b5b4251e86701c6c5a60d84802d382a0c38df4a28fd840d7e1406a5c2eb5d3b6bc323bd49386c4a924950314fe617f8cd3437a4aa6d1c6d62640309f9de2393999b114768d510d734fd72d198b261bd618114bf3fa3e2fe84ffe65c80e47212c49e47bb3aaa8689462f21d51880d97cb445d3")
syz_execute_func(&(0x7f00000000c0)="c4a184582caa26440fae04c4410f74ab00000100c423f5784ce99d4044df345926410fae4101646466440fe5b94e9ab0c4c4227d470f410f457f56660fdde8")
syz_extract_tcp_res(&(0x7f0000000100), 0x6, 0x1)
syz_usb_connect(0x0, 0xc9, &(0x7f0000000140)="64d32f16ebd817d004dcb801718205bca1d86dad3cb132a286609214b7395a97a0e8feda5fad02cce9deea94d55a750c17b234075002b9df629fa68e3f7da97e9c2a2e0a95d15d359561b1477440342cd79c7cebd6bf008acd1c7ff146a6fe22013661d8c8ce8eb17f5cf3892ae08bba46545b2b690ab7e0368aec4d32b76d7fc15dd7c2aba184d41a5e5abb8d716f5e645e1767138ed738f315795ac99e22fd44db06096313f4729ce0d3bd938f5b6520ef9376fa909df6b205c2d3f52ee43e3f59ea441b7c4e4d5c", &(0x7f0000000240)="c1b01d40739935b1217d0e393cdd4fa4ef8bbd9957ee996877e4ca155c195dc166f9486ac4db17f754c48938a43419f082a8c30effbef064f6c8b87bc930e439c719ec0a1199040b86286d271f25af26ebed3f55c32e68ac70330df76931bf55fae880256b74a923f8a3022c310f94cc0c623302a5d14b3f8e18f41599882866ea0242864b37d5ae87fbcb745c3e26423d05c5483833dfcdd43dc0c6507329037273de282e3a16ac00c5539c309463984b153ec6250a781975a277017280db1e9c18ce664df5947c6c18bef2367e6163b46b9503f700705fd0e89eae6df0884bf27c00e05fc5efc64907")
r6 = syz_usb_connect(0x4, 0xbf, &(0x7f0000000340)="364fb1a417263de22797ec760861f3852cf24f79e2b7a5c62afad7d6d4d09d862f8eccd02e1bb989e0f8a8ad915442016404c9826a5c0a284fc7a840304759b684f357b2e6fecfb3cc8157c008ff0dcff2108984548a2ad695fad9512f06fd12d66bc443047512ab4ef3058ae6c0c6ec3fd627e370a151ae719b8e3a77d682dc06a93be9c2aa8018b58a9492cb39031bb5abf3124eaab85330f181fccca7597b4ec0879fcbcf51143f98c443c16720a6e01b7e07df4727e288e13dcc0b7e11", &(0x7f0000000400)="5903923c7a1b2838f3c12156785a11c81b2e82d9a1190e1b9c45976a917c00294dc94d5354e8c5d6a4e8986da074eb461ed0736bcbede2cef1f19e0216c09eb794d8b9754fea26f110c83248c286eaa05a69844eb1292f594f59f6c9beca47d894d44dfd15ff81b76b4635392eb5ed431ca3092230")
syz_usb_disconnect(r6)
csource_test.go:124: failed to build program:
// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <dev/usb/usb.h>
#include <dev/usb/usbhid.h>
#include <dev/usb/vhci.h>
#include <dirent.h>
#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <pthread.h>
#include <pwd.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ioctl.h>
#include <sys/resource.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>
static unsigned long long procid;
static void kill_and_wait(int pid, int* status)
{
kill(pid, SIGKILL);
while (waitpid(-1, status, 0) != pid) {
}
}
static void sleep_ms(uint64_t ms)
{
usleep(ms * 1000);
}
static uint64_t current_time_ms(void)
{
struct timespec ts;
if (clock_gettime(CLOCK_MONOTONIC, &ts))
exit(1);
return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}
static void use_temporary_dir(void)
{
char tmpdir_template[] = "./syzkaller.XXXXXX";
char* tmpdir = mkdtemp(tmpdir_template);
if (!tmpdir)
exit(1);
if (chmod(tmpdir, 0777))
exit(1);
if (chdir(tmpdir))
exit(1);
}
static void remove_dir(const char* dir)
{
DIR* dp;
struct dirent* ep;
dp = opendir(dir);
if (dp == NULL)
exit(1);
while ((ep = readdir(dp))) {
if (strcmp(ep->d_name, ".") == 0 || strcmp(ep->d_name, "..") == 0)
continue;
char filename[FILENAME_MAX];
snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name);
struct stat st;
if (lstat(filename, &st))
exit(1);
if (S_ISDIR(st.st_mode)) {
remove_dir(filename);
continue;
}
if (unlink(filename))
exit(1);
}
closedir(dp);
if (rmdir(dir))
exit(1);
}
static void thread_start(void* (*fn)(void*), void* arg)
{
pthread_t th;
pthread_attr_t attr;
pthread_attr_init(&attr);
pthread_attr_setstacksize(&attr, 128 << 10);
int i;
for (i = 0; i < 100; i++) {
if (pthread_create(&th, &attr, fn, arg) == 0) {
pthread_attr_destroy(&attr);
return;
}
if (errno == EAGAIN) {
usleep(50);
continue;
}
break;
}
exit(1);
}
typedef struct {
pthread_mutex_t mu;
pthread_cond_t cv;
int state;
} event_t;
static void event_init(event_t* ev)
{
if (pthread_mutex_init(&ev->mu, 0))
exit(1);
if (pthread_cond_init(&ev->cv, 0))
exit(1);
ev->state = 0;
}
static void event_reset(event_t* ev)
{
ev->state = 0;
}
static void event_set(event_t* ev)
{
pthread_mutex_lock(&ev->mu);
if (ev->state)
exit(1);
ev->state = 1;
pthread_mutex_unlock(&ev->mu);
pthread_cond_broadcast(&ev->cv);
}
static void event_wait(event_t* ev)
{
pthread_mutex_lock(&ev->mu);
while (!ev->state)
pthread_cond_wait(&ev->cv, &ev->mu);
pthread_mutex_unlock(&ev->mu);
}
static int event_isset(event_t* ev)
{
pthread_mutex_lock(&ev->mu);
int res = ev->state;
pthread_mutex_unlock(&ev->mu);
return res;
}
static int event_timedwait(event_t* ev, uint64_t timeout)
{
uint64_t start = current_time_ms();
uint64_t now = start;
pthread_mutex_lock(&ev->mu);
for (;;) {
if (ev->state)
break;
uint64_t remain = timeout - (now - start);
struct timespec ts;
ts.tv_sec = remain / 1000;
ts.tv_nsec = (remain % 1000) * 1000 * 1000;
pthread_cond_timedwait(&ev->cv, &ev->mu, &ts);
now = current_time_ms();
if (now - start > timeout)
break;
}
int res = ev->state;
pthread_mutex_unlock(&ev->mu);
return res;
}
/* -------------------------------------------------------------------------- */
/*
* Redefinitions to match the linux types used in common_usb.h.
*/
struct usb_endpoint_descriptor {
uint8_t_t bLength;
uint8_t_t bDescriptorType;
uint8_t_t bEndpointAddress;
uint8_t_t bmAttributes;
uint16_t_t wMaxPacketSize;
uint8_t_t bInterval;
uint8_t_t bRefresh;
uint8_t_t bSynchAddress;
} __attribute__((packed));
struct usb_device_descriptor {
uint8_t_t bLength;
uint8_t_t bDescriptorType;
uint16_t_t bcdUSB;
uint8_t_t bDeviceClass;
uint8_t_t bDeviceSubClass;
uint8_t_t bDeviceProtocol;
uint8_t_t bMaxPacketSize0;
uint16_t_t idVendor;
uint16_t_t idProduct;
uint16_t_t bcdDevice;
uint8_t_t iManufacturer;
uint8_t_t iProduct;
uint8_t_t iSerialNumber;
uint8_t_t bNumConfigurations;
} __attribute__((packed));
struct usb_config_descriptor {
uint8_t_t bLength;
uint8_t_t bDescriptorType;
uint16_t_t wTotalLength;
uint8_t_t bNumInterfaces;
uint8_t_t bConfigurationValue;
uint8_t_t iConfiguration;
uint8_t_t bmAttributes;
uint8_t_t bMaxPower;
} __attribute__((packed));
struct usb_interface_descriptor {
uint8_t_t bLength;
uint8_t_t bDescriptorType;
uint8_t_t bInterfaceNumber;
uint8_t_t bAlternateSetting;
uint8_t_t bNumEndpoints;
uint8_t_t bInterfaceClass;
uint8_t_t bInterfaceSubClass;
uint8_t_t bInterfaceProtocol;
uint8_t_t iInterface;
} __attribute__((packed));
struct usb_ctrlrequest {
uint8_t_t bRequestType;
uint8_t_t bRequest;
uint16_t_t wValue;
uint16_t_t wIndex;
uint16_t_t wLength;
} __attribute__((packed));
struct usb_qualifier_descriptor {
uint8_t_t bLength;
uint8_t_t bDescriptorType;
uint16_t_t bcdUSB;
uint8_t_t bDeviceClass;
uint8_t_t bDeviceSubClass;
uint8_t_t bDeviceProtocol;
uint8_t_t bMaxPacketSize0;
uint8_t_t bNumConfigurations;
uint8_t_t bRESERVED;
} __attribute__((packed));
#define USB_TYPE_MASK (0x03 << 5)
#define USB_TYPE_STANDARD (0x00 << 5)
#define USB_TYPE_CLASS (0x01 << 5)
#define USB_TYPE_VENDOR (0x02 << 5)
#define USB_TYPE_RESERVED (0x03 << 5)
#define USB_DT_DEVICE 0x01
#define USB_DT_CONFIG 0x02
#define USB_DT_STRING 0x03
#define USB_DT_INTERFACE 0x04
#define USB_DT_ENDPOINT 0x05
#define USB_DT_DEVICE_QUALIFIER 0x06
#define USB_DT_OTHER_SPEED_CONFIG 0x07
#define USB_DT_INTERFACE_POWER 0x08
#define USB_DT_OTG 0x09
#define USB_DT_DEBUG 0x0a
#define USB_DT_INTERFACE_ASSOCIATION 0x0b
#define USB_DT_SECURITY 0x0c
#define USB_DT_KEY 0x0d
#define USB_DT_ENCRYPTION_TYPE 0x0e
#define USB_DT_BOS 0x0f
#define USB_DT_DEVICE_CAPABILITY 0x10
#define USB_DT_WIRELESS_ENDPOINT_COMP 0x11
#define USB_DT_WIRE_ADAPTER 0x21
#define USB_DT_RPIPE 0x22
#define USB_DT_CS_RADIO_CONTROL 0x23
#define USB_DT_PIPE_USAGE 0x24
#define USB_DT_SS_ENDPOINT_COMP 0x30
#define USB_DT_SSP_ISOC_ENDPOINT_COMP 0x31
#define USB_REQ_GET_STATUS 0x00
#define USB_REQ_CLEAR_FEATURE 0x01
#define USB_REQ_SET_FEATURE 0x03
#define USB_REQ_SET_ADDRESS 0x05
#define USB_REQ_GET_DESCRIPTOR 0x06
#define USB_REQ_SET_DESCRIPTOR 0x07
#define USB_REQ_GET_CONFIGURATION 0x08
#define USB_REQ_SET_CONFIGURATION 0x09
#define USB_REQ_GET_INTERFACE 0x0A
#define USB_REQ_SET_INTERFACE 0x0B
#define USB_REQ_SYNCH_FRAME 0x0C
#define USB_REQ_SET_SEL 0x30
#define USB_REQ_SET_ISOCH_DELAY 0x31
#define USB_REQ_SET_ENCRYPTION 0x0D
#define USB_REQ_GET_ENCRYPTION 0x0E
#define USB_REQ_RPIPE_ABORT 0x0E
#define USB_REQ_SET_HANDSHAKE 0x0F
#define USB_REQ_RPIPE_RESET 0x0F
#define USB_REQ_GET_HANDSHAKE 0x10
#define USB_REQ_SET_CONNECTION 0x11
#define USB_REQ_SET_SECURITY_DATA 0x12
#define USB_REQ_GET_SECURITY_DATA 0x13
#define USB_REQ_SET_WUSB_DATA 0x14
#define USB_REQ_LOOPBACK_DATA_WRITE 0x15
#define USB_REQ_LOOPBACK_DATA_READ 0x16
#define USB_REQ_SET_INTERFACE_DS 0x17
#define USB_REQ_GET_PARTNER_PDO 20
#define USB_REQ_GET_BATTERY_STATUS 21
#define USB_REQ_SET_PDO 22
#define USB_REQ_GET_VDM 23
#define USB_REQ_SEND_VDM 24
#define USB_MAX_IFACE_NUM 4
#define USB_MAX_EP_NUM 32
#define USB_MAX_FDS 6
struct usb_endpoint_index {
struct usb_endpoint_descriptor desc;
int handle;
};
struct usb_iface_index {
struct usb_interface_descriptor* iface;
uint8_t bInterfaceNumber;
uint8_t bAlternateSetting;
uint8_t bInterfaceClass;
struct usb_endpoint_index eps[USB_MAX_EP_NUM];
int eps_num;
};
struct usb_device_index {
struct usb_device_descriptor* dev;
struct usb_config_descriptor* config;
uint8_t bDeviceClass;
uint8_t bMaxPower;
int config_length;
struct usb_iface_index ifaces[USB_MAX_IFACE_NUM];
int ifaces_num;
int iface_cur;
};
struct usb_info {
int fd;
struct usb_device_index index;
};
static struct usb_info usb_devices[USB_MAX_FDS];
static int usb_devices_num;
static bool parse_usb_descriptor(const char* buffer, size_t length, struct usb_device_index* index)
{
if (length < sizeof(*index->dev) + sizeof(*index->config))
return false;
memset(index, 0, sizeof(*index));
index->dev = (struct usb_device_descriptor*)buffer;
index->config = (struct usb_config_descriptor*)(buffer + sizeof(*index->dev));
index->bDeviceClass = index->dev->bDeviceClass;
index->bMaxPower = index->config->bMaxPower;
index->config_length = length - sizeof(*index->dev);
index->iface_cur = -1;
size_t offset = 0;
while (true) {
if (offset + 1 >= length)
break;
uint8_t desc_length = buffer[offset];
uint8_t desc_type = buffer[offset + 1];
if (desc_length <= 2)
break;
if (offset + desc_length > length)
break;
if (desc_type == USB_DT_INTERFACE && index->ifaces_num < USB_MAX_IFACE_NUM) {
struct usb_interface_descriptor* iface = (struct usb_interface_descriptor*)(buffer + offset);
index->ifaces[index->ifaces_num].iface = iface;
index->ifaces[index->ifaces_num].bInterfaceNumber = iface->bInterfaceNumber;
index->ifaces[index->ifaces_num].bAlternateSetting = iface->bAlternateSetting;
index->ifaces[index->ifaces_num].bInterfaceClass = iface->bInterfaceClass;
index->ifaces_num++;
}
if (desc_type == USB_DT_ENDPOINT && index->ifaces_num > 0) {
struct usb_iface_index* iface = &index->ifaces[index->ifaces_num - 1];
if (iface->eps_num < USB_MAX_EP_NUM) {
memcpy(&iface->eps[iface->eps_num].desc, buffer + offset, sizeof(iface->eps[iface->eps_num].desc));
iface->eps_num++;
}
}
offset += desc_length;
}
return true;
}
static struct usb_device_index* add_usb_index(int fd, const char* dev, size_t dev_len)
{
int i = __atomic_fetch_add(&usb_devices_num, 1, __ATOMIC_RELAXED);
if (i >= USB_MAX_FDS)
return NULL;
int rv = 0;
rv = parse_usb_descriptor(dev, dev_len, &usb_devices[i].index);
if (!rv)
return NULL;
__atomic_store_n(&usb_devices[i].fd, fd, __ATOMIC_RELEASE);
return &usb_devices[i].index;
}
static struct usb_device_index* lookup_usb_index(int fd)
{
int i;
for (i = 0; i < USB_MAX_FDS; i++) {
if (__atomic_load_n(&usb_devices[i].fd, __ATOMIC_ACQUIRE) == fd) {
return &usb_devices[i].index;
}
}
return NULL;
}
struct vusb_connect_string_descriptor {
uint32_t len;
char* str;
} __attribute__((packed));
struct vusb_connect_descriptors {
uint32_t qual_len;
char* qual;
uint32_t bos_len;
char* bos;
uint32_t strs_len;
struct vusb_connect_string_descriptor strs[0];
} __attribute__((packed));
static const char default_string[] = {
8, USB_DT_STRING,
's', 0, 'y', 0, 'z', 0
};
static const char default_lang_id[] = {
4, USB_DT_STRING,
0x09, 0x04
};
static bool lookup_connect_response_in(int fd, const struct vusb_connect_descriptors* descs,
const struct usb_ctrlrequest* ctrl,
char** response_data, uint32_t* response_length)
{
struct usb_device_index* index = lookup_usb_index(fd);
uint8_t str_idx;
if (!index)
return false;
switch (ctrl->bRequestType & USB_TYPE_MASK) {
case USB_TYPE_STANDARD:
switch (ctrl->bRequest) {
case USB_REQ_GET_DESCRIPTOR:
switch (ctrl->wValue >> 8) {
case USB_DT_DEVICE:
*response_data = (char*)index->dev;
*response_length = sizeof(*index->dev);
return true;
case USB_DT_CONFIG:
*response_data = (char*)index->config;
*response_length = index->config_length;
return true;
case USB_DT_STRING:
str_idx = (uint8_t)ctrl->wValue;
if (descs && str_idx < descs->strs_len) {
*response_data = descs->strs[str_idx].str;
*response_length = descs->strs[str_idx].len;
return true;
}
if (str_idx == 0) {
*response_data = (char*)&default_lang_id[0];
*response_length = default_lang_id[0];
return true;
}
*response_data = (char*)&default_string[0];
*response_length = default_string[0];
return true;
case USB_DT_BOS:
*response_data = descs->bos;
*response_length = descs->bos_len;
return true;
case USB_DT_DEVICE_QUALIFIER:
if (!descs->qual) {
struct usb_qualifier_descriptor* qual =
(struct usb_qualifier_descriptor*)response_data;
qual->bLength = sizeof(*qual);
qual->bDescriptorType = USB_DT_DEVICE_QUALIFIER;
qual->bcdUSB = index->dev->bcdUSB;
qual->bDeviceClass = index->dev->bDeviceClass;
qual->bDeviceSubClass = index->dev->bDeviceSubClass;
qual->bDeviceProtocol = index->dev->bDeviceProtocol;
qual->bMaxPacketSize0 = index->dev->bMaxPacketSize0;
qual->bNumConfigurations = index->dev->bNumConfigurations;
qual->bRESERVED = 0;
*response_length = sizeof(*qual);
return true;
}
*response_data = descs->qual;
*response_length = descs->qual_len;
return true;
default:
break;
}
break;
default:
break;
}
break;
default:
break;
}
return false;
}
typedef bool (*lookup_connect_out_response_t)(int fd, const struct vusb_connect_descriptors* descs,
const struct usb_ctrlrequest* ctrl, bool* done);
static bool lookup_connect_response_out_generic(int fd, const struct vusb_connect_descriptors* descs,
const struct usb_ctrlrequest* ctrl, bool* done)
{
switch (ctrl->bRequestType & USB_TYPE_MASK) {
case USB_TYPE_STANDARD:
switch (ctrl->bRequest) {
case USB_REQ_SET_CONFIGURATION:
*done = true;
return true;
default:
break;
}
break;
}
return false;
}
/* -------------------------------------------------------------------------- */
static int vhci_open(void)
{
return open("/dev/vhci", O_RDWR);
}
static int vhci_setport(int fd, u_int port)
{
struct vhci_ioc_set_port args;
args.port = port;
return ioctl(fd, VHCI_IOC_SET_PORT, &args);
}
static int vhci_usb_attach(int fd)
{
return ioctl(fd, VHCI_IOC_USB_ATTACH, NULL);
}
static int vhci_usb_recv(int fd, void* buf, size_t size)
{
uint8_t_t* ptr = (uint8_t_t*)buf;
ssize_t done;
while (1) {
done = read(fd, ptr, size);
if (done < 0)
return -1;
if ((size_t)done == size)
return 0;
size -= done;
ptr += done;
}
}
static int vhci_usb_send(int fd, void* buf, size_t size)
{
uint8_t_t* ptr = (uint8_t_t*)buf;
ssize_t done;
while (1) {
done = write(fd, ptr, size);
if (done <= 0)
return -1;
if ((size_t)done == size)
return 0;
size -= done;
ptr += done;
}
}
/* -------------------------------------------------------------------------- */
static volatile long syz_usb_connect_impl(uint64_t speed, uint64_t dev_len,
const char* dev, const struct vusb_connect_descriptors* descs,
lookup_connect_out_response_t lookup_connect_response_out)
{
struct usb_device_index* index;
int portnum, fd, rv;
bool done;
portnum = procid + 1;
if (!dev) {
return -1;
}
if (portnum != 1) {
/* For now, we support only one proc. */
return -1;
}
fd = vhci_open();
if (fd < 0) {
return -1;
}
index = add_usb_index(fd, dev, dev_len);
if (!index) {
goto err;
}
rv = vhci_setport(fd, portnum);
if (rv != 0) {
goto err;
}
rv = vhci_usb_attach(fd);
if (rv != 0) {
goto err;
}
done = false;
while (!done) {
vhci_request_t req;
rv = vhci_usb_recv(fd, &req, sizeof(req));
if (rv != 0) {
goto err;
}
if (req.type != VHCI_REQ_CTRL) {
goto err;
}
char* response_data = NULL;
uint32_t response_length = 0;
char data[4096];
if (req.u.ctrl.bmRequestType & UE_DIR_IN) {
bool response_found = false;
response_found = lookup_connect_response_in(fd, descs, (const usb_ctrlrequest*)&req.u.ctrl, &response_data, &response_length);
if (!response_found) {
goto err;
}
} else {
if (!lookup_connect_response_out(fd, descs, (const usb_ctrlrequest*)&req.u.ctrl, &done)) {
goto err;
}
response_data = NULL;
response_length = UGETW(req.u.ctrl.wLength);
}
if ((req.u.ctrl.bmRequestType & USB_TYPE_MASK) == USB_TYPE_STANDARD &&
req.u.ctrl.bRequest == USB_REQ_SET_CONFIGURATION) {
/* TODO: possibly revisit */
}
if (response_length > sizeof(data))
response_length = 0;
if ((uint32_t_t)UGETW(req.u.ctrl.wLength) < response_length)
response_length = UGETW(req.u.ctrl.wLength);
if (response_data)
memcpy(data, response_data, response_length);
else
memset(data, 0, response_length);
if (req.u.ctrl.bmRequestType & UE_DIR_IN) {
if (response_length > 0) {
vhci_response_t res;
res.size = response_length;
rv = vhci_usb_send(fd, &res, sizeof(res));
if (rv == 0)
rv = vhci_usb_send(fd, data, response_length);
}
} else {
rv = vhci_usb_recv(fd, data, response_length);
}
if (rv < 0) {
goto err;
}
}
sleep_ms(200);
return fd;
err:
close(fd);
return -1;
}
static volatile long syz_usb_connect(volatile long a0, volatile long a1,
volatile long a2, volatile long a3)
{
uint64_t speed = a0;
uint64_t dev_len = a1;
const char* dev = (const char*)a2;
const struct vusb_connect_descriptors* descs = (const struct vusb_connect_descriptors*)a3;
return syz_usb_connect_impl(speed, dev_len, dev, descs,
&lookup_connect_response_out_generic);
}
static volatile long syz_usb_disconnect(volatile long a0)
{
int fd = a0;
int rv = close(fd);
sleep_ms(200);
return rv;
}
static void setup_usb(void)
{
if (chmod("/dev/vhci", 0666))
exit(1);
}
static void sandbox_common()
{
if (setsid() == -1)
exit(1);
struct rlimit rlim;
rlim.rlim_cur = rlim.rlim_max = 8 << 20;
setrlimit(RLIMIT_MEMLOCK, &rlim);
rlim.rlim_cur = rlim.rlim_max = 1 << 20;
setrlimit(RLIMIT_FSIZE, &rlim);
rlim.rlim_cur = rlim.rlim_max = 1 << 20;
setrlimit(RLIMIT_STACK, &rlim);
rlim.rlim_cur = rlim.rlim_max = 0;
setrlimit(RLIMIT_CORE, &rlim);
rlim.rlim_cur = rlim.rlim_max = 256;
setrlimit(RLIMIT_NOFILE, &rlim);
}
static void loop();
static int do_sandbox_none(void)
{
sandbox_common();
loop();
return 0;
}
static long syz_execute_func(volatile long text)
{
volatile long p[8] = {0};
(void)p;
asm volatile("" ::"r"(0l), "r"(1l), "r"(2l), "r"(3l), "r"(4l), "r"(5l), "r"(6l),
"r"(7l), "r"(8l), "r"(9l), "r"(10l), "r"(11l), "r"(12l), "r"(13l));
((void (*)(void))(text))();
return 0;
}
struct thread_t {
int created, call;
event_t ready, done;
};
static struct thread_t threads[16];
static void execute_call(int call);
static int running;
static void* thr(void* arg)
{
struct thread_t* th = (struct thread_t*)arg;
for (;;) {
event_wait(&th->ready);
event_reset(&th->ready);
execute_call(th->call);
__atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED);
event_set(&th->done);
}
return 0;
}
static void execute_one(void)
{
int i, call, thread;
for (call = 0; call < 16; call++) {
for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0])); thread++) {
struct thread_t* th = &threads[thread];
if (!th->created) {
th->created = 1;
event_init(&th->ready);
event_init(&th->done);
event_set(&th->done);
thread_start(thr, th);
}
if (!event_isset(&th->done))
continue;
event_reset(&th->done);
th->call = call;
__atomic_fetch_add(&running, 1, __ATOMIC_RELAXED);
event_set(&th->ready);
event_timedwait(&th->done, 45 + (call == 13 ? 3000 : 0) + (call == 14 ? 3000 : 0) + (call == 15 ? 300 : 0));
break;
}
}
for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++)
sleep_ms(1);
}
static void execute_one(void);
#define WAIT_FLAGS 0
static void loop(void)
{
int iter;
for (iter = 0;; iter++) {
char cwdbuf[32];
sprintf(cwdbuf, "./%d", iter);
if (mkdir(cwdbuf, 0777))
exit(1);
int pid = fork();
if (pid < 0)
exit(1);
if (pid == 0) {
if (chdir(cwdbuf))
exit(1);
execute_one();
exit(0);
}
int status = 0;
uint64_t start = current_time_ms();
for (;;) {
if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
break;
sleep_ms(1);
if (current_time_ms() - start < 5 * 1000)
continue;
kill_and_wait(pid, &status);
break;
}
remove_dir(cwdbuf);
}
}
#ifndef SYS_dup2
#define SYS_dup2 90
#endif
#ifndef SYS_getgid
#define SYS_getgid 47
#endif
#ifndef SYS_getgroups
#define SYS_getgroups 79
#endif
#ifndef SYS_getsockopt
#define SYS_getsockopt 118
#endif
#ifndef SYS_mmap
#define SYS_mmap 197
#endif
#ifndef SYS_semctl
#define SYS_semctl 442
#endif
#ifndef SYS_semget
#define SYS_semget 221
#endif
#ifndef SYS_seteuid
#define SYS_seteuid 183
#endif
#ifndef SYS_setregid
#define SYS_setregid 127
#endif
#ifndef SYS_stat
#define SYS_stat 439
#endif
#ifndef SYS_writev
#define SYS_writev 121
#endif
uint64_t r[7] = {0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff};
void execute_call(int call)
{
intptr_t res = 0;
switch (call) {
case 0:
res = syscall(SYS_dup2, -1, 0xffffff9c);
if (res != -1)
r[0] = res;
break;
case 1:
*(uint64_t*)0x200002c0 = 0x20000000;
memcpy((void*)0x20000000, "\x25\xc5\xf6\x76\x86\x92\xf1\x6a\x6b\x02\x33\x7b\xc5\xf2\x4e\x95\xc2\xe5\x74\xf7\xbd\x23\xda\x78\xff\x22\x41\x43\x9c\xac\xed\x12\x2e\x33\xab\x16\xd3\x77\x84\x34\x15\x78\x1f\xa5\x08\xcd\x63\x5f\x2f\xd0\x41\x13\x20\x4e\xd9\xbd\xa7\x39\x6e\x99\xa3\x8a\x2f\x10\xe9\xc7\x39\x8b\x5a\x64\xc4\x9d\x98\x66\x4b\xd1\x49\x75\xbe\x70\x76\xa8\x36\x38\xa7\xda\x30\x95\xf0\xe0\x27\xbd\x16\x1c\xcd\x5c\x99\x4f\x8b\x31\xd5\x35\xa3\xce\x4c\x57\x81\x2d\x96\x82\xf3\xeb\xb1\x0e\x05\xa7\x14\x22\x10\x51\x5b\x66\x8d\x13\x57\xd9\x1a\xaa\xbb\x6a\xd8\x8a\xed\x6b\x9f\x21\x43\xd0\x62\xe0\xb5", 141);
*(uint64_t*)0x200002c8 = 0x8d;
*(uint64_t*)0x200002d0 = 0x200000c0;
memcpy((void*)0x200000c0, "\xe8\x98\x7e\x8f\x86\x4e\x9d\x38\xb5\x56\x15\xb6\x59\xd1\x4c\xae\x9e\x91\xa9\x53\x22\x13\xff\xb4\x65\xb6\x1b", 27);
*(uint64_t*)0x200002d8 = 0x1b;
*(uint64_t*)0x200002e0 = 0x20000100;
memcpy((void*)0x20000100, "\x3f\x97\x99\x2c\x94\x0f\xba\x89\x36\xa6\xb4", 11);
*(uint64_t*)0x200002e8 = 0xb;
*(uint64_t*)0x200002f0 = 0x20000140;
memcpy((void*)0x20000140, "\xc9\x9a\xb6\x04\xeb\x2e\x44\xeb\xf7\xbf\xb7\xb0\x4c\x08\x43\x21\xa3\x0f\x43\x51\xae\xb0\x67\x6b\xb2\x1a\xef\xc3\xbc\x23\x22\xd9\x9a\x5b\x03\x4f\x88\x0a\xa2\x5d\x61\xae\x40\x76\x39\x7c\x30\x35\x7b\x22\xcc\xb7\x79\xeb\xd3\x20\x6a\xc6\x48\xfa\xb9\x08\x36\xdd\x4d\x9e\x73\xdc\x3c\x07\x72\x70\xb5\x7d\xc3\x22\x22\x84\xdd\x3c\xae\x47\x37\x95\x7d\x94\x7d\x76\x5a\x5e\x0e\x91\x9c\xbd\x3e\xf2\xd3\xd9\x52\x2a\x82\x7f\x3f\xe6\x0d\xdc", 106);
*(uint64_t*)0x200002f8 = 0x6a;
*(uint64_t*)0x20000300 = 0x200001c0;
memcpy((void*)0x200001c0, "\x2b\xc5\xa9\xfd\x6c\xc3\x45\x00\x82\x40\x5a\xb6\x07\xa0\xf5\x62\x7b\x40\x58\x9a\x69\x0a\xc5\x91\x58\xac\xf1\x0f\x2a\x1c\xc4\x61\x52\xfa\x5f\x49\x3a\x85\x99\xcc\x6e\xaa\xb5\xd9\x69\x68\xbe\xf1\xa2\x7f\x62\xda\xcf\x64\xd0\x6c\x80\xcf\xb5\xb3\x20\xb9\x77\xc9\x43\x2c\x44\x6f\xa6\xf6\x55\x14\x44\xee\x4c\x59\x98\x85\x32\x60\xd6\x5d\x2c\xb3\xc7\x78\xf4\x4f\xe2\x70\x36\x3b\x4e\xb3\x09\xe2\x4f\xc4\x77\x97\xb5\xbd\x45\x4b\xf4\xd3\xd4\x65\x6f\xa0\x78\xff\x56\xb3\x0f\x4f\x0e\x9d\x5e\x6e\x89\x43\x83\x0a\xd6\xd3\x42\x96\x8c\x22\x4f\x7c\x35\xaf\x01\xa6\x1d\x10\xe1\x55\xfe\xe7\xe0\x22\x7c\xd7\x9a\x79\x77\xb3\xf4\x03\x51\xca\x01\x83\x48\x40\xab\xba\x55\x7d\x36\xbc\x8a\x42\x08\xf9\x0d\xc5\xf5\x1e\x3f\x3d\x44\x5c\x5f\xee\xa7\x93\x68\x16\x4e\xde\xf0\x5d\x24\x74\x8c\xe9\xf0\xa5\x84\x51\xb4\x3d\x98\x91\x90\x2b\xc4\x5e\xc6\x7d\x00\xdf\x1d\xeb\x74\xe6\x5b\x29\xc0\xd0\x95\xdb\xdd\x5b\x9a\x7c", 220);
*(uint64_t*)0x20000308 = 0xdc;
syscall(SYS_writev, r[0], 0x200002c0ul, 5ul);
break;
case 2:
*(uint32_t*)0x20000340 = 0;
*(uint32_t*)0x20000344 = -1;
*(uint32_t*)0x20000348 = 0;
res = syscall(SYS_getgroups, 3ul, 0x20000340ul);
if (res != -1)
r[1] = *(uint32_t*)0x20000348;
break;
case 3:
*(uint32_t*)0x200003c0 = 0xc;
res = syscall(SYS_getsockopt, -1, 0xffff, 0x11, 0x20000380ul, 0x200003c0ul);
if (res != -1)
r[2] = *(uint32_t*)0x20000388;
break;
case 4:
syscall(SYS_setregid, r[1], r[2]);
break;
case 5:
res = syscall(SYS_semget, 0x798e2634ul, 0ul, 0xb2603d964b180ce8ul);
if (res != -1)
r[3] = res;
break;
case 6:
memcpy((void*)0x20000400, "./file0\000", 8);
res = syscall(SYS_stat, 0x20000400ul, 0x20000440ul);
if (res != -1)
r[4] = *(uint32_t*)0x2000045c;
break;
case 7:
res = syscall(SYS_getgid);
if (res != -1)
r[5] = res;
break;
case 8:
*(uint32_t*)0x20000500 = 0xfffff834;
*(uint32_t*)0x20000504 = r[4];
*(uint32_t*)0x20000508 = r[5];
*(uint32_t*)0x2000050c = -1;
*(uint32_t*)0x20000510 = 0;
*(uint32_t*)0x20000514 = 3;
*(uint16_t*)0x20000518 = 9;
*(uint16_t*)0x2000051a = 0;
*(uint64_t*)0x20000520 = 0;
*(uint64_t*)0x20000528 = 0;
*(uint64_t*)0x20000530 = 0xfffffffffffffffd;
*(uint64_t*)0x20000538 = 0x4535;
*(uint64_t*)0x20000540 = 2;
*(uint64_t*)0x20000548 = 0;
*(uint64_t*)0x20000550 = 0;
syscall(SYS_semctl, r[3], 0ul, 1ul, 0x20000500ul);
break;
case 9:
syscall(SYS_seteuid, 0);
break;
case 10:
memcpy((void*)0x20000000, "\xbf\x5b\xc2\xc4\xdd\xcd\x9b\xaa\x7f\x7c\x66\xf9\x17\x26\xa8\xc4\x90\xf6\x91\x85\x14\x0b\x5b\x42\x51\xe8\x67\x01\xc6\xc5\xa6\x0d\x84\x80\x2d\x38\x2a\x0c\x38\xdf\x4a\x28\xfd\x84\x0d\x7e\x14\x06\xa5\xc2\xeb\x5d\x3b\x6b\xc3\x23\xbd\x49\x38\x6c\x4a\x92\x49\x50\x31\x4f\xe6\x17\xf8\xcd\x34\x37\xa4\xaa\x6d\x1c\x6d\x62\x64\x03\x09\xf9\xde\x23\x93\x99\x9b\x11\x47\x68\xd5\x10\xd7\x34\xfd\x72\xd1\x98\xb2\x61\xbd\x61\x81\x14\xbf\x3f\xa3\xe2\xfe\x84\xff\xe6\x5c\x80\xe4\x72\x12\xc4\x9e\x47\xbb\x3a\xaa\x86\x89\x46\x2f\x21\xd5\x18\x80\xd9\x7c\xb4\x45\xd3", 136);
break;
case 11:
memcpy((void*)0x200000c0, "\xc4\xa1\x84\x58\x2c\xaa\x26\x44\x0f\xae\x04\xc4\x41\x0f\x74\xab\x00\x00\x01\x00\xc4\x23\xf5\x78\x4c\xe9\x9d\x40\x44\xdf\x34\x59\x26\x41\x0f\xae\x41\x01\x64\x64\x66\x44\x0f\xe5\xb9\x4e\x9a\xb0\xc4\xc4\x22\x7d\x47\x0f\x41\x0f\x45\x7f\x56\x66\x0f\xdd\xe8", 63);
syz_execute_func(0x200000c0);
break;
case 12:
break;
case 13:
memcpy((void*)0x20000140, "\x64\xd3\x2f\x16\xeb\xd8\x17\xd0\x04\xdc\xb8\x01\x71\x82\x05\xbc\xa1\xd8\x6d\xad\x3c\xb1\x32\xa2\x86\x60\x92\x14\xb7\x39\x5a\x97\xa0\xe8\xfe\xda\x5f\xad\x02\xcc\xe9\xde\xea\x94\xd5\x5a\x75\x0c\x17\xb2\x34\x07\x50\x02\xb9\xdf\x62\x9f\xa6\x8e\x3f\x7d\xa9\x7e\x9c\x2a\x2e\x0a\x95\xd1\x5d\x35\x95\x61\xb1\x47\x74\x40\x34\x2c\xd7\x9c\x7c\xeb\xd6\xbf\x00\x8a\xcd\x1c\x7f\xf1\x46\xa6\xfe\x22\x01\x36\x61\xd8\xc8\xce\x8e\xb1\x7f\x5c\xf3\x89\x2a\xe0\x8b\xba\x46\x54\x5b\x2b\x69\x0a\xb7\xe0\x36\x8a\xec\x4d\x32\xb7\x6d\x7f\xc1\x5d\xd7\xc2\xab\xa1\x84\xd4\x1a\x5e\x5a\xbb\x8d\x71\x6f\x5e\x64\x5e\x17\x67\x13\x8e\xd7\x38\xf3\x15\x79\x5a\xc9\x9e\x22\xfd\x44\xdb\x06\x09\x63\x13\xf4\x72\x9c\xe0\xd3\xbd\x93\x8f\x5b\x65\x20\xef\x93\x76\xfa\x90\x9d\xf6\xb2\x05\xc2\xd3\xf5\x2e\xe4\x3e\x3f\x59\xea\x44\x1b\x7c\x4e\x4d\x5c", 201);
memcpy((void*)0x20000240, "\xc1\xb0\x1d\x40\x73\x99\x35\xb1\x21\x7d\x0e\x39\x3c\xdd\x4f\xa4\xef\x8b\xbd\x99\x57\xee\x99\x68\x77\xe4\xca\x15\x5c\x19\x5d\xc1\x66\xf9\x48\x6a\xc4\xdb\x17\xf7\x54\xc4\x89\x38\xa4\x34\x19\xf0\x82\xa8\xc3\x0e\xff\xbe\xf0\x64\xf6\xc8\xb8\x7b\xc9\x30\xe4\x39\xc7\x19\xec\x0a\x11\x99\x04\x0b\x86\x28\x6d\x27\x1f\x25\xaf\x26\xeb\xed\x3f\x55\xc3\x2e\x68\xac\x70\x33\x0d\xf7\x69\x31\xbf\x55\xfa\xe8\x80\x25\x6b\x74\xa9\x23\xf8\xa3\x02\x2c\x31\x0f\x94\xcc\x0c\x62\x33\x02\xa5\xd1\x4b\x3f\x8e\x18\xf4\x15\x99\x88\x28\x66\xea\x02\x42\x86\x4b\x37\xd5\xae\x87\xfb\xcb\x74\x5c\x3e\x26\x42\x3d\x05\xc5\x48\x38\x33\xdf\xcd\xd4\x3d\xc0\xc6\x50\x73\x29\x03\x72\x73\xde\x28\x2e\x3a\x16\xac\x00\xc5\x53\x9c\x30\x94\x63\x98\x4b\x15\x3e\xc6\x25\x0a\x78\x19\x75\xa2\x77\x01\x72\x80\xdb\x1e\x9c\x18\xce\x66\x4d\xf5\x94\x7c\x6c\x18\xbe\xf2\x36\x7e\x61\x63\xb4\x6b\x95\x03\xf7\x00\x70\x5f\xd0\xe8\x9e\xae\x6d\xf0\x88\x4b\xf2\x7c\x00\xe0\x5f\xc5\xef\xc6\x49\x07", 234);
syz_usb_connect(0, 0xc9, 0x20000140, 0x20000240);
break;
case 14:
memcpy((void*)0x20000340, "\x36\x4f\xb1\xa4\x17\x26\x3d\xe2\x27\x97\xec\x76\x08\x61\xf3\x85\x2c\xf2\x4f\x79\xe2\xb7\xa5\xc6\x2a\xfa\xd7\xd6\xd4\xd0\x9d\x86\x2f\x8e\xcc\xd0\x2e\x1b\xb9\x89\xe0\xf8\xa8\xad\x91\x54\x42\x01\x64\x04\xc9\x82\x6a\x5c\x0a\x28\x4f\xc7\xa8\x40\x30\x47\x59\xb6\x84\xf3\x57\xb2\xe6\xfe\xcf\xb3\xcc\x81\x57\xc0\x08\xff\x0d\xcf\xf2\x10\x89\x84\x54\x8a\x2a\xd6\x95\xfa\xd9\x51\x2f\x06\xfd\x12\xd6\x6b\xc4\x43\x04\x75\x12\xab\x4e\xf3\x05\x8a\xe6\xc0\xc6\xec\x3f\xd6\x27\xe3\x70\xa1\x51\xae\x71\x9b\x8e\x3a\x77\xd6\x82\xdc\x06\xa9\x3b\xe9\xc2\xaa\x80\x18\xb5\x8a\x94\x92\xcb\x39\x03\x1b\xb5\xab\xf3\x12\x4e\xaa\xb8\x53\x30\xf1\x81\xfc\xcc\xa7\x59\x7b\x4e\xc0\x87\x9f\xcb\xcf\x51\x14\x3f\x98\xc4\x43\xc1\x67\x20\xa6\xe0\x1b\x7e\x07\xdf\x47\x27\xe2\x88\xe1\x3d\xcc\x0b\x7e\x11", 191);
memcpy((void*)0x20000400, "\x59\x03\x92\x3c\x7a\x1b\x28\x38\xf3\xc1\x21\x56\x78\x5a\x11\xc8\x1b\x2e\x82\xd9\xa1\x19\x0e\x1b\x9c\x45\x97\x6a\x91\x7c\x00\x29\x4d\xc9\x4d\x53\x54\xe8\xc5\xd6\xa4\xe8\x98\x6d\xa0\x74\xeb\x46\x1e\xd0\x73\x6b\xcb\xed\xe2\xce\xf1\xf1\x9e\x02\x16\xc0\x9e\xb7\x94\xd8\xb9\x75\x4f\xea\x26\xf1\x10\xc8\x32\x48\xc2\x86\xea\xa0\x5a\x69\x84\x4e\xb1\x29\x2f\x59\x4f\x59\xf6\xc9\xbe\xca\x47\xd8\x94\xd4\x4d\xfd\x15\xff\x81\xb7\x6b\x46\x35\x39\x2e\xb5\xed\x43\x1c\xa3\x09\x22\x30", 117);
res = syz_usb_connect(4, 0xbf, 0x20000340, 0x20000400);
if (res != -1)
r[6] = res;
break;
case 15:
syz_usb_disconnect(r[6]);
break;
}
}
int main(void)
{
syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 3ul, 0x1012ul, -1, 0ul, 0ul);
use_temporary_dir();
do_sandbox_none();
return 0;
}
<stdin>:187:2: error: unknown type name 'uint8_t_t'
<stdin>:188:2: error: unknown type name 'uint8_t_t'
<stdin>:189:2: error: unknown type name 'uint8_t_t'
<stdin>:190:2: error: unknown type name 'uint8_t_t'
<stdin>:191:2: error: unknown type name 'uint16_t_t'
<stdin>:192:2: error: unknown type name 'uint8_t_t'
<stdin>:193:2: error: unknown type name 'uint8_t_t'
<stdin>:194:2: error: unknown type name 'uint8_t_t'
<stdin>:198:2: error: unknown type name 'uint8_t_t'
<stdin>:199:2: error: unknown type name 'uint8_t_t'
<stdin>:200:2: error: unknown type name 'uint16_t_t'
<stdin>:201:2: error: unknown type name 'uint8_t_t'
<stdin>:202:2: error: unknown type name 'uint8_t_t'
<stdin>:203:2: error: unknown type name 'uint8_t_t'
<stdin>:204:2: error: unknown type name 'uint8_t_t'
<stdin>:205:2: error: unknown type name 'uint16_t_t'
<stdin>:206:2: error: unknown type name 'uint16_t_t'
<stdin>:207:2: error: unknown type name 'uint16_t_t'
<stdin>:208:2: error: unknown type name 'uint8_t_t'
<stdin>:209:2: error: unknown type name 'uint8_t_t'
<stdin>:210:2: error: unknown type name 'uint8_t_t'
<stdin>:211:2: error: unknown type name 'uint8_t_t'
<stdin>:215:2: error: unknown type name 'uint8_t_t'
<stdin>:216:2: error: unknown type name 'uint8_t_t'
<stdin>:217:2: error: unknown type name 'uint16_t_t'
<stdin>:218:2: error: unknown type name 'uint8_t_t'
<stdin>:219:2: error: unknown type name 'uint8_t_t'
<stdin>:220:2: error: unknown type name 'uint8_t_t'
<stdin>:221:2: error: unknown type name 'uint8_t_t'
<stdin>:222:2: error: unknown type name 'uint8_t_t'
<stdin>:226:2: error: unknown type name 'uint8_t_t'
<stdin>:227:2: error: unknown type name 'uint8_t_t'
<stdin>:228:2: error: unknown type name 'uint8_t_t'
<stdin>:229:2: error: unknown type name 'uint8_t_t'
<stdin>:230:2: error: unknown type name 'uint8_t_t'
<stdin>:231:2: error: unknown type name 'uint8_t_t'
<stdin>:232:2: error: unknown type name 'uint8_t_t'
<stdin>:233:2: error: unknown type name 'uint8_t_t'
<stdin>:234:2: error: unknown type name 'uint8_t_t'
<stdin>:238:2: error: unknown type name 'uint8_t_t'
<stdin>:239:2: error: unknown type name 'uint8_t_t'
<stdin>:240:2: error: unknown type name 'uint16_t_t'
<stdin>:241:2: error: unknown type name 'uint16_t_t'
<stdin>:242:2: error: unknown type name 'uint16_t_t'
<stdin>:246:2: error: unknown type name 'uint8_t_t'
<stdin>:247:2: error: unknown type name 'uint8_t_t'
<stdin>:248:2: error: unknown type name 'uint16_t_t'
<stdin>:249:2: error: unknown type name 'uint8_t_t'
<stdin>:250:2: error: unknown type name 'uint8_t_t'
<stdin>:251:2: error: unknown type name 'uint8_t_t'
<stdin>:252:2: error: unknown type name 'uint8_t_t'
<stdin>:253:2: error: unknown type name 'uint8_t_t'
<stdin>:254:2: error: unknown type name 'uint8_t_t'
<stdin>: In function 'vhci_usb_recv':
<stdin>:561:2: error: unknown type name 'uint8_t_t'; did you mean 'uint8_t'?
<stdin>:561:20: error: 'uint8_t_t' undeclared (first use in this function); did you mean 'uint8_t'?
<stdin>:561:20: note: each undeclared identifier is reported only once for each function it appears in
<stdin>:561:30: error: expected expression before ')' token
<stdin>: In function 'vhci_usb_send':
<stdin>:576:2: error: unknown type name 'uint8_t_t'; did you mean 'uint8_t'?
<stdin>:576:20: error: 'uint8_t_t' undeclared (first use in this function); did you mean 'uint8_t'?
<stdin>:576:30: error: expected expression before ')' token
<stdin>: In function 'syz_usb_connect_impl':
<stdin>:637:63: error: unknown type name 'usb_ctrlrequest'
<stdin>:642:55: error: unknown type name 'usb_ctrlrequest'
<stdin>:654:8: error: 'uint32_t_t' undeclared (first use in this function); did you mean 'uint32_t'?
At top level:
<stdin>:702:13: error: 'setup_usb' defined but not used [-Werror=unused-function]
cc1: all warnings being treated as errors
compiler invocation: /syzkaller/netbsd/src/../tools/bin/x86_64--netbsd-g++ [-o /tmp/syz-executor766295902 -DGOOS_netbsd=1 -DGOARCH_amd64=1 -DHOSTGOOS_linux=1 -x c - -m64 --sysroot /syzkaller/netbsd/src/../dest/ -O2 -pthread -Wall -Werror -Wparentheses -Wframe-larger-than=16384]
--- FAIL: TestGenerate/netbsd/amd64/11 (0.49s)
csource_test.go:123: opts: {Threaded:true Collide:false Repeat:true RepeatTimes:0 Procs:0 Sandbox:none Fault:false FaultCall:0 FaultNth:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false USB:false UseTmpDir:true HandleSegv:true Repro:false Trace:false}
program:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
writev(r0, &(0x7f00000002c0)=[{&(0x7f0000000000)="25c5f6768692f16a6b02337bc5f24e95c2e574f7bd23da78ff2241439caced122e33ab16d377843415781fa508cd635f2fd04113204ed9bda7396e99a38a2f10e9c7398b5a64c49d98664bd14975be7076a83638a7da3095f0e027bd161ccd5c994f8b31d535a3ce4c57812d9682f3ebb10e05a7142210515b668d1357d91aaabb6ad88aed6b9f2143d062e0b5", 0x8d}, {&(0x7f00000000c0)="e8987e8f864e9d38b55615b659d14cae9e91a9532213ffb465b61b", 0x1b}, {&(0x7f0000000100)="3f97992c940fba8936a6b4", 0xb}, {&(0x7f0000000140)="c99ab604eb2e44ebf7bfb7b04c084321a30f4351aeb0676bb21aefc3bc2322d99a5b034f880aa25d61ae4076397c30357b22ccb779ebd3206ac648fab90836dd4d9e73dc3c077270b57dc3222284dd3cae4737957d947d765a5e0e919cbd3ef2d3d9522a827f3fe60ddc", 0x6a}, {&(0x7f00000001c0)="2bc5a9fd6cc3450082405ab607a0f5627b40589a690ac59158acf10f2a1cc46152fa5f493a8599cc6eaab5d96968bef1a27f62dacf64d06c80cfb5b320b977c9432c446fa6f6551444ee4c5998853260d65d2cb3c778f44fe270363b4eb309e24fc47797b5bd454bf4d3d4656fa078ff56b30f4f0e9d5e6e8943830ad6d342968c224f7c35af01a61d10e155fee7e0227cd79a7977b3f40351ca01834840abba557d36bc8a4208f90dc5f51e3f3d445c5feea79368164edef05d24748ce9f0a58451b43d9891902bc45ec67d00df1deb74e65b29c0d095dbdd5b9a7c", 0xdc}], 0x5)
getgroups(0x3, &(0x7f0000000340)=[0x0, 0xffffffffffffffff, <r1=>0x0])
getsockopt$sock_cred(0xffffffffffffffff, 0xffff, 0x11, &(0x7f0000000380)={0x0, 0x0, <r2=>0x0}, &(0x7f00000003c0)=0xc)
setregid(r1, r2)
r3 = semget(0x1, 0x0, 0xb2603d964b180ce8)
stat(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, <r4=>0x0})
r5 = getgid()
semctl$IPC_SET(r3, 0x0, 0x1, &(0x7f0000000500)={{0xfffff834, r4, r5, 0xffffffffffffffff, 0x0, 0x3, 0x9}, 0xfffffffffffffffd, 0x4535, 0x2})
seteuid(0x0)
syz_emit_ethernet(0x88, &(0x7f0000000000)="bf5bc2c4ddcd9baa7f7c66f91726a8c490f69185140b5b4251e86701c6c5a60d84802d382a0c38df4a28fd840d7e1406a5c2eb5d3b6bc323bd49386c4a924950314fe617f8cd3437a4aa6d1c6d62640309f9de2393999b114768d510d734fd72d198b261bd618114bf3fa3e2fe84ffe65c80e47212c49e47bb3aaa8689462f21d51880d97cb445d3")
syz_execute_func(&(0x7f00000000c0)="c4a184582caa26440fae04c4410f74ab00000100c423f5784ce99d4044df345926410fae4101646466440fe5b94e9ab0c4c4227d470f410f457f56660fdde8")
syz_extract_tcp_res(&(0x7f0000000100), 0x6, 0x1)
syz_usb_connect(0x0, 0xc9, &(0x7f0000000140)="64d32f16ebd817d004dcb801718205bca1d86dad3cb132a286609214b7395a97a0e8feda5fad02cce9deea94d55a750c17b234075002b9df629fa68e3f7da97e9c2a2e0a95d15d359561b1477440342cd79c7cebd6bf008acd1c7ff146a6fe22013661d8c8ce8eb17f5cf3892ae08bba46545b2b690ab7e0368aec4d32b76d7fc15dd7c2aba184d41a5e5abb8d716f5e645e1767138ed738f315795ac99e22fd44db06096313f4729ce0d3bd938f5b6520ef9376fa909df6b205c2d3f52ee43e3f59ea441b7c4e4d5c", &(0x7f0000000240)="c1b01d40739935b1217d0e393cdd4fa4ef8bbd9957ee996877e4ca155c195dc166f9486ac4db17f754c48938a43419f082a8c30effbef064f6c8b87bc930e439c719ec0a1199040b86286d271f25af26ebed3f55c32e68ac70330df76931bf55fae880256b74a923f8a3022c310f94cc0c623302a5d14b3f8e18f41599882866ea0242864b37d5ae87fbcb745c3e26423d05c5483833dfcdd43dc0c6507329037273de282e3a16ac00c5539c309463984b153ec6250a781975a277017280db1e9c18ce664df5947c6c18bef2367e6163b46b9503f700705fd0e89eae6df0884bf27c00e05fc5efc64907")
r6 = syz_usb_connect(0x4, 0xbf, &(0x7f0000000340)="364fb1a417263de22797ec760861f3852cf24f79e2b7a5c62afad7d6d4d09d862f8eccd02e1bb989e0f8a8ad915442016404c9826a5c0a284fc7a840304759b684f357b2e6fecfb3cc8157c008ff0dcff2108984548a2ad695fad9512f06fd12d66bc443047512ab4ef3058ae6c0c6ec3fd627e370a151ae719b8e3a77d682dc06a93be9c2aa8018b58a9492cb39031bb5abf3124eaab85330f181fccca7597b4ec0879fcbcf51143f98c443c16720a6e01b7e07df4727e288e13dcc0b7e11", &(0x7f0000000400)="5903923c7a1b2838f3c12156785a11c81b2e82d9a1190e1b9c45976a917c00294dc94d5354e8c5d6a4e8986da074eb461ed0736bcbede2cef1f19e0216c09eb794d8b9754fea26f110c83248c286eaa05a69844eb1292f594f59f6c9beca47d894d44dfd15ff81b76b4635392eb5ed431ca3092230")
syz_usb_disconnect(r6)
csource_test.go:124: failed to build program:
// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <dev/usb/usb.h>
#include <dev/usb/usbhid.h>
#include <dev/usb/vhci.h>
#include <dirent.h>
#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <pthread.h>
#include <pwd.h>
#include <setjmp.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ioctl.h>
#include <sys/resource.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>
static unsigned long long procid;
static __thread int skip_segv;
static __thread jmp_buf segv_env;
static void segv_handler(int sig, siginfo_t* info, void* ctx)
{
uintptr_t addr = (uintptr_t)info->si_addr;
const uintptr_t prog_start = 1 << 20;
const uintptr_t prog_end = 100 << 20;
if (__atomic_load_n(&skip_segv, __ATOMIC_RELAXED) && (addr < prog_start || addr > prog_end)) {
_longjmp(segv_env, 1);
}
exit(sig);
}
static void install_segv_handler(void)
{
struct sigaction sa;
memset(&sa, 0, sizeof(sa));
sa.sa_sigaction = segv_handler;
sa.sa_flags = SA_NODEFER | SA_SIGINFO;
sigaction(SIGSEGV, &sa, NULL);
sigaction(SIGBUS, &sa, NULL);
}
#define NONFAILING(...) { __atomic_fetch_add(&skip_segv, 1, __ATOMIC_SEQ_CST); if (_setjmp(segv_env) == 0) { __VA_ARGS__; } __atomic_fetch_sub(&skip_segv, 1, __ATOMIC_SEQ_CST); }
static void kill_and_wait(int pid, int* status)
{
kill(pid, SIGKILL);
while (waitpid(-1, status, 0) != pid) {
}
}
static void sleep_ms(uint64_t ms)
{
usleep(ms * 1000);
}
static uint64_t current_time_ms(void)
{
struct timespec ts;
if (clock_gettime(CLOCK_MONOTONIC, &ts))
exit(1);
return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}
static void use_temporary_dir(void)
{
char tmpdir_template[] = "./syzkaller.XXXXXX";
char* tmpdir = mkdtemp(tmpdir_template);
if (!tmpdir)
exit(1);
if (chmod(tmpdir, 0777))
exit(1);
if (chdir(tmpdir))
exit(1);
}
static void remove_dir(const char* dir)
{
DIR* dp;
struct dirent* ep;
dp = opendir(dir);
if (dp == NULL)
exit(1);
while ((ep = readdir(dp))) {
if (strcmp(ep->d_name, ".") == 0 || strcmp(ep->d_name, "..") == 0)
continue;
char filename[FILENAME_MAX];
snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name);
struct stat st;
if (lstat(filename, &st))
exit(1);
if (S_ISDIR(st.st_mode)) {
remove_dir(filename);
continue;
}
if (unlink(filename))
exit(1);
}
closedir(dp);
if (rmdir(dir))
exit(1);
}
static void thread_start(void* (*fn)(void*), void* arg)
{
pthread_t th;
pthread_attr_t attr;
pthread_attr_init(&attr);
pthread_attr_setstacksize(&attr, 128 << 10);
int i;
for (i = 0; i < 100; i++) {
if (pthread_create(&th, &attr, fn, arg) == 0) {
pthread_attr_destroy(&attr);
return;
}
if (errno == EAGAIN) {
usleep(50);
continue;
}
break;
}
exit(1);
}
typedef struct {
pthread_mutex_t mu;
pthread_cond_t cv;
int state;
} event_t;
static void event_init(event_t* ev)
{
if (pthread_mutex_init(&ev->mu, 0))
exit(1);
if (pthread_cond_init(&ev->cv, 0))
exit(1);
ev->state = 0;
}
static void event_reset(event_t* ev)
{
ev->state = 0;
}
static void event_set(event_t* ev)
{
pthread_mutex_lock(&ev->mu);
if (ev->state)
exit(1);
ev->state = 1;
pthread_mutex_unlock(&ev->mu);
pthread_cond_broadcast(&ev->cv);
}
static void event_wait(event_t* ev)
{
pthread_mutex_lock(&ev->mu);
while (!ev->state)
pthread_cond_wait(&ev->cv, &ev->mu);
pthread_mutex_unlock(&ev->mu);
}
static int event_isset(event_t* ev)
{
pthread_mutex_lock(&ev->mu);
int res = ev->state;
pthread_mutex_unlock(&ev->mu);
return res;
}
static int event_timedwait(event_t* ev, uint64_t timeout)
{
uint64_t start = current_time_ms();
uint64_t now = start;
pthread_mutex_lock(&ev->mu);
for (;;) {
if (ev->state)
break;
uint64_t remain = timeout - (now - start);
struct timespec ts;
ts.tv_sec = remain / 1000;
ts.tv_nsec = (remain % 1000) * 1000 * 1000;
pthread_cond_timedwait(&ev->cv, &ev->mu, &ts);
now = current_time_ms();
if (now - start > timeout)
break;
}
int res = ev->state;
pthread_mutex_unlock(&ev->mu);
return res;
}
/* -------------------------------------------------------------------------- */
/*
* Redefinitions to match the linux types used in common_usb.h.
*/
struct usb_endpoint_descriptor {
uint8_t_t bLength;
uint8_t_t bDescriptorType;
uint8_t_t bEndpointAddress;
uint8_t_t bmAttributes;
uint16_t_t wMaxPacketSize;
uint8_t_t bInterval;
uint8_t_t bRefresh;
uint8_t_t bSynchAddress;
} __attribute__((packed));
struct usb_device_descriptor {
uint8_t_t bLength;
uint8_t_t bDescriptorType;
uint16_t_t bcdUSB;
uint8_t_t bDeviceClass;
uint8_t_t bDeviceSubClass;
uint8_t_t bDeviceProtocol;
uint8_t_t bMaxPacketSize0;
uint16_t_t idVendor;
uint16_t_t idProduct;
uint16_t_t bcdDevice;
uint8_t_t iManufacturer;
uint8_t_t iProduct;
uint8_t_t iSerialNumber;
uint8_t_t bNumConfigurations;
} __attribute__((packed));
struct usb_config_descriptor {
uint8_t_t bLength;
uint8_t_t bDescriptorType;
uint16_t_t wTotalLength;
uint8_t_t bNumInterfaces;
uint8_t_t bConfigurationValue;
uint8_t_t iConfiguration;
uint8_t_t bmAttributes;
uint8_t_t bMaxPower;
} __attribute__((packed));
struct usb_interface_descriptor {
uint8_t_t bLength;
uint8_t_t bDescriptorType;
uint8_t_t bInterfaceNumber;
uint8_t_t bAlternateSetting;
uint8_t_t bNumEndpoints;
uint8_t_t bInterfaceClass;
uint8_t_t bInterfaceSubClass;
uint8_t_t bInterfaceProtocol;
uint8_t_t iInterface;
} __attribute__((packed));
struct usb_ctrlrequest {
uint8_t_t bRequestType;
uint8_t_t bRequest;
uint16_t_t wValue;
uint16_t_t wIndex;
uint16_t_t wLength;
} __attribute__((packed));
struct usb_qualifier_descriptor {
uint8_t_t bLength;
uint8_t_t bDescriptorType;
uint16_t_t bcdUSB;
uint8_t_t bDeviceClass;
uint8_t_t bDeviceSubClass;
uint8_t_t bDeviceProtocol;
uint8_t_t bMaxPacketSize0;
uint8_t_t bNumConfigurations;
uint8_t_t bRESERVED;
} __attribute__((packed));
#define USB_TYPE_MASK (0x03 << 5)
#define USB_TYPE_STANDARD (0x00 << 5)
#define USB_TYPE_CLASS (0x01 << 5)
#define USB_TYPE_VENDOR (0x02 << 5)
#define USB_TYPE_RESERVED (0x03 << 5)
#define USB_DT_DEVICE 0x01
#define USB_DT_CONFIG 0x02
#define USB_DT_STRING 0x03
#define USB_DT_INTERFACE 0x04
#define USB_DT_ENDPOINT 0x05
#define USB_DT_DEVICE_QUALIFIER 0x06
#define USB_DT_OTHER_SPEED_CONFIG 0x07
#define USB_DT_INTERFACE_POWER 0x08
#define USB_DT_OTG 0x09
#define USB_DT_DEBUG 0x0a
#define USB_DT_INTERFACE_ASSOCIATION 0x0b
#define USB_DT_SECURITY 0x0c
#define USB_DT_KEY 0x0d
#define USB_DT_ENCRYPTION_TYPE 0x0e
#define USB_DT_BOS 0x0f
#define USB_DT_DEVICE_CAPABILITY 0x10
#define USB_DT_WIRELESS_ENDPOINT_COMP 0x11
#define USB_DT_WIRE_ADAPTER 0x21
#define USB_DT_RPIPE 0x22
#define USB_DT_CS_RADIO_CONTROL 0x23
#define USB_DT_PIPE_USAGE 0x24
#define USB_DT_SS_ENDPOINT_COMP 0x30
#define USB_DT_SSP_ISOC_ENDPOINT_COMP 0x31
#define USB_REQ_GET_STATUS 0x00
#define USB_REQ_CLEAR_FEATURE 0x01
#define USB_REQ_SET_FEATURE 0x03
#define USB_REQ_SET_ADDRESS 0x05
#define USB_REQ_GET_DESCRIPTOR 0x06
#define USB_REQ_SET_DESCRIPTOR 0x07
#define USB_REQ_GET_CONFIGURATION 0x08
#define USB_REQ_SET_CONFIGURATION 0x09
#define USB_REQ_GET_INTERFACE 0x0A
#define USB_REQ_SET_INTERFACE 0x0B
#define USB_REQ_SYNCH_FRAME 0x0C
#define USB_REQ_SET_SEL 0x30
#define USB_REQ_SET_ISOCH_DELAY 0x31
#define USB_REQ_SET_ENCRYPTION 0x0D
#define USB_REQ_GET_ENCRYPTION 0x0E
#define USB_REQ_RPIPE_ABORT 0x0E
#define USB_REQ_SET_HANDSHAKE 0x0F
#define USB_REQ_RPIPE_RESET 0x0F
#define USB_REQ_GET_HANDSHAKE 0x10
#define USB_REQ_SET_CONNECTION 0x11
#define USB_REQ_SET_SECURITY_DATA 0x12
#define USB_REQ_GET_SECURITY_DATA 0x13
#define USB_REQ_SET_WUSB_DATA 0x14
#define USB_REQ_LOOPBACK_DATA_WRITE 0x15
#define USB_REQ_LOOPBACK_DATA_READ 0x16
#define USB_REQ_SET_INTERFACE_DS 0x17
#define USB_REQ_GET_PARTNER_PDO 20
#define USB_REQ_GET_BATTERY_STATUS 21
#define USB_REQ_SET_PDO 22
#define USB_REQ_GET_VDM 23
#define USB_REQ_SEND_VDM 24
#define USB_MAX_IFACE_NUM 4
#define USB_MAX_EP_NUM 32
#define USB_MAX_FDS 6
struct usb_endpoint_index {
struct usb_endpoint_descriptor desc;
int handle;
};
struct usb_iface_index {
struct usb_interface_descriptor* iface;
uint8_t bInterfaceNumber;
uint8_t bAlternateSetting;
uint8_t bInterfaceClass;
struct usb_endpoint_index eps[USB_MAX_EP_NUM];
int eps_num;
};
struct usb_device_index {
struct usb_device_descriptor* dev;
struct usb_config_descriptor* config;
uint8_t bDeviceClass;
uint8_t bMaxPower;
int config_length;
struct usb_iface_index ifaces[USB_MAX_IFACE_NUM];
int ifaces_num;
int iface_cur;
};
struct usb_info {
int fd;
struct usb_device_index index;
};
static struct usb_info usb_devices[USB_MAX_FDS];
static int usb_devices_num;
static bool parse_usb_descriptor(const char* buffer, size_t length, struct usb_device_index* index)
{
if (length < sizeof(*index->dev) + sizeof(*index->config))
return false;
memset(index, 0, sizeof(*index));
index->dev = (struct usb_device_descriptor*)buffer;
index->config = (struct usb_config_descriptor*)(buffer + sizeof(*index->dev));
index->bDeviceClass = index->dev->bDeviceClass;
index->bMaxPower = index->config->bMaxPower;
index->config_length = length - sizeof(*index->dev);
index->iface_cur = -1;
size_t offset = 0;
while (true) {
if (offset + 1 >= length)
break;
uint8_t desc_length = buffer[offset];
uint8_t desc_type = buffer[offset + 1];
if (desc_length <= 2)
break;
if (offset + desc_length > length)
break;
if (desc_type == USB_DT_INTERFACE && index->ifaces_num < USB_MAX_IFACE_NUM) {
struct usb_interface_descriptor* iface = (struct usb_interface_descriptor*)(buffer + offset);
index->ifaces[index->ifaces_num].iface = iface;
index->ifaces[index->ifaces_num].bInterfaceNumber = iface->bInterfaceNumber;
index->ifaces[index->ifaces_num].bAlternateSetting = iface->bAlternateSetting;
index->ifaces[index->ifaces_num].bInterfaceClass = iface->bInterfaceClass;
index->ifaces_num++;
}
if (desc_type == USB_DT_ENDPOINT && index->ifaces_num > 0) {
struct usb_iface_index* iface = &index->ifaces[index->ifaces_num - 1];
if (iface->eps_num < USB_MAX_EP_NUM) {
memcpy(&iface->eps[iface->eps_num].desc, buffer + offset, sizeof(iface->eps[iface->eps_num].desc));
iface->eps_num++;
}
}
offset += desc_length;
}
return true;
}
static struct usb_device_index* add_usb_index(int fd, const char* dev, size_t dev_len)
{
int i = __atomic_fetch_add(&usb_devices_num, 1, __ATOMIC_RELAXED);
if (i >= USB_MAX_FDS)
return NULL;
int rv = 0;
NONFAILING(rv = parse_usb_descriptor(dev, dev_len, &usb_devices[i].index));
if (!rv)
return NULL;
__atomic_store_n(&usb_devices[i].fd, fd, __ATOMIC_RELEASE);
return &usb_devices[i].index;
}
static struct usb_device_index* lookup_usb_index(int fd)
{
int i;
for (i = 0; i < USB_MAX_FDS; i++) {
if (__atomic_load_n(&usb_devices[i].fd, __ATOMIC_ACQUIRE) == fd) {
return &usb_devices[i].index;
}
}
return NULL;
}
struct vusb_connect_string_descriptor {
uint32_t len;
char* str;
} __attribute__((packed));
struct vusb_connect_descriptors {
uint32_t qual_len;
char* qual;
uint32_t bos_len;
char* bos;
uint32_t strs_len;
struct vusb_connect_string_descriptor strs[0];
} __attribute__((packed));
static const char default_string[] = {
8, USB_DT_STRING,
's', 0, 'y', 0, 'z', 0
};
static const char default_lang_id[] = {
4, USB_DT_STRING,
0x09, 0x04
};
static bool lookup_connect_response_in(int fd, const struct vusb_connect_descriptors* descs,
const struct usb_ctrlrequest* ctrl,
char** response_data, uint32_t* response_length)
{
struct usb_device_index* index = lookup_usb_index(fd);
uint8_t str_idx;
if (!index)
return false;
switch (ctrl->bRequestType & USB_TYPE_MASK) {
case USB_TYPE_STANDARD:
switch (ctrl->bRequest) {
case USB_REQ_GET_DESCRIPTOR:
switch (ctrl->wValue >> 8) {
case USB_DT_DEVICE:
*response_data = (char*)index->dev;
*response_length = sizeof(*index->dev);
return true;
case USB_DT_CONFIG:
*response_data = (char*)index->config;
*response_length = index->config_length;
return true;
case USB_DT_STRING:
str_idx = (uint8_t)ctrl->wValue;
if (descs && str_idx < descs->strs_len) {
*response_data = descs->strs[str_idx].str;
*response_length = descs->strs[str_idx].len;
return true;
}
if (str_idx == 0) {
*response_data = (char*)&default_lang_id[0];
*response_length = default_lang_id[0];
return true;
}
*response_data = (char*)&default_string[0];
*response_length = default_string[0];
return true;
case USB_DT_BOS:
*response_data = descs->bos;
*response_length = descs->bos_len;
return true;
case USB_DT_DEVICE_QUALIFIER:
if (!descs->qual) {
struct usb_qualifier_descriptor* qual =
(struct usb_qualifier_descriptor*)response_data;
qual->bLength = sizeof(*qual);
qual->bDescriptorType = USB_DT_DEVICE_QUALIFIER;
qual->bcdUSB = index->dev->bcdUSB;
qual->bDeviceClass = index->dev->bDeviceClass;
qual->bDeviceSubClass = index->dev->bDeviceSubClass;
qual->bDeviceProtocol = index->dev->bDeviceProtocol;
qual->bMaxPacketSize0 = index->dev->bMaxPacketSize0;
qual->bNumConfigurations = index->dev->bNumConfigurations;
qual->bRESERVED = 0;
*response_length = sizeof(*qual);
return true;
}
*response_data = descs->qual;
*response_length = descs->qual_len;
return true;
default:
break;
}
break;
default:
break;
}
break;
default:
break;
}
return false;
}
typedef bool (*lookup_connect_out_response_t)(int fd, const struct vusb_connect_descriptors* descs,
const struct usb_ctrlrequest* ctrl, bool* done);
static bool lookup_connect_response_out_generic(int fd, const struct vusb_connect_descriptors* descs,
const struct usb_ctrlrequest* ctrl, bool* done)
{
switch (ctrl->bRequestType & USB_TYPE_MASK) {
case USB_TYPE_STANDARD:
switch (ctrl->bRequest) {
case USB_REQ_SET_CONFIGURATION:
*done = true;
return true;
default:
break;
}
break;
}
return false;
}
/* -------------------------------------------------------------------------- */
static int vhci_open(void)
{
return open("/dev/vhci", O_RDWR);
}
static int vhci_setport(int fd, u_int port)
{
struct vhci_ioc_set_port args;
args.port = port;
return ioctl(fd, VHCI_IOC_SET_PORT, &args);
}
static int vhci_usb_attach(int fd)
{
return ioctl(fd, VHCI_IOC_USB_ATTACH, NULL);
}
static int vhci_usb_recv(int fd, void* buf, size_t size)
{
uint8_t_t* ptr = (uint8_t_t*)buf;
ssize_t done;
while (1) {
done = read(fd, ptr, size);
if (done < 0)
return -1;
if ((size_t)done == size)
return 0;
size -= done;
ptr += done;
}
}
static int vhci_usb_send(int fd, void* buf, size_t size)
{
uint8_t_t* ptr = (uint8_t_t*)buf;
ssize_t done;
while (1) {
done = write(fd, ptr, size);
if (done <= 0)
return -1;
if ((size_t)done == size)
return 0;
size -= done;
ptr += done;
}
}
/* -------------------------------------------------------------------------- */
static volatile long syz_usb_connect_impl(uint64_t speed, uint64_t dev_len,
const char* dev, const struct vusb_connect_descriptors* descs,
lookup_connect_out_response_t lookup_connect_response_out)
{
struct usb_device_index* index;
int portnum, fd, rv;
bool done;
portnum = procid + 1;
if (!dev) {
return -1;
}
if (portnum != 1) {
/* For now, we support only one proc. */
return -1;
}
fd = vhci_open();
if (fd < 0) {
return -1;
}
index = add_usb_index(fd, dev, dev_len);
if (!index) {
goto err;
}
rv = vhci_setport(fd, portnum);
if (rv != 0) {
goto err;
}
rv = vhci_usb_attach(fd);
if (rv != 0) {
goto err;
}
done = false;
while (!done) {
vhci_request_t req;
rv = vhci_usb_recv(fd, &req, sizeof(req));
if (rv != 0) {
goto err;
}
if (req.type != VHCI_REQ_CTRL) {
goto err;
}
char* response_data = NULL;
uint32_t response_length = 0;
char data[4096];
if (req.u.ctrl.bmRequestType & UE_DIR_IN) {
bool response_found = false;
NONFAILING(response_found = lookup_connect_response_in(fd, descs, (const usb_ctrlrequest*)&req.u.ctrl, &response_data, &response_length));
if (!response_found) {
goto err;
}
} else {
if (!lookup_connect_response_out(fd, descs, (const usb_ctrlrequest*)&req.u.ctrl, &done)) {
goto err;
}
response_data = NULL;
response_length = UGETW(req.u.ctrl.wLength);
}
if ((req.u.ctrl.bmRequestType & USB_TYPE_MASK) == USB_TYPE_STANDARD &&
req.u.ctrl.bRequest == USB_REQ_SET_CONFIGURATION) {
/* TODO: possibly revisit */
}
if (response_length > sizeof(data))
response_length = 0;
if ((uint32_t_t)UGETW(req.u.ctrl.wLength) < response_length)
response_length = UGETW(req.u.ctrl.wLength);
if (response_data)
memcpy(data, response_data, response_length);
else
memset(data, 0, response_length);
if (req.u.ctrl.bmRequestType & UE_DIR_IN) {
if (response_length > 0) {
vhci_response_t res;
res.size = response_length;
rv = vhci_usb_send(fd, &res, sizeof(res));
if (rv == 0)
rv = vhci_usb_send(fd, data, response_length);
}
} else {
rv = vhci_usb_recv(fd, data, response_length);
}
if (rv < 0) {
goto err;
}
}
sleep_ms(200);
return fd;
err:
close(fd);
return -1;
}
static volatile long syz_usb_connect(volatile long a0, volatile long a1,
volatile long a2, volatile long a3)
{
uint64_t speed = a0;
uint64_t dev_len = a1;
const char* dev = (const char*)a2;
const struct vusb_connect_descriptors* descs = (const struct vusb_connect_descriptors*)a3;
return syz_usb_connect_impl(speed, dev_len, dev, descs,
&lookup_connect_response_out_generic);
}
static volatile long syz_usb_disconnect(volatile long a0)
{
int fd = a0;
int rv = close(fd);
sleep_ms(200);
return rv;
}
static void setup_usb(void)
{
if (chmod("/dev/vhci", 0666))
exit(1);
}
static void sandbox_common()
{
if (setsid() == -1)
exit(1);
struct rlimit rlim;
rlim.rlim_cur = rlim.rlim_max = 8 << 20;
setrlimit(RLIMIT_MEMLOCK, &rlim);
rlim.rlim_cur = rlim.rlim_max = 1 << 20;
setrlimit(RLIMIT_FSIZE, &rlim);
rlim.rlim_cur = rlim.rlim_max = 1 << 20;
setrlimit(RLIMIT_STACK, &rlim);
rlim.rlim_cur = rlim.rlim_max = 0;
setrlimit(RLIMIT_CORE, &rlim);
rlim.rlim_cur = rlim.rlim_max = 256;
setrlimit(RLIMIT_NOFILE, &rlim);
}
static void loop();
static int do_sandbox_none(void)
{
sandbox_common();
loop();
return 0;
}
static long syz_execute_func(volatile long text)
{
volatile long p[8] = {0};
(void)p;
asm volatile("" ::"r"(0l), "r"(1l), "r"(2l), "r"(3l), "r"(4l), "r"(5l), "r"(6l),
"r"(7l), "r"(8l), "r"(9l), "r"(10l), "r"(11l), "r"(12l), "r"(13l));
NONFAILING(((void (*)(void))(text))());
return 0;
}
struct thread_t {
int created, call;
event_t ready, done;
};
static struct thread_t threads[16];
static void execute_call(int call);
static int running;
static void* thr(void* arg)
{
struct thread_t* th = (struct thread_t*)arg;
for (;;) {
event_wait(&th->ready);
event_reset(&th->ready);
execute_call(th->call);
__atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED);
event_set(&th->done);
}
return 0;
}
static void execute_one(void)
{
int i, call, thread;
for (call = 0; call < 16; call++) {
for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0])); thread++) {
struct thread_t* th = &threads[thread];
if (!th->created) {
th->created = 1;
event_init(&th->ready);
event_init(&th->done);
event_set(&th->done);
thread_start(thr, th);
}
if (!event_isset(&th->done))
continue;
event_reset(&th->done);
th->call = call;
__atomic_fetch_add(&running, 1, __ATOMIC_RELAXED);
event_set(&th->ready);
event_timedwait(&th->done, 45 + (call == 13 ? 3000 : 0) + (call == 14 ? 3000 : 0) + (call == 15 ? 300 : 0));
break;
}
}
for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++)
sleep_ms(1);
}
static void execute_one(void);
#define WAIT_FLAGS 0
static void loop(void)
{
int iter;
for (iter = 0;; iter++) {
char cwdbuf[32];
sprintf(cwdbuf, "./%d", iter);
if (mkdir(cwdbuf, 0777))
exit(1);
int pid = fork();
if (pid < 0)
exit(1);
if (pid == 0) {
if (chdir(cwdbuf))
exit(1);
execute_one();
exit(0);
}
int status = 0;
uint64_t start = current_time_ms();
for (;;) {
if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
break;
sleep_ms(1);
if (current_time_ms() - start < 5 * 1000)
continue;
kill_and_wait(pid, &status);
break;
}
remove_dir(cwdbuf);
}
}
#ifndef SYS_dup2
#define SYS_dup2 90
#endif
#ifndef SYS_getgid
#define SYS_getgid 47
#endif
#ifndef SYS_getgroups
#define SYS_getgroups 79
#endif
#ifndef SYS_getsockopt
#define SYS_getsockopt 118
#endif
#ifndef SYS_mmap
#define SYS_mmap 197
#endif
#ifndef SYS_semctl
#define SYS_semctl 442
#endif
#ifndef SYS_semget
#define SYS_semget 221
#endif
#ifndef SYS_seteuid
#define SYS_seteuid 183
#endif
#ifndef SYS_setregid
#define SYS_setregid 127
#endif
#ifndef SYS_stat
#define SYS_stat 439
#endif
#ifndef SYS_writev
#define SYS_writev 121
#endif
uint64_t r[7] = {0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff};
void execute_call(int call)
{
intptr_t res = 0;
switch (call) {
case 0:
res = syscall(SYS_dup2, -1, 0xffffff9c);
if (res != -1)
r[0] = res;
break;
case 1:
NONFAILING(*(uint64_t*)0x200002c0 = 0x20000000);
NONFAILING(memcpy((void*)0x20000000, "\x25\xc5\xf6\x76\x86\x92\xf1\x6a\x6b\x02\x33\x7b\xc5\xf2\x4e\x95\xc2\xe5\x74\xf7\xbd\x23\xda\x78\xff\x22\x41\x43\x9c\xac\xed\x12\x2e\x33\xab\x16\xd3\x77\x84\x34\x15\x78\x1f\xa5\x08\xcd\x63\x5f\x2f\xd0\x41\x13\x20\x4e\xd9\xbd\xa7\x39\x6e\x99\xa3\x8a\x2f\x10\xe9\xc7\x39\x8b\x5a\x64\xc4\x9d\x98\x66\x4b\xd1\x49\x75\xbe\x70\x76\xa8\x36\x38\xa7\xda\x30\x95\xf0\xe0\x27\xbd\x16\x1c\xcd\x5c\x99\x4f\x8b\x31\xd5\x35\xa3\xce\x4c\x57\x81\x2d\x96\x82\xf3\xeb\xb1\x0e\x05\xa7\x14\x22\x10\x51\x5b\x66\x8d\x13\x57\xd9\x1a\xaa\xbb\x6a\xd8\x8a\xed\x6b\x9f\x21\x43\xd0\x62\xe0\xb5", 141));
NONFAILING(*(uint64_t*)0x200002c8 = 0x8d);
NONFAILING(*(uint64_t*)0x200002d0 = 0x200000c0);
NONFAILING(memcpy((void*)0x200000c0, "\xe8\x98\x7e\x8f\x86\x4e\x9d\x38\xb5\x56\x15\xb6\x59\xd1\x4c\xae\x9e\x91\xa9\x53\x22\x13\xff\xb4\x65\xb6\x1b", 27));
NONFAILING(*(uint64_t*)0x200002d8 = 0x1b);
NONFAILING(*(uint64_t*)0x200002e0 = 0x20000100);
NONFAILING(memcpy((void*)0x20000100, "\x3f\x97\x99\x2c\x94\x0f\xba\x89\x36\xa6\xb4", 11));
NONFAILING(*(uint64_t*)0x200002e8 = 0xb);
NONFAILING(*(uint64_t*)0x200002f0 = 0x20000140);
NONFAILING(memcpy((void*)0x20000140, "\xc9\x9a\xb6\x04\xeb\x2e\x44\xeb\xf7\xbf\xb7\xb0\x4c\x08\x43\x21\xa3\x0f\x43\x51\xae\xb0\x67\x6b\xb2\x1a\xef\xc3\xbc\x23\x22\xd9\x9a\x5b\x03\x4f\x88\x0a\xa2\x5d\x61\xae\x40\x76\x39\x7c\x30\x35\x7b\x22\xcc\xb7\x79\xeb\xd3\x20\x6a\xc6\x48\xfa\xb9\x08\x36\xdd\x4d\x9e\x73\xdc\x3c\x07\x72\x70\xb5\x7d\xc3\x22\x22\x84\xdd\x3c\xae\x47\x37\x95\x7d\x94\x7d\x76\x5a\x5e\x0e\x91\x9c\xbd\x3e\xf2\xd3\xd9\x52\x2a\x82\x7f\x3f\xe6\x0d\xdc", 106));
NONFAILING(*(uint64_t*)0x200002f8 = 0x6a);
NONFAILING(*(uint64_t*)0x20000300 = 0x200001c0);
NONFAILING(memcpy((void*)0x200001c0, "\x2b\xc5\xa9\xfd\x6c\xc3\x45\x00\x82\x40\x5a\xb6\x07\xa0\xf5\x62\x7b\x40\x58\x9a\x69\x0a\xc5\x91\x58\xac\xf1\x0f\x2a\x1c\xc4\x61\x52\xfa\x5f\x49\x3a\x85\x99\xcc\x6e\xaa\xb5\xd9\x69\x68\xbe\xf1\xa2\x7f\x62\xda\xcf\x64\xd0\x6c\x80\xcf\xb5\xb3\x20\xb9\x77\xc9\x43\x2c\x44\x6f\xa6\xf6\x55\x14\x44\xee\x4c\x59\x98\x85\x32\x60\xd6\x5d\x2c\xb3\xc7\x78\xf4\x4f\xe2\x70\x36\x3b\x4e\xb3\x09\xe2\x4f\xc4\x77\x97\xb5\xbd\x45\x4b\xf4\xd3\xd4\x65\x6f\xa0\x78\xff\x56\xb3\x0f\x4f\x0e\x9d\x5e\x6e\x89\x43\x83\x0a\xd6\xd3\x42\x96\x8c\x22\x4f\x7c\x35\xaf\x01\xa6\x1d\x10\xe1\x55\xfe\xe7\xe0\x22\x7c\xd7\x9a\x79\x77\xb3\xf4\x03\x51\xca\x01\x83\x48\x40\xab\xba\x55\x7d\x36\xbc\x8a\x42\x08\xf9\x0d\xc5\xf5\x1e\x3f\x3d\x44\x5c\x5f\xee\xa7\x93\x68\x16\x4e\xde\xf0\x5d\x24\x74\x8c\xe9\xf0\xa5\x84\x51\xb4\x3d\x98\x91\x90\x2b\xc4\x5e\xc6\x7d\x00\xdf\x1d\xeb\x74\xe6\x5b\x29\xc0\xd0\x95\xdb\xdd\x5b\x9a\x7c", 220));
NONFAILING(*(uint64_t*)0x20000308 = 0xdc);
syscall(SYS_writev, r[0], 0x200002c0ul, 5ul);
break;
case 2:
NONFAILING(*(uint32_t*)0x20000340 = 0);
NONFAILING(*(uint32_t*)0x20000344 = -1);
NONFAILING(*(uint32_t*)0x20000348 = 0);
res = syscall(SYS_getgroups, 3ul, 0x20000340ul);
if (res != -1)
NONFAILING(r[1] = *(uint32_t*)0x20000348);
break;
case 3:
NONFAILING(*(uint32_t*)0x200003c0 = 0xc);
res = syscall(SYS_getsockopt, -1, 0xffff, 0x11, 0x20000380ul, 0x200003c0ul);
if (res != -1)
NONFAILING(r[2] = *(uint32_t*)0x20000388);
break;
case 4:
syscall(SYS_setregid, r[1], r[2]);
break;
case 5:
res = syscall(SYS_semget, 0x798e2634ul, 0ul, 0xb2603d964b180ce8ul);
if (res != -1)
r[3] = res;
break;
case 6:
NONFAILING(memcpy((void*)0x20000400, "./file0\000", 8));
res = syscall(SYS_stat, 0x20000400ul, 0x20000440ul);
if (res != -1)
NONFAILING(r[4] = *(uint32_t*)0x2000045c);
break;
case 7:
res = syscall(SYS_getgid);
if (res != -1)
r[5] = res;
break;
case 8:
NONFAILING(*(uint32_t*)0x20000500 = 0xfffff834);
NONFAILING(*(uint32_t*)0x20000504 = r[4]);
NONFAILING(*(uint32_t*)0x20000508 = r[5]);
NONFAILING(*(uint32_t*)0x2000050c = -1);
NONFAILING(*(uint32_t*)0x20000510 = 0);
NONFAILING(*(uint32_t*)0x20000514 = 3);
NONFAILING(*(uint16_t*)0x20000518 = 9);
NONFAILING(*(uint16_t*)0x2000051a = 0);
NONFAILING(*(uint64_t*)0x20000520 = 0);
NONFAILING(*(uint64_t*)0x20000528 = 0);
NONFAILING(*(uint64_t*)0x20000530 = 0xfffffffffffffffd);
NONFAILING(*(uint64_t*)0x20000538 = 0x4535);
NONFAILING(*(uint64_t*)0x20000540 = 2);
NONFAILING(*(uint64_t*)0x20000548 = 0);
NONFAILING(*(uint64_t*)0x20000550 = 0);
syscall(SYS_semctl, r[3], 0ul, 1ul, 0x20000500ul);
break;
case 9:
syscall(SYS_seteuid, 0);
break;
case 10:
NONFAILING(memcpy((void*)0x20000000, "\xbf\x5b\xc2\xc4\xdd\xcd\x9b\xaa\x7f\x7c\x66\xf9\x17\x26\xa8\xc4\x90\xf6\x91\x85\x14\x0b\x5b\x42\x51\xe8\x67\x01\xc6\xc5\xa6\x0d\x84\x80\x2d\x38\x2a\x0c\x38\xdf\x4a\x28\xfd\x84\x0d\x7e\x14\x06\xa5\xc2\xeb\x5d\x3b\x6b\xc3\x23\xbd\x49\x38\x6c\x4a\x92\x49\x50\x31\x4f\xe6\x17\xf8\xcd\x34\x37\xa4\xaa\x6d\x1c\x6d\x62\x64\x03\x09\xf9\xde\x23\x93\x99\x9b\x11\x47\x68\xd5\x10\xd7\x34\xfd\x72\xd1\x98\xb2\x61\xbd\x61\x81\x14\xbf\x3f\xa3\xe2\xfe\x84\xff\xe6\x5c\x80\xe4\x72\x12\xc4\x9e\x47\xbb\x3a\xaa\x86\x89\x46\x2f\x21\xd5\x18\x80\xd9\x7c\xb4\x45\xd3", 136));
break;
case 11:
NONFAILING(memcpy((void*)0x200000c0, "\xc4\xa1\x84\x58\x2c\xaa\x26\x44\x0f\xae\x04\xc4\x41\x0f\x74\xab\x00\x00\x01\x00\xc4\x23\xf5\x78\x4c\xe9\x9d\x40\x44\xdf\x34\x59\x26\x41\x0f\xae\x41\x01\x64\x64\x66\x44\x0f\xe5\xb9\x4e\x9a\xb0\xc4\xc4\x22\x7d\x47\x0f\x41\x0f\x45\x7f\x56\x66\x0f\xdd\xe8", 63));
syz_execute_func(0x200000c0);
break;
case 12:
break;
case 13:
NONFAILING(memcpy((void*)0x20000140, "\x64\xd3\x2f\x16\xeb\xd8\x17\xd0\x04\xdc\xb8\x01\x71\x82\x05\xbc\xa1\xd8\x6d\xad\x3c\xb1\x32\xa2\x86\x60\x92\x14\xb7\x39\x5a\x97\xa0\xe8\xfe\xda\x5f\xad\x02\xcc\xe9\xde\xea\x94\xd5\x5a\x75\x0c\x17\xb2\x34\x07\x50\x02\xb9\xdf\x62\x9f\xa6\x8e\x3f\x7d\xa9\x7e\x9c\x2a\x2e\x0a\x95\xd1\x5d\x35\x95\x61\xb1\x47\x74\x40\x34\x2c\xd7\x9c\x7c\xeb\xd6\xbf\x00\x8a\xcd\x1c\x7f\xf1\x46\xa6\xfe\x22\x01\x36\x61\xd8\xc8\xce\x8e\xb1\x7f\x5c\xf3\x89\x2a\xe0\x8b\xba\x46\x54\x5b\x2b\x69\x0a\xb7\xe0\x36\x8a\xec\x4d\x32\xb7\x6d\x7f\xc1\x5d\xd7\xc2\xab\xa1\x84\xd4\x1a\x5e\x5a\xbb\x8d\x71\x6f\x5e\x64\x5e\x17\x67\x13\x8e\xd7\x38\xf3\x15\x79\x5a\xc9\x9e\x22\xfd\x44\xdb\x06\x09\x63\x13\xf4\x72\x9c\xe0\xd3\xbd\x93\x8f\x5b\x65\x20\xef\x93\x76\xfa\x90\x9d\xf6\xb2\x05\xc2\xd3\xf5\x2e\xe4\x3e\x3f\x59\xea\x44\x1b\x7c\x4e\x4d\x5c", 201));
NONFAILING(memcpy((void*)0x20000240, "\xc1\xb0\x1d\x40\x73\x99\x35\xb1\x21\x7d\x0e\x39\x3c\xdd\x4f\xa4\xef\x8b\xbd\x99\x57\xee\x99\x68\x77\xe4\xca\x15\x5c\x19\x5d\xc1\x66\xf9\x48\x6a\xc4\xdb\x17\xf7\x54\xc4\x89\x38\xa4\x34\x19\xf0\x82\xa8\xc3\x0e\xff\xbe\xf0\x64\xf6\xc8\xb8\x7b\xc9\x30\xe4\x39\xc7\x19\xec\x0a\x11\x99\x04\x0b\x86\x28\x6d\x27\x1f\x25\xaf\x26\xeb\xed\x3f\x55\xc3\x2e\x68\xac\x70\x33\x0d\xf7\x69\x31\xbf\x55\xfa\xe8\x80\x25\x6b\x74\xa9\x23\xf8\xa3\x02\x2c\x31\x0f\x94\xcc\x0c\x62\x33\x02\xa5\xd1\x4b\x3f\x8e\x18\xf4\x15\x99\x88\x28\x66\xea\x02\x42\x86\x4b\x37\xd5\xae\x87\xfb\xcb\x74\x5c\x3e\x26\x42\x3d\x05\xc5\x48\x38\x33\xdf\xcd\xd4\x3d\xc0\xc6\x50\x73\x29\x03\x72\x73\xde\x28\x2e\x3a\x16\xac\x00\xc5\x53\x9c\x30\x94\x63\x98\x4b\x15\x3e\xc6\x25\x0a\x78\x19\x75\xa2\x77\x01\x72\x80\xdb\x1e\x9c\x18\xce\x66\x4d\xf5\x94\x7c\x6c\x18\xbe\xf2\x36\x7e\x61\x63\xb4\x6b\x95\x03\xf7\x00\x70\x5f\xd0\xe8\x9e\xae\x6d\xf0\x88\x4b\xf2\x7c\x00\xe0\x5f\xc5\xef\xc6\x49\x07", 234));
syz_usb_connect(0, 0xc9, 0x20000140, 0x20000240);
break;
case 14:
NONFAILING(memcpy((void*)0x20000340, "\x36\x4f\xb1\xa4\x17\x26\x3d\xe2\x27\x97\xec\x76\x08\x61\xf3\x85\x2c\xf2\x4f\x79\xe2\xb7\xa5\xc6\x2a\xfa\xd7\xd6\xd4\xd0\x9d\x86\x2f\x8e\xcc\xd0\x2e\x1b\xb9\x89\xe0\xf8\xa8\xad\x91\x54\x42\x01\x64\x04\xc9\x82\x6a\x5c\x0a\x28\x4f\xc7\xa8\x40\x30\x47\x59\xb6\x84\xf3\x57\xb2\xe6\xfe\xcf\xb3\xcc\x81\x57\xc0\x08\xff\x0d\xcf\xf2\x10\x89\x84\x54\x8a\x2a\xd6\x95\xfa\xd9\x51\x2f\x06\xfd\x12\xd6\x6b\xc4\x43\x04\x75\x12\xab\x4e\xf3\x05\x8a\xe6\xc0\xc6\xec\x3f\xd6\x27\xe3\x70\xa1\x51\xae\x71\x9b\x8e\x3a\x77\xd6\x82\xdc\x06\xa9\x3b\xe9\xc2\xaa\x80\x18\xb5\x8a\x94\x92\xcb\x39\x03\x1b\xb5\xab\xf3\x12\x4e\xaa\xb8\x53\x30\xf1\x81\xfc\xcc\xa7\x59\x7b\x4e\xc0\x87\x9f\xcb\xcf\x51\x14\x3f\x98\xc4\x43\xc1\x67\x20\xa6\xe0\x1b\x7e\x07\xdf\x47\x27\xe2\x88\xe1\x3d\xcc\x0b\x7e\x11", 191));
NONFAILING(memcpy((void*)0x20000400, "\x59\x03\x92\x3c\x7a\x1b\x28\x38\xf3\xc1\x21\x56\x78\x5a\x11\xc8\x1b\x2e\x82\xd9\xa1\x19\x0e\x1b\x9c\x45\x97\x6a\x91\x7c\x00\x29\x4d\xc9\x4d\x53\x54\xe8\xc5\xd6\xa4\xe8\x98\x6d\xa0\x74\xeb\x46\x1e\xd0\x73\x6b\xcb\xed\xe2\xce\xf1\xf1\x9e\x02\x16\xc0\x9e\xb7\x94\xd8\xb9\x75\x4f\xea\x26\xf1\x10\xc8\x32\x48\xc2\x86\xea\xa0\x5a\x69\x84\x4e\xb1\x29\x2f\x59\x4f\x59\xf6\xc9\xbe\xca\x47\xd8\x94\xd4\x4d\xfd\x15\xff\x81\xb7\x6b\x46\x35\x39\x2e\xb5\xed\x43\x1c\xa3\x09\x22\x30", 117));
res = syz_usb_connect(4, 0xbf, 0x20000340, 0x20000400);
if (res != -1)
r[6] = res;
break;
case 15:
syz_usb_disconnect(r[6]);
break;
}
}
int main(void)
{
syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 3ul, 0x1012ul, -1, 0ul, 0ul);
install_segv_handler();
use_temporary_dir();
do_sandbox_none();
return 0;
}
<stdin>:214:2: error: unknown type name 'uint8_t_t'
<stdin>:215:2: error: unknown type name 'uint8_t_t'
<stdin>:216:2: error: unknown type name 'uint8_t_t'
<stdin>:217:2: error: unknown type name 'uint8_t_t'
<stdin>:218:2: error: unknown type name 'uint16_t_t'
<stdin>:219:2: error: unknown type name 'uint8_t_t'
<stdin>:220:2: error: unknown type name 'uint8_t_t'
<stdin>:221:2: error: unknown type name 'uint8_t_t'
<stdin>:225:2: error: unknown type name 'uint8_t_t'
<stdin>:226:2: error: unknown type name 'uint8_t_t'
<stdin>:227:2: error: unknown type name 'uint16_t_t'
<stdin>:228:2: error: unknown type name 'uint8_t_t'
<stdin>:229:2: error: unknown type name 'uint8_t_t'
<stdin>:230:2: error: unknown type name 'uint8_t_t'
<stdin>:231:2: error: unknown type name 'uint8_t_t'
<stdin>:232:2: error: unknown type name 'uint16_t_t'
<stdin>:233:2: error: unknown type name 'uint16_t_t'
<stdin>:234:2: error: unknown type name 'uint16_t_t'
<stdin>:235:2: error: unknown type name 'uint8_t_t'
<stdin>:236:2: error: unknown type name 'uint8_t_t'
<stdin>:237:2: error: unknown type name 'uint8_t_t'
<stdin>:238:2: error: unknown type name 'uint8_t_t'
<stdin>:242:2: error: unknown type name 'uint8_t_t'
<stdin>:243:2: error: unknown type name 'uint8_t_t'
<stdin>:244:2: error: unknown type name 'uint16_t_t'
<stdin>:245:2: error: unknown type name 'uint8_t_t'
<stdin>:246:2: error: unknown type name 'uint8_t_t'
<stdin>:247:2: error: unknown type name 'uint8_t_t'
<stdin>:248:2: error: unknown type name 'uint8_t_t'
<stdin>:249:2: error: unknown type name 'uint8_t_t'
<stdin>:253:2: error: unknown type name 'uint8_t_t'
<stdin>:254:2: error: unknown type name 'uint8_t_t'
<stdin>:255:2: error: unknown type name 'uint8_t_t'
<stdin>:256:2: error: unknown type name 'uint8_t_t'
<stdin>:257:2: error: unknown type name 'uint8_t_t'
<stdin>:258:2: error: unknown type name 'uint8_t_t'
<stdin>:259:2: error: unknown type name 'uint8_t_t'
<stdin>:260:2: error: unknown type name 'uint8_t_t'
<stdin>:261:2: error: unknown type name 'uint8_t_t'
<stdin>:265:2: error: unknown type name 'uint8_t_t'
<stdin>:266:2: error: unknown type name 'uint8_t_t'
<stdin>:267:2: error: unknown type name 'uint16_t_t'
<stdin>:268:2: error: unknown type name 'uint16_t_t'
<stdin>:269:2: error: unknown type name 'uint16_t_t'
<stdin>:273:2: error: unknown type name 'uint8_t_t'
<stdin>:274:2: error: unknown type name 'uint8_t_t'
<stdin>:275:2: error: unknown type name 'uint16_t_t'
<stdin>:276:2: error: unknown type name 'uint8_t_t'
<stdin>:277:2: error: unknown type name 'uint8_t_t'
<stdin>:278:2: error: unknown type name 'uint8_t_t'
<stdin>:279:2: error: unknown type name 'uint8_t_t'
<stdin>:280:2: error: unknown type name 'uint8_t_t'
<stdin>:281:2: error: unknown type name 'uint8_t_t'
<stdin>: In function 'vhci_usb_recv':
<stdin>:588:2: error: unknown type name 'uint8_t_t'; did you mean 'uint8_t'?
<stdin>:588:20: error: 'uint8_t_t' undeclared (first use in this function); did you mean 'uint8_t'?
<stdin>:588:20: note: each undeclared identifier is reported only once for each function it appears in
<stdin>:588:30: error: expected expression before ')' token
<stdin>: In function 'vhci_usb_send':
<stdin>:603:2: error: unknown type name 'uint8_t_t'; did you mean 'uint8_t'?
<stdin>:603:20: error: 'uint8_t_t' undeclared (first use in this function); did you mean 'uint8_t'?
<stdin>:603:30: error: expected expression before ')' token
<stdin>: In function 'syz_usb_connect_impl':
<stdin>:664:77: error: unknown type name 'usb_ctrlrequest'
<stdin>:57:110: note: in definition of macro 'NONFAILING'
<stdin>:669:55: error: unknown type name 'usb_ctrlrequest'
<stdin>:681:8: error: 'uint32_t_t' undeclared (first use in this function); did you mean 'uint32_t'?
At top level:
<stdin>:729:13: error: 'setup_usb' defined but not used [-Werror=unused-function]
cc1: all warnings being treated as errors
compiler invocation: /syzkaller/netbsd/src/../tools/bin/x86_64--netbsd-g++ [-o /tmp/syz-executor480526986 -DGOOS_netbsd=1 -DGOARCH_amd64=1 -DHOSTGOOS_linux=1 -x c - -m64 --sysroot /syzkaller/netbsd/src/../dest/ -O2 -pthread -Wall -Werror -Wparentheses -Wframe-larger-than=16384]
--- FAIL: TestGenerate/netbsd/amd64/6 (0.52s)
csource_test.go:123: opts: {Threaded:true Collide:false Repeat:true RepeatTimes:0 Procs:4 Sandbox:none Fault:false FaultCall:0 FaultNth:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false USB:false UseTmpDir:true HandleSegv:false Repro:false Trace:false}
program:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
writev(r0, &(0x7f00000002c0)=[{&(0x7f0000000000)="25c5f6768692f16a6b02337bc5f24e95c2e574f7bd23da78ff2241439caced122e33ab16d377843415781fa508cd635f2fd04113204ed9bda7396e99a38a2f10e9c7398b5a64c49d98664bd14975be7076a83638a7da3095f0e027bd161ccd5c994f8b31d535a3ce4c57812d9682f3ebb10e05a7142210515b668d1357d91aaabb6ad88aed6b9f2143d062e0b5", 0x8d}, {&(0x7f00000000c0)="e8987e8f864e9d38b55615b659d14cae9e91a9532213ffb465b61b", 0x1b}, {&(0x7f0000000100)="3f97992c940fba8936a6b4", 0xb}, {&(0x7f0000000140)="c99ab604eb2e44ebf7bfb7b04c084321a30f4351aeb0676bb21aefc3bc2322d99a5b034f880aa25d61ae4076397c30357b22ccb779ebd3206ac648fab90836dd4d9e73dc3c077270b57dc3222284dd3cae4737957d947d765a5e0e919cbd3ef2d3d9522a827f3fe60ddc", 0x6a}, {&(0x7f00000001c0)="2bc5a9fd6cc3450082405ab607a0f5627b40589a690ac59158acf10f2a1cc46152fa5f493a8599cc6eaab5d96968bef1a27f62dacf64d06c80cfb5b320b977c9432c446fa6f6551444ee4c5998853260d65d2cb3c778f44fe270363b4eb309e24fc47797b5bd454bf4d3d4656fa078ff56b30f4f0e9d5e6e8943830ad6d342968c224f7c35af01a61d10e155fee7e0227cd79a7977b3f40351ca01834840abba557d36bc8a4208f90dc5f51e3f3d445c5feea79368164edef05d24748ce9f0a58451b43d9891902bc45ec67d00df1deb74e65b29c0d095dbdd5b9a7c", 0xdc}], 0x5)
getgroups(0x3, &(0x7f0000000340)=[0x0, 0xffffffffffffffff, <r1=>0x0])
getsockopt$sock_cred(0xffffffffffffffff, 0xffff, 0x11, &(0x7f0000000380)={0x0, 0x0, <r2=>0x0}, &(0x7f00000003c0)=0xc)
setregid(r1, r2)
r3 = semget(0x1, 0x0, 0xb2603d964b180ce8)
stat(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, <r4=>0x0})
r5 = getgid()
semctl$IPC_SET(r3, 0x0, 0x1, &(0x7f0000000500)={{0xfffff834, r4, r5, 0xffffffffffffffff, 0x0, 0x3, 0x9}, 0xfffffffffffffffd, 0x4535, 0x2})
seteuid(0x0)
syz_emit_ethernet(0x88, &(0x7f0000000000)="bf5bc2c4ddcd9baa7f7c66f91726a8c490f69185140b5b4251e86701c6c5a60d84802d382a0c38df4a28fd840d7e1406a5c2eb5d3b6bc323bd49386c4a924950314fe617f8cd3437a4aa6d1c6d62640309f9de2393999b114768d510d734fd72d198b261bd618114bf3fa3e2fe84ffe65c80e47212c49e47bb3aaa8689462f21d51880d97cb445d3")
syz_execute_func(&(0x7f00000000c0)="c4a184582caa26440fae04c4410f74ab00000100c423f5784ce99d4044df345926410fae4101646466440fe5b94e9ab0c4c4227d470f410f457f56660fdde8")
syz_extract_tcp_res(&(0x7f0000000100), 0x6, 0x1)
syz_usb_connect(0x0, 0xc9, &(0x7f0000000140)="64d32f16ebd817d004dcb801718205bca1d86dad3cb132a286609214b7395a97a0e8feda5fad02cce9deea94d55a750c17b234075002b9df629fa68e3f7da97e9c2a2e0a95d15d359561b1477440342cd79c7cebd6bf008acd1c7ff146a6fe22013661d8c8ce8eb17f5cf3892ae08bba46545b2b690ab7e0368aec4d32b76d7fc15dd7c2aba184d41a5e5abb8d716f5e645e1767138ed738f315795ac99e22fd44db06096313f4729ce0d3bd938f5b6520ef9376fa909df6b205c2d3f52ee43e3f59ea441b7c4e4d5c", &(0x7f0000000240)="c1b01d40739935b1217d0e393cdd4fa4ef8bbd9957ee996877e4ca155c195dc166f9486ac4db17f754c48938a43419f082a8c30effbef064f6c8b87bc930e439c719ec0a1199040b86286d271f25af26ebed3f55c32e68ac70330df76931bf55fae880256b74a923f8a3022c310f94cc0c623302a5d14b3f8e18f41599882866ea0242864b37d5ae87fbcb745c3e26423d05c5483833dfcdd43dc0c6507329037273de282e3a16ac00c5539c309463984b153ec6250a781975a277017280db1e9c18ce664df5947c6c18bef2367e6163b46b9503f700705fd0e89eae6df0884bf27c00e05fc5efc64907")
r6 = syz_usb_connect(0x4, 0xbf, &(0x7f0000000340)="364fb1a417263de22797ec760861f3852cf24f79e2b7a5c62afad7d6d4d09d862f8eccd02e1bb989e0f8a8ad915442016404c9826a5c0a284fc7a840304759b684f357b2e6fecfb3cc8157c008ff0dcff2108984548a2ad695fad9512f06fd12d66bc443047512ab4ef3058ae6c0c6ec3fd627e370a151ae719b8e3a77d682dc06a93be9c2aa8018b58a9492cb39031bb5abf3124eaab85330f181fccca7597b4ec0879fcbcf51143f98c443c16720a6e01b7e07df4727e288e13dcc0b7e11", &(0x7f0000000400)="5903923c7a1b2838f3c12156785a11c81b2e82d9a1190e1b9c45976a917c00294dc94d5354e8c5d6a4e8986da074eb461ed0736bcbede2cef1f19e0216c09eb794d8b9754fea26f110c83248c286eaa05a69844eb1292f594f59f6c9beca47d894d44dfd15ff81b76b4635392eb5ed431ca3092230")
syz_usb_disconnect(r6)
csource_test.go:124: failed to build program:
// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <dev/usb/usb.h>
#include <dev/usb/usbhid.h>
#include <dev/usb/vhci.h>
#include <dirent.h>
#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <pthread.h>
#include <pwd.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ioctl.h>
#include <sys/resource.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>
static unsigned long long procid;
static void kill_and_wait(int pid, int* status)
{
kill(pid, SIGKILL);
while (waitpid(-1, status, 0) != pid) {
}
}
static void sleep_ms(uint64_t ms)
{
usleep(ms * 1000);
}
static uint64_t current_time_ms(void)
{
struct timespec ts;
if (clock_gettime(CLOCK_MONOTONIC, &ts))
exit(1);
return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}
static void use_temporary_dir(void)
{
char tmpdir_template[] = "./syzkaller.XXXXXX";
char* tmpdir = mkdtemp(tmpdir_template);
if (!tmpdir)
exit(1);
if (chmod(tmpdir, 0777))
exit(1);
if (chdir(tmpdir))
exit(1);
}
static void remove_dir(const char* dir)
{
DIR* dp;
struct dirent* ep;
dp = opendir(dir);
if (dp == NULL)
exit(1);
while ((ep = readdir(dp))) {
if (strcmp(ep->d_name, ".") == 0 || strcmp(ep->d_name, "..") == 0)
continue;
char filename[FILENAME_MAX];
snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name);
struct stat st;
if (lstat(filename, &st))
exit(1);
if (S_ISDIR(st.st_mode)) {
remove_dir(filename);
continue;
}
if (unlink(filename))
exit(1);
}
closedir(dp);
if (rmdir(dir))
exit(1);
}
static void thread_start(void* (*fn)(void*), void* arg)
{
pthread_t th;
pthread_attr_t attr;
pthread_attr_init(&attr);
pthread_attr_setstacksize(&attr, 128 << 10);
int i;
for (i = 0; i < 100; i++) {
if (pthread_create(&th, &attr, fn, arg) == 0) {
pthread_attr_destroy(&attr);
return;
}
if (errno == EAGAIN) {
usleep(50);
continue;
}
break;
}
exit(1);
}
typedef struct {
pthread_mutex_t mu;
pthread_cond_t cv;
int state;
} event_t;
static void event_init(event_t* ev)
{
if (pthread_mutex_init(&ev->mu, 0))
exit(1);
if (pthread_cond_init(&ev->cv, 0))
exit(1);
ev->state = 0;
}
static void event_reset(event_t* ev)
{
ev->state = 0;
}
static void event_set(event_t* ev)
{
pthread_mutex_lock(&ev->mu);
if (ev->state)
exit(1);
ev->state = 1;
pthread_mutex_unlock(&ev->mu);
pthread_cond_broadcast(&ev->cv);
}
static void event_wait(event_t* ev)
{
pthread_mutex_lock(&ev->mu);
while (!ev->state)
pthread_cond_wait(&ev->cv, &ev->mu);
pthread_mutex_unlock(&ev->mu);
}
static int event_isset(event_t* ev)
{
pthread_mutex_lock(&ev->mu);
int res = ev->state;
pthread_mutex_unlock(&ev->mu);
return res;
}
static int event_timedwait(event_t* ev, uint64_t timeout)
{
uint64_t start = current_time_ms();
uint64_t now = start;
pthread_mutex_lock(&ev->mu);
for (;;) {
if (ev->state)
break;
uint64_t remain = timeout - (now - start);
struct timespec ts;
ts.tv_sec = remain / 1000;
ts.tv_nsec = (remain % 1000) * 1000 * 1000;
pthread_cond_timedwait(&ev->cv, &ev->mu, &ts);
now = current_time_ms();
if (now - start > timeout)
break;
}
int res = ev->state;
pthread_mutex_unlock(&ev->mu);
return res;
}
/* -------------------------------------------------------------------------- */
/*
* Redefinitions to match the linux types used in common_usb.h.
*/
struct usb_endpoint_descriptor {
uint8_t_t bLength;
uint8_t_t bDescriptorType;
uint8_t_t bEndpointAddress;
uint8_t_t bmAttributes;
uint16_t_t wMaxPacketSize;
uint8_t_t bInterval;
uint8_t_t bRefresh;
uint8_t_t bSynchAddress;
} __attribute__((packed));
struct usb_device_descriptor {
uint8_t_t bLength;
uint8_t_t bDescriptorType;
uint16_t_t bcdUSB;
uint8_t_t bDeviceClass;
uint8_t_t bDeviceSubClass;
uint8_t_t bDeviceProtocol;
uint8_t_t bMaxPacketSize0;
uint16_t_t idVendor;
uint16_t_t idProduct;
uint16_t_t bcdDevice;
uint8_t_t iManufacturer;
uint8_t_t iProduct;
uint8_t_t iSerialNumber;
uint8_t_t bNumConfigurations;
} __attribute__((packed));
struct usb_config_descriptor {
uint8_t_t bLength;
uint8_t_t bDescriptorType;
uint16_t_t wTotalLength;
uint8_t_t bNumInterfaces;
uint8_t_t bConfigurationValue;
uint8_t_t iConfiguration;
uint8_t_t bmAttributes;
uint8_t_t bMaxPower;
} __attribute__((packed));
struct usb_interface_descriptor {
uint8_t_t bLength;
uint8_t_t bDescriptorType;
uint8_t_t bInterfaceNumber;
uint8_t_t bAlternateSetting;
uint8_t_t bNumEndpoints;
uint8_t_t bInterfaceClass;
uint8_t_t bInterfaceSubClass;
uint8_t_t bInterfaceProtocol;
uint8_t_t iInterface;
} __attribute__((packed));
struct usb_ctrlrequest {
uint8_t_t bRequestType;
uint8_t_t bRequest;
uint16_t_t wValue;
uint16_t_t wIndex;
uint16_t_t wLength;
} __attribute__((packed));
struct usb_qualifier_descriptor {
uint8_t_t bLength;
uint8_t_t bDescriptorType;
uint16_t_t bcdUSB;
uint8_t_t bDeviceClass;
uint8_t_t bDeviceSubClass;
uint8_t_t bDeviceProtocol;
uint8_t_t bMaxPacketSize0;
uint8_t_t bNumConfigurations;
uint8_t_t bRESERVED;
} __attribute__((packed));
#define USB_TYPE_MASK (0x03 << 5)
#define USB_TYPE_STANDARD (0x00 << 5)
#define USB_TYPE_CLASS (0x01 << 5)
#define USB_TYPE_VENDOR (0x02 << 5)
#define USB_TYPE_RESERVED (0x03 << 5)
#define USB_DT_DEVICE 0x01
#define USB_DT_CONFIG 0x02
#define USB_DT_STRING 0x03
#define USB_DT_INTERFACE 0x04
#define USB_DT_ENDPOINT 0x05
#define USB_DT_DEVICE_QUALIFIER 0x06
#define USB_DT_OTHER_SPEED_CONFIG 0x07
#define USB_DT_INTERFACE_POWER 0x08
#define USB_DT_OTG 0x09
#define USB_DT_DEBUG 0x0a
#define USB_DT_INTERFACE_ASSOCIATION 0x0b
#define USB_DT_SECURITY 0x0c
#define USB_DT_KEY 0x0d
#define USB_DT_ENCRYPTION_TYPE 0x0e
#define USB_DT_BOS 0x0f
#define USB_DT_DEVICE_CAPABILITY 0x10
#define USB_DT_WIRELESS_ENDPOINT_COMP 0x11
#define USB_DT_WIRE_ADAPTER 0x21
#define USB_DT_RPIPE 0x22
#define USB_DT_CS_RADIO_CONTROL 0x23
#define USB_DT_PIPE_USAGE 0x24
#define USB_DT_SS_ENDPOINT_COMP 0x30
#define USB_DT_SSP_ISOC_ENDPOINT_COMP 0x31
#define USB_REQ_GET_STATUS 0x00
#define USB_REQ_CLEAR_FEATURE 0x01
#define USB_REQ_SET_FEATURE 0x03
#define USB_REQ_SET_ADDRESS 0x05
#define USB_REQ_GET_DESCRIPTOR 0x06
#define USB_REQ_SET_DESCRIPTOR 0x07
#define USB_REQ_GET_CONFIGURATION 0x08
#define USB_REQ_SET_CONFIGURATION 0x09
#define USB_REQ_GET_INTERFACE 0x0A
#define USB_REQ_SET_INTERFACE 0x0B
#define USB_REQ_SYNCH_FRAME 0x0C
#define USB_REQ_SET_SEL 0x30
#define USB_REQ_SET_ISOCH_DELAY 0x31
#define USB_REQ_SET_ENCRYPTION 0x0D
#define USB_REQ_GET_ENCRYPTION 0x0E
#define USB_REQ_RPIPE_ABORT 0x0E
#define USB_REQ_SET_HANDSHAKE 0x0F
#define USB_REQ_RPIPE_RESET 0x0F
#define USB_REQ_GET_HANDSHAKE 0x10
#define USB_REQ_SET_CONNECTION 0x11
#define USB_REQ_SET_SECURITY_DATA 0x12
#define USB_REQ_GET_SECURITY_DATA 0x13
#define USB_REQ_SET_WUSB_DATA 0x14
#define USB_REQ_LOOPBACK_DATA_WRITE 0x15
#define USB_REQ_LOOPBACK_DATA_READ 0x16
#define USB_REQ_SET_INTERFACE_DS 0x17
#define USB_REQ_GET_PARTNER_PDO 20
#define USB_REQ_GET_BATTERY_STATUS 21
#define USB_REQ_SET_PDO 22
#define USB_REQ_GET_VDM 23
#define USB_REQ_SEND_VDM 24
#define USB_MAX_IFACE_NUM 4
#define USB_MAX_EP_NUM 32
#define USB_MAX_FDS 6
struct usb_endpoint_index {
struct usb_endpoint_descriptor desc;
int handle;
};
struct usb_iface_index {
struct usb_interface_descriptor* iface;
uint8_t bInterfaceNumber;
uint8_t bAlternateSetting;
uint8_t bInterfaceClass;
struct usb_endpoint_index eps[USB_MAX_EP_NUM];
int eps_num;
};
struct usb_device_index {
struct usb_device_descriptor* dev;
struct usb_config_descriptor* config;
uint8_t bDeviceClass;
uint8_t bMaxPower;
int config_length;
struct usb_iface_index ifaces[USB_MAX_IFACE_NUM];
int ifaces_num;
int iface_cur;
};
struct usb_info {
int fd;
struct usb_device_index index;
};
static struct usb_info usb_devices[USB_MAX_FDS];
static int usb_devices_num;
static bool parse_usb_descriptor(const char* buffer, size_t length, struct usb_device_index* index)
{
if (length < sizeof(*index->dev) + sizeof(*index->config))
return false;
memset(index, 0, sizeof(*index));
index->dev = (struct usb_device_descriptor*)buffer;
index->config = (struct usb_config_descriptor*)(buffer + sizeof(*index->dev));
index->bDeviceClass = index->dev->bDeviceClass;
index->bMaxPower = index->config->bMaxPower;
index->config_length = length - sizeof(*index->dev);
index->iface_cur = -1;
size_t offset = 0;
while (true) {
if (offset + 1 >= length)
break;
uint8_t desc_length = buffer[offset];
uint8_t desc_type = buffer[offset + 1];
if (desc_length <= 2)
break;
if (offset + desc_length > length)
break;
if (desc_type == USB_DT_INTERFACE && index->ifaces_num < USB_MAX_IFACE_NUM) {
struct usb_interface_descriptor* iface = (struct usb_interface_descriptor*)(buffer + offset);
index->ifaces[index->ifaces_num].iface = iface;
index->ifaces[index->ifaces_num].bInterfaceNumber = iface->bInterfaceNumber;
index->ifaces[index->ifaces_num].bAlternateSetting = iface->bAlternateSetting;
index->ifaces[index->ifaces_num].bInterfaceClass = iface->bInterfaceClass;
index->ifaces_num++;
}
if (desc_type == USB_DT_ENDPOINT && index->ifaces_num > 0) {
struct usb_iface_index* iface = &index->ifaces[index->ifaces_num - 1];
if (iface->eps_num < USB_MAX_EP_NUM) {
memcpy(&iface->eps[iface->eps_num].desc, buffer + offset, sizeof(iface->eps[iface->eps_num].desc));
iface->eps_num++;
}
}
offset += desc_length;
}
return true;
}
static struct usb_device_index* add_usb_index(int fd, const char* dev, size_t dev_len)
{
int i = __atomic_fetch_add(&usb_devices_num, 1, __ATOMIC_RELAXED);
if (i >= USB_MAX_FDS)
return NULL;
int rv = 0;
rv = parse_usb_descriptor(dev, dev_len, &usb_devices[i].index);
if (!rv)
return NULL;
__atomic_store_n(&usb_devices[i].fd, fd, __ATOMIC_RELEASE);
return &usb_devices[i].index;
}
static struct usb_device_index* lookup_usb_index(int fd)
{
int i;
for (i = 0; i < USB_MAX_FDS; i++) {
if (__atomic_load_n(&usb_devices[i].fd, __ATOMIC_ACQUIRE) == fd) {
return &usb_devices[i].index;
}
}
return NULL;
}
struct vusb_connect_string_descriptor {
uint32_t len;
char* str;
} __attribute__((packed));
struct vusb_connect_descriptors {
uint32_t qual_len;
char* qual;
uint32_t bos_len;
char* bos;
uint32_t strs_len;
struct vusb_connect_string_descriptor strs[0];
} __attribute__((packed));
static const char default_string[] = {
8, USB_DT_STRING,
's', 0, 'y', 0, 'z', 0
};
static const char default_lang_id[] = {
4, USB_DT_STRING,
0x09, 0x04
};
static bool lookup_connect_response_in(int fd, const struct vusb_connect_descriptors* descs,
const struct usb_ctrlrequest* ctrl,
char** response_data, uint32_t* response_length)
{
struct usb_device_index* index = lookup_usb_index(fd);
uint8_t str_idx;
if (!index)
return false;
switch (ctrl->bRequestType & USB_TYPE_MASK) {
case USB_TYPE_STANDARD:
switch (ctrl->bRequest) {
case USB_REQ_GET_DESCRIPTOR:
switch (ctrl->wValue >> 8) {
case USB_DT_DEVICE:
*response_data = (char*)index->dev;
*response_length = sizeof(*index->dev);
return true;
case USB_DT_CONFIG:
*response_data = (char*)index->config;
*response_length = index->config_length;
return true;
case USB_DT_STRING:
str_idx = (uint8_t)ctrl->wValue;
if (descs && str_idx < descs->strs_len) {
*response_data = descs->strs[str_idx].str;
*response_length = descs->strs[str_idx].len;
return true;
}
if (str_idx == 0) {
*response_data = (char*)&default_lang_id[0];
*response_length = default_lang_id[0];
return true;
}
*response_data = (char*)&default_string[0];
*response_length = default_string[0];
return true;
case USB_DT_BOS:
*response_data = descs->bos;
*response_length = descs->bos_len;
return true;
case USB_DT_DEVICE_QUALIFIER:
if (!descs->qual) {
struct usb_qualifier_descriptor* qual =
(struct usb_qualifier_descriptor*)response_data;
qual->bLength = sizeof(*qual);
qual->bDescriptorType = USB_DT_DEVICE_QUALIFIER;
qual->bcdUSB = index->dev->bcdUSB;
qual->bDeviceClass = index->dev->bDeviceClass;
qual->bDeviceSubClass = index->dev->bDeviceSubClass;
qual->bDeviceProtocol = index->dev->bDeviceProtocol;
qual->bMaxPacketSize0 = index->dev->bMaxPacketSize0;
qual->bNumConfigurations = index->dev->bNumConfigurations;
qual->bRESERVED = 0;
*response_length = sizeof(*qual);
return true;
}
*response_data = descs->qual;
*response_length = descs->qual_len;
return true;
default:
break;
}
break;
default:
break;
}
break;
default:
break;
}
return false;
}
typedef bool (*lookup_connect_out_response_t)(int fd, const struct vusb_connect_descriptors* descs,
const struct usb_ctrlrequest* ctrl, bool* done);
static bool lookup_connect_response_out_generic(int fd, const struct vusb_connect_descriptors* descs,
const struct usb_ctrlrequest* ctrl, bool* done)
{
switch (ctrl->bRequestType & USB_TYPE_MASK) {
case USB_TYPE_STANDARD:
switch (ctrl->bRequest) {
case USB_REQ_SET_CONFIGURATION:
*done = true;
return true;
default:
break;
}
break;
}
return false;
}
/* -------------------------------------------------------------------------- */
static int vhci_open(void)
{
return open("/dev/vhci", O_RDWR);
}
static int vhci_setport(int fd, u_int port)
{
struct vhci_ioc_set_port args;
args.port = port;
return ioctl(fd, VHCI_IOC_SET_PORT, &args);
}
static int vhci_usb_attach(int fd)
{
return ioctl(fd, VHCI_IOC_USB_ATTACH, NULL);
}
static int vhci_usb_recv(int fd, void* buf, size_t size)
{
uint8_t_t* ptr = (uint8_t_t*)buf;
ssize_t done;
while (1) {
done = read(fd, ptr, size);
if (done < 0)
return -1;
if ((size_t)done == size)
return 0;
size -= done;
ptr += done;
}
}
static int vhci_usb_send(int fd, void* buf, size_t size)
{
uint8_t_t* ptr = (uint8_t_t*)buf;
ssize_t done;
while (1) {
done = write(fd, ptr, size);
if (done <= 0)
return -1;
if ((size_t)done == size)
return 0;
size -= done;
ptr += done;
}
}
/* -------------------------------------------------------------------------- */
static volatile long syz_usb_connect_impl(uint64_t speed, uint64_t dev_len,
const char* dev, const struct vusb_connect_descriptors* descs,
lookup_connect_out_response_t lookup_connect_response_out)
{
struct usb_device_index* index;
int portnum, fd, rv;
bool done;
portnum = procid + 1;
if (!dev) {
return -1;
}
if (portnum != 1) {
/* For now, we support only one proc. */
return -1;
}
fd = vhci_open();
if (fd < 0) {
return -1;
}
index = add_usb_index(fd, dev, dev_len);
if (!index) {
goto err;
}
rv = vhci_setport(fd, portnum);
if (rv != 0) {
goto err;
}
rv = vhci_usb_attach(fd);
if (rv != 0) {
goto err;
}
done = false;
while (!done) {
vhci_request_t req;
rv = vhci_usb_recv(fd, &req, sizeof(req));
if (rv != 0) {
goto err;
}
if (req.type != VHCI_REQ_CTRL) {
goto err;
}
char* response_data = NULL;
uint32_t response_length = 0;
char data[4096];
if (req.u.ctrl.bmRequestType & UE_DIR_IN) {
bool response_found = false;
response_found = lookup_connect_response_in(fd, descs, (const usb_ctrlrequest*)&req.u.ctrl, &response_data, &response_length);
if (!response_found) {
goto err;
}
} else {
if (!lookup_connect_response_out(fd, descs, (const usb_ctrlrequest*)&req.u.ctrl, &done)) {
goto err;
}
response_data = NULL;
response_length = UGETW(req.u.ctrl.wLength);
}
if ((req.u.ctrl.bmRequestType & USB_TYPE_MASK) == USB_TYPE_STANDARD &&
req.u.ctrl.bRequest == USB_REQ_SET_CONFIGURATION) {
/* TODO: possibly revisit */
}
if (response_length > sizeof(data))
response_length = 0;
if ((uint32_t_t)UGETW(req.u.ctrl.wLength) < response_length)
response_length = UGETW(req.u.ctrl.wLength);
if (response_data)
memcpy(data, response_data, response_length);
else
memset(data, 0, response_length);
if (req.u.ctrl.bmRequestType & UE_DIR_IN) {
if (response_length > 0) {
vhci_response_t res;
res.size = response_length;
rv = vhci_usb_send(fd, &res, sizeof(res));
if (rv == 0)
rv = vhci_usb_send(fd, data, response_length);
}
} else {
rv = vhci_usb_recv(fd, data, response_length);
}
if (rv < 0) {
goto err;
}
}
sleep_ms(200);
return fd;
err:
close(fd);
return -1;
}
static volatile long syz_usb_connect(volatile long a0, volatile long a1,
volatile long a2, volatile long a3)
{
uint64_t speed = a0;
uint64_t dev_len = a1;
const char* dev = (const char*)a2;
const struct vusb_connect_descriptors* descs = (const struct vusb_connect_descriptors*)a3;
return syz_usb_connect_impl(speed, dev_len, dev, descs,
&lookup_connect_response_out_generic);
}
static volatile long syz_usb_disconnect(volatile long a0)
{
int fd = a0;
int rv = close(fd);
sleep_ms(200);
return rv;
}
static void setup_usb(void)
{
if (chmod("/dev/vhci", 0666))
exit(1);
}
static void sandbox_common()
{
if (setsid() == -1)
exit(1);
struct rlimit rlim;
rlim.rlim_cur = rlim.rlim_max = 8 << 20;
setrlimit(RLIMIT_MEMLOCK, &rlim);
rlim.rlim_cur = rlim.rlim_max = 1 << 20;
setrlimit(RLIMIT_FSIZE, &rlim);
rlim.rlim_cur = rlim.rlim_max = 1 << 20;
setrlimit(RLIMIT_STACK, &rlim);
rlim.rlim_cur = rlim.rlim_max = 0;
setrlimit(RLIMIT_CORE, &rlim);
rlim.rlim_cur = rlim.rlim_max = 256;
setrlimit(RLIMIT_NOFILE, &rlim);
}
static void loop();
static int do_sandbox_none(void)
{
sandbox_common();
loop();
return 0;
}
static long syz_execute_func(volatile long text)
{
volatile long p[8] = {0};
(void)p;
asm volatile("" ::"r"(0l), "r"(1l), "r"(2l), "r"(3l), "r"(4l), "r"(5l), "r"(6l),
"r"(7l), "r"(8l), "r"(9l), "r"(10l), "r"(11l), "r"(12l), "r"(13l));
((void (*)(void))(text))();
return 0;
}
struct thread_t {
int created, call;
event_t ready, done;
};
static struct thread_t threads[16];
static void execute_call(int call);
static int running;
static void* thr(void* arg)
{
struct thread_t* th = (struct thread_t*)arg;
for (;;) {
event_wait(&th->ready);
event_reset(&th->ready);
execute_call(th->call);
__atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED);
event_set(&th->done);
}
return 0;
}
static void execute_one(void)
{
int i, call, thread;
for (call = 0; call < 16; call++) {
for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0])); thread++) {
struct thread_t* th = &threads[thread];
if (!th->created) {
th->created = 1;
event_init(&th->ready);
event_init(&th->done);
event_set(&th->done);
thread_start(thr, th);
}
if (!event_isset(&th->done))
continue;
event_reset(&th->done);
th->call = call;
__atomic_fetch_add(&running, 1, __ATOMIC_RELAXED);
event_set(&th->ready);
event_timedwait(&th->done, 45 + (call == 13 ? 3000 : 0) + (call == 14 ? 3000 : 0) + (call == 15 ? 300 : 0));
break;
}
}
for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++)
sleep_ms(1);
}
static void execute_one(void);
#define WAIT_FLAGS 0
static void loop(void)
{
int iter;
for (iter = 0;; iter++) {
char cwdbuf[32];
sprintf(cwdbuf, "./%d", iter);
if (mkdir(cwdbuf, 0777))
exit(1);
int pid = fork();
if (pid < 0)
exit(1);
if (pid == 0) {
if (chdir(cwdbuf))
exit(1);
execute_one();
exit(0);
}
int status = 0;
uint64_t start = current_time_ms();
for (;;) {
if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
break;
sleep_ms(1);
if (current_time_ms() - start < 5 * 1000)
continue;
kill_and_wait(pid, &status);
break;
}
remove_dir(cwdbuf);
}
}
#ifndef SYS_dup2
#define SYS_dup2 90
#endif
#ifndef SYS_getgid
#define SYS_getgid 47
#endif
#ifndef SYS_getgroups
#define SYS_getgroups 79
#endif
#ifndef SYS_getsockopt
#define SYS_getsockopt 118
#endif
#ifndef SYS_mmap
#define SYS_mmap 197
#endif
#ifndef SYS_semctl
#define SYS_semctl 442
#endif
#ifndef SYS_semget
#define SYS_semget 221
#endif
#ifndef SYS_seteuid
#define SYS_seteuid 183
#endif
#ifndef SYS_setregid
#define SYS_setregid 127
#endif
#ifndef SYS_stat
#define SYS_stat 439
#endif
#ifndef SYS_writev
#define SYS_writev 121
#endif
uint64_t r[7] = {0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff};
void execute_call(int call)
{
intptr_t res = 0;
switch (call) {
case 0:
res = syscall(SYS_dup2, -1, 0xffffff9c);
if (res != -1)
r[0] = res;
break;
case 1:
*(uint64_t*)0x200002c0 = 0x20000000;
memcpy((void*)0x20000000, "\x25\xc5\xf6\x76\x86\x92\xf1\x6a\x6b\x02\x33\x7b\xc5\xf2\x4e\x95\xc2\xe5\x74\xf7\xbd\x23\xda\x78\xff\x22\x41\x43\x9c\xac\xed\x12\x2e\x33\xab\x16\xd3\x77\x84\x34\x15\x78\x1f\xa5\x08\xcd\x63\x5f\x2f\xd0\x41\x13\x20\x4e\xd9\xbd\xa7\x39\x6e\x99\xa3\x8a\x2f\x10\xe9\xc7\x39\x8b\x5a\x64\xc4\x9d\x98\x66\x4b\xd1\x49\x75\xbe\x70\x76\xa8\x36\x38\xa7\xda\x30\x95\xf0\xe0\x27\xbd\x16\x1c\xcd\x5c\x99\x4f\x8b\x31\xd5\x35\xa3\xce\x4c\x57\x81\x2d\x96\x82\xf3\xeb\xb1\x0e\x05\xa7\x14\x22\x10\x51\x5b\x66\x8d\x13\x57\xd9\x1a\xaa\xbb\x6a\xd8\x8a\xed\x6b\x9f\x21\x43\xd0\x62\xe0\xb5", 141);
*(uint64_t*)0x200002c8 = 0x8d;
*(uint64_t*)0x200002d0 = 0x200000c0;
memcpy((void*)0x200000c0, "\xe8\x98\x7e\x8f\x86\x4e\x9d\x38\xb5\x56\x15\xb6\x59\xd1\x4c\xae\x9e\x91\xa9\x53\x22\x13\xff\xb4\x65\xb6\x1b", 27);
*(uint64_t*)0x200002d8 = 0x1b;
*(uint64_t*)0x200002e0 = 0x20000100;
memcpy((void*)0x20000100, "\x3f\x97\x99\x2c\x94\x0f\xba\x89\x36\xa6\xb4", 11);
*(uint64_t*)0x200002e8 = 0xb;
*(uint64_t*)0x200002f0 = 0x20000140;
memcpy((void*)0x20000140, "\xc9\x9a\xb6\x04\xeb\x2e\x44\xeb\xf7\xbf\xb7\xb0\x4c\x08\x43\x21\xa3\x0f\x43\x51\xae\xb0\x67\x6b\xb2\x1a\xef\xc3\xbc\x23\x22\xd9\x9a\x5b\x03\x4f\x88\x0a\xa2\x5d\x61\xae\x40\x76\x39\x7c\x30\x35\x7b\x22\xcc\xb7\x79\xeb\xd3\x20\x6a\xc6\x48\xfa\xb9\x08\x36\xdd\x4d\x9e\x73\xdc\x3c\x07\x72\x70\xb5\x7d\xc3\x22\x22\x84\xdd\x3c\xae\x47\x37\x95\x7d\x94\x7d\x76\x5a\x5e\x0e\x91\x9c\xbd\x3e\xf2\xd3\xd9\x52\x2a\x82\x7f\x3f\xe6\x0d\xdc", 106);
*(uint64_t*)0x200002f8 = 0x6a;
*(uint64_t*)0x20000300 = 0x200001c0;
memcpy((void*)0x200001c0, "\x2b\xc5\xa9\xfd\x6c\xc3\x45\x00\x82\x40\x5a\xb6\x07\xa0\xf5\x62\x7b\x40\x58\x9a\x69\x0a\xc5\x91\x58\xac\xf1\x0f\x2a\x1c\xc4\x61\x52\xfa\x5f\x49\x3a\x85\x99\xcc\x6e\xaa\xb5\xd9\x69\x68\xbe\xf1\xa2\x7f\x62\xda\xcf\x64\xd0\x6c\x80\xcf\xb5\xb3\x20\xb9\x77\xc9\x43\x2c\x44\x6f\xa6\xf6\x55\x14\x44\xee\x4c\x59\x98\x85\x32\x60\xd6\x5d\x2c\xb3\xc7\x78\xf4\x4f\xe2\x70\x36\x3b\x4e\xb3\x09\xe2\x4f\xc4\x77\x97\xb5\xbd\x45\x4b\xf4\xd3\xd4\x65\x6f\xa0\x78\xff\x56\xb3\x0f\x4f\x0e\x9d\x5e\x6e\x89\x43\x83\x0a\xd6\xd3\x42\x96\x8c\x22\x4f\x7c\x35\xaf\x01\xa6\x1d\x10\xe1\x55\xfe\xe7\xe0\x22\x7c\xd7\x9a\x79\x77\xb3\xf4\x03\x51\xca\x01\x83\x48\x40\xab\xba\x55\x7d\x36\xbc\x8a\x42\x08\xf9\x0d\xc5\xf5\x1e\x3f\x3d\x44\x5c\x5f\xee\xa7\x93\x68\x16\x4e\xde\xf0\x5d\x24\x74\x8c\xe9\xf0\xa5\x84\x51\xb4\x3d\x98\x91\x90\x2b\xc4\x5e\xc6\x7d\x00\xdf\x1d\xeb\x74\xe6\x5b\x29\xc0\xd0\x95\xdb\xdd\x5b\x9a\x7c", 220);
*(uint64_t*)0x20000308 = 0xdc;
syscall(SYS_writev, r[0], 0x200002c0ul, 5ul);
break;
case 2:
*(uint32_t*)0x20000340 = 0;
*(uint32_t*)0x20000344 = -1;
*(uint32_t*)0x20000348 = 0;
res = syscall(SYS_getgroups, 3ul, 0x20000340ul);
if (res != -1)
r[1] = *(uint32_t*)0x20000348;
break;
case 3:
*(uint32_t*)0x200003c0 = 0xc;
res = syscall(SYS_getsockopt, -1, 0xffff, 0x11, 0x20000380ul, 0x200003c0ul);
if (res != -1)
r[2] = *(uint32_t*)0x20000388;
break;
case 4:
syscall(SYS_setregid, r[1], r[2]);
break;
case 5:
res = syscall(SYS_semget, 0x798e2634ul + procid*4, 0ul, 0xb2603d964b180ce8ul);
if (res != -1)
r[3] = res;
break;
case 6:
memcpy((void*)0x20000400, "./file0\000", 8);
res = syscall(SYS_stat, 0x20000400ul, 0x20000440ul);
if (res != -1)
r[4] = *(uint32_t*)0x2000045c;
break;
case 7:
res = syscall(SYS_getgid);
if (res != -1)
r[5] = res;
break;
case 8:
*(uint32_t*)0x20000500 = 0xfffff834;
*(uint32_t*)0x20000504 = r[4];
*(uint32_t*)0x20000508 = r[5];
*(uint32_t*)0x2000050c = -1;
*(uint32_t*)0x20000510 = 0;
*(uint32_t*)0x20000514 = 3;
*(uint16_t*)0x20000518 = 9;
*(uint16_t*)0x2000051a = 0;
*(uint64_t*)0x20000520 = 0;
*(uint64_t*)0x20000528 = 0;
*(uint64_t*)0x20000530 = 0xfffffffffffffffd;
*(uint64_t*)0x20000538 = 0x4535;
*(uint64_t*)0x20000540 = 2;
*(uint64_t*)0x20000548 = 0;
*(uint64_t*)0x20000550 = 0;
syscall(SYS_semctl, r[3], 0ul, 1ul, 0x20000500ul);
break;
case 9:
syscall(SYS_seteuid, 0);
break;
case 10:
memcpy((void*)0x20000000, "\xbf\x5b\xc2\xc4\xdd\xcd\x9b\xaa\x7f\x7c\x66\xf9\x17\x26\xa8\xc4\x90\xf6\x91\x85\x14\x0b\x5b\x42\x51\xe8\x67\x01\xc6\xc5\xa6\x0d\x84\x80\x2d\x38\x2a\x0c\x38\xdf\x4a\x28\xfd\x84\x0d\x7e\x14\x06\xa5\xc2\xeb\x5d\x3b\x6b\xc3\x23\xbd\x49\x38\x6c\x4a\x92\x49\x50\x31\x4f\xe6\x17\xf8\xcd\x34\x37\xa4\xaa\x6d\x1c\x6d\x62\x64\x03\x09\xf9\xde\x23\x93\x99\x9b\x11\x47\x68\xd5\x10\xd7\x34\xfd\x72\xd1\x98\xb2\x61\xbd\x61\x81\x14\xbf\x3f\xa3\xe2\xfe\x84\xff\xe6\x5c\x80\xe4\x72\x12\xc4\x9e\x47\xbb\x3a\xaa\x86\x89\x46\x2f\x21\xd5\x18\x80\xd9\x7c\xb4\x45\xd3", 136);
break;
case 11:
memcpy((void*)0x200000c0, "\xc4\xa1\x84\x58\x2c\xaa\x26\x44\x0f\xae\x04\xc4\x41\x0f\x74\xab\x00\x00\x01\x00\xc4\x23\xf5\x78\x4c\xe9\x9d\x40\x44\xdf\x34\x59\x26\x41\x0f\xae\x41\x01\x64\x64\x66\x44\x0f\xe5\xb9\x4e\x9a\xb0\xc4\xc4\x22\x7d\x47\x0f\x41\x0f\x45\x7f\x56\x66\x0f\xdd\xe8", 63);
syz_execute_func(0x200000c0);
break;
case 12:
break;
case 13:
memcpy((void*)0x20000140, "\x64\xd3\x2f\x16\xeb\xd8\x17\xd0\x04\xdc\xb8\x01\x71\x82\x05\xbc\xa1\xd8\x6d\xad\x3c\xb1\x32\xa2\x86\x60\x92\x14\xb7\x39\x5a\x97\xa0\xe8\xfe\xda\x5f\xad\x02\xcc\xe9\xde\xea\x94\xd5\x5a\x75\x0c\x17\xb2\x34\x07\x50\x02\xb9\xdf\x62\x9f\xa6\x8e\x3f\x7d\xa9\x7e\x9c\x2a\x2e\x0a\x95\xd1\x5d\x35\x95\x61\xb1\x47\x74\x40\x34\x2c\xd7\x9c\x7c\xeb\xd6\xbf\x00\x8a\xcd\x1c\x7f\xf1\x46\xa6\xfe\x22\x01\x36\x61\xd8\xc8\xce\x8e\xb1\x7f\x5c\xf3\x89\x2a\xe0\x8b\xba\x46\x54\x5b\x2b\x69\x0a\xb7\xe0\x36\x8a\xec\x4d\x32\xb7\x6d\x7f\xc1\x5d\xd7\xc2\xab\xa1\x84\xd4\x1a\x5e\x5a\xbb\x8d\x71\x6f\x5e\x64\x5e\x17\x67\x13\x8e\xd7\x38\xf3\x15\x79\x5a\xc9\x9e\x22\xfd\x44\xdb\x06\x09\x63\x13\xf4\x72\x9c\xe0\xd3\xbd\x93\x8f\x5b\x65\x20\xef\x93\x76\xfa\x90\x9d\xf6\xb2\x05\xc2\xd3\xf5\x2e\xe4\x3e\x3f\x59\xea\x44\x1b\x7c\x4e\x4d\x5c", 201);
memcpy((void*)0x20000240, "\xc1\xb0\x1d\x40\x73\x99\x35\xb1\x21\x7d\x0e\x39\x3c\xdd\x4f\xa4\xef\x8b\xbd\x99\x57\xee\x99\x68\x77\xe4\xca\x15\x5c\x19\x5d\xc1\x66\xf9\x48\x6a\xc4\xdb\x17\xf7\x54\xc4\x89\x38\xa4\x34\x19\xf0\x82\xa8\xc3\x0e\xff\xbe\xf0\x64\xf6\xc8\xb8\x7b\xc9\x30\xe4\x39\xc7\x19\xec\x0a\x11\x99\x04\x0b\x86\x28\x6d\x27\x1f\x25\xaf\x26\xeb\xed\x3f\x55\xc3\x2e\x68\xac\x70\x33\x0d\xf7\x69\x31\xbf\x55\xfa\xe8\x80\x25\x6b\x74\xa9\x23\xf8\xa3\x02\x2c\x31\x0f\x94\xcc\x0c\x62\x33\x02\xa5\xd1\x4b\x3f\x8e\x18\xf4\x15\x99\x88\x28\x66\xea\x02\x42\x86\x4b\x37\xd5\xae\x87\xfb\xcb\x74\x5c\x3e\x26\x42\x3d\x05\xc5\x48\x38\x33\xdf\xcd\xd4\x3d\xc0\xc6\x50\x73\x29\x03\x72\x73\xde\x28\x2e\x3a\x16\xac\x00\xc5\x53\x9c\x30\x94\x63\x98\x4b\x15\x3e\xc6\x25\x0a\x78\x19\x75\xa2\x77\x01\x72\x80\xdb\x1e\x9c\x18\xce\x66\x4d\xf5\x94\x7c\x6c\x18\xbe\xf2\x36\x7e\x61\x63\xb4\x6b\x95\x03\xf7\x00\x70\x5f\xd0\xe8\x9e\xae\x6d\xf0\x88\x4b\xf2\x7c\x00\xe0\x5f\xc5\xef\xc6\x49\x07", 234);
syz_usb_connect(0, 0xc9, 0x20000140, 0x20000240);
break;
case 14:
memcpy((void*)0x20000340, "\x36\x4f\xb1\xa4\x17\x26\x3d\xe2\x27\x97\xec\x76\x08\x61\xf3\x85\x2c\xf2\x4f\x79\xe2\xb7\xa5\xc6\x2a\xfa\xd7\xd6\xd4\xd0\x9d\x86\x2f\x8e\xcc\xd0\x2e\x1b\xb9\x89\xe0\xf8\xa8\xad\x91\x54\x42\x01\x64\x04\xc9\x82\x6a\x5c\x0a\x28\x4f\xc7\xa8\x40\x30\x47\x59\xb6\x84\xf3\x57\xb2\xe6\xfe\xcf\xb3\xcc\x81\x57\xc0\x08\xff\x0d\xcf\xf2\x10\x89\x84\x54\x8a\x2a\xd6\x95\xfa\xd9\x51\x2f\x06\xfd\x12\xd6\x6b\xc4\x43\x04\x75\x12\xab\x4e\xf3\x05\x8a\xe6\xc0\xc6\xec\x3f\xd6\x27\xe3\x70\xa1\x51\xae\x71\x9b\x8e\x3a\x77\xd6\x82\xdc\x06\xa9\x3b\xe9\xc2\xaa\x80\x18\xb5\x8a\x94\x92\xcb\x39\x03\x1b\xb5\xab\xf3\x12\x4e\xaa\xb8\x53\x30\xf1\x81\xfc\xcc\xa7\x59\x7b\x4e\xc0\x87\x9f\xcb\xcf\x51\x14\x3f\x98\xc4\x43\xc1\x67\x20\xa6\xe0\x1b\x7e\x07\xdf\x47\x27\xe2\x88\xe1\x3d\xcc\x0b\x7e\x11", 191);
memcpy((void*)0x20000400, "\x59\x03\x92\x3c\x7a\x1b\x28\x38\xf3\xc1\x21\x56\x78\x5a\x11\xc8\x1b\x2e\x82\xd9\xa1\x19\x0e\x1b\x9c\x45\x97\x6a\x91\x7c\x00\x29\x4d\xc9\x4d\x53\x54\xe8\xc5\xd6\xa4\xe8\x98\x6d\xa0\x74\xeb\x46\x1e\xd0\x73\x6b\xcb\xed\xe2\xce\xf1\xf1\x9e\x02\x16\xc0\x9e\xb7\x94\xd8\xb9\x75\x4f\xea\x26\xf1\x10\xc8\x32\x48\xc2\x86\xea\xa0\x5a\x69\x84\x4e\xb1\x29\x2f\x59\x4f\x59\xf6\xc9\xbe\xca\x47\xd8\x94\xd4\x4d\xfd\x15\xff\x81\xb7\x6b\x46\x35\x39\x2e\xb5\xed\x43\x1c\xa3\x09\x22\x30", 117);
res = syz_usb_connect(4, 0xbf, 0x20000340, 0x20000400);
if (res != -1)
r[6] = res;
break;
case 15:
syz_usb_disconnect(r[6]);
break;
}
}
int main(void)
{
syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 3ul, 0x1012ul, -1, 0ul, 0ul);
for (procid = 0; procid < 4; procid++) {
if (fork() == 0) {
use_temporary_dir();
do_sandbox_none();
}
}
sleep(1000000);
return 0;
}
<stdin>:187:2: error: unknown type name 'uint8_t_t'
<stdin>:188:2: error: unknown type name 'uint8_t_t'
<stdin>:189:2: error: unknown type name 'uint8_t_t'
<stdin>:190:2: error: unknown type name 'uint8_t_t'
<stdin>:191:2: error: unknown type name 'uint16_t_t'
<stdin>:192:2: error: unknown type name 'uint8_t_t'
<stdin>:193:2: error: unknown type name 'uint8_t_t'
<stdin>:194:2: error: unknown type name 'uint8_t_t'
<stdin>:198:2: error: unknown type name 'uint8_t_t'
<stdin>:199:2: error: unknown type name 'uint8_t_t'
<stdin>:200:2: error: unknown type name 'uint16_t_t'
<stdin>:201:2: error: unknown type name 'uint8_t_t'
<stdin>:202:2: error: unknown type name 'uint8_t_t'
<stdin>:203:2: error: unknown type name 'uint8_t_t'
<stdin>:204:2: error: unknown type name 'uint8_t_t'
<stdin>:205:2: error: unknown type name 'uint16_t_t'
<stdin>:206:2: error: unknown type name 'uint16_t_t'
<stdin>:207:2: error: unknown type name 'uint16_t_t'
<stdin>:208:2: error: unknown type name 'uint8_t_t'
<stdin>:209:2: error: unknown type name 'uint8_t_t'
<stdin>:210:2: error: unknown type name 'uint8_t_t'
<stdin>:211:2: error: unknown type name 'uint8_t_t'
<stdin>:215:2: error: unknown type name 'uint8_t_t'
<stdin>:216:2: error: unknown type name 'uint8_t_t'
<stdin>:217:2: error: unknown type name 'uint16_t_t'
<stdin>:218:2: error: unknown type name 'uint8_t_t'
<stdin>:219:2: error: unknown type name 'uint8_t_t'
<stdin>:220:2: error: unknown type name 'uint8_t_t'
<stdin>:221:2: error: unknown type name 'uint8_t_t'
<stdin>:222:2: error: unknown type name 'uint8_t_t'
<stdin>:226:2: error: unknown type name 'uint8_t_t'
<stdin>:227:2: error: unknown type name 'uint8_t_t'
<stdin>:228:2: error: unknown type name 'uint8_t_t'
<stdin>:229:2: error: unknown type name 'uint8_t_t'
<stdin>:230:2: error: unknown type name 'uint8_t_t'
<stdin>:231:2: error: unknown type name 'uint8_t_t'
<stdin>:232:2: error: unknown type name 'uint8_t_t'
<stdin>:233:2: error: unknown type name 'uint8_t_t'
<stdin>:234:2: error: unknown type name 'uint8_t_t'
<stdin>:238:2: error: unknown type name 'uint8_t_t'
<stdin>:239:2: error: unknown type name 'uint8_t_t'
<stdin>:240:2: error: unknown type name 'uint16_t_t'
<stdin>:241:2: error: unknown type name 'uint16_t_t'
<stdin>:242:2: error: unknown type name 'uint16_t_t'
<stdin>:246:2: error: unknown type name 'uint8_t_t'
<stdin>:247:2: error: unknown type name 'uint8_t_t'
<stdin>:248:2: error: unknown type name 'uint16_t_t'
<stdin>:249:2: error: unknown type name 'uint8_t_t'
<stdin>:250:2: error: unknown type name 'uint8_t_t'
<stdin>:251:2: error: unknown type name 'uint8_t_t'
<stdin>:252:2: error: unknown type name 'uint8_t_t'
<stdin>:253:2: error: unknown type name 'uint8_t_t'
<stdin>:254:2: error: unknown type name 'uint8_t_t'
<stdin>: In function 'vhci_usb_recv':
<stdin>:561:2: error: unknown type name 'uint8_t_t'; did you mean 'uint8_t'?
<stdin>:561:20: error: 'uint8_t_t' undeclared (first use in this function); did you mean 'uint8_t'?
<stdin>:561:20: note: each undeclared identifier is reported only once for each function it appears in
<stdin>:561:30: error: expected expression before ')' token
<stdin>: In function 'vhci_usb_send':
<stdin>:576:2: error: unknown type name 'uint8_t_t'; did you mean 'uint8_t'?
<stdin>:576:20: error: 'uint8_t_t' undeclared (first use in this function); did you mean 'uint8_t'?
<stdin>:576:30: error: expected expression before ')' token
<stdin>: In function 'syz_usb_connect_impl':
<stdin>:637:63: error: unknown type name 'usb_ctrlrequest'
<stdin>:642:55: error: unknown type name 'usb_ctrlrequest'
<stdin>:654:8: error: 'uint32_t_t' undeclared (first use in this function); did you mean 'uint32_t'?
At top level:
<stdin>:702:13: error: 'setup_usb' defined but not used [-Werror=unused-function]
cc1: all warnings being treated as errors
compiler invocation: /syzkaller/netbsd/src/../tools/bin/x86_64--netbsd-g++ [-o /tmp/syz-executor420238871 -DGOOS_netbsd=1 -DGOARCH_amd64=1 -DHOSTGOOS_linux=1 -x c - -m64 --sysroot /syzkaller/netbsd/src/../dest/ -O2 -pthread -Wall -Werror -Wparentheses -Wframe-larger-than=16384]
FAIL
FAIL github.com/google/syzkaller/pkg/csource 4.520s
ok github.com/google/syzkaller/pkg/db (cached)
ok github.com/google/syzkaller/pkg/email (cached)
? github.com/google/syzkaller/pkg/gce [no test files]
? github.com/google/syzkaller/pkg/gcs [no test files]
? github.com/google/syzkaller/pkg/hash [no test files]
ok github.com/google/syzkaller/pkg/host 8.586s
? github.com/google/syzkaller/pkg/html [no test files]
ok github.com/google/syzkaller/pkg/ifuzz (cached)
? github.com/google/syzkaller/pkg/ifuzz/gen [no test files]
? github.com/google/syzkaller/pkg/ifuzz/generated [no test files]
ok github.com/google/syzkaller/pkg/instance 2.900s
ok github.com/google/syzkaller/pkg/ipc 7.646s
? github.com/google/syzkaller/pkg/ipc/ipcconfig [no test files]
ok github.com/google/syzkaller/pkg/kd (cached)
ok github.com/google/syzkaller/pkg/log (cached)
ok github.com/google/syzkaller/pkg/mgrconfig 2.142s
ok github.com/google/syzkaller/pkg/osutil (cached)
ok github.com/google/syzkaller/pkg/report 7.033s
ok github.com/google/syzkaller/pkg/repro 3.691s
? github.com/google/syzkaller/pkg/rpctype [no test files]
ok github.com/google/syzkaller/pkg/runtest 12.761s
ok github.com/google/syzkaller/pkg/serializer (cached)
? github.com/google/syzkaller/pkg/signal [no test files]
ok github.com/google/syzkaller/pkg/symbolizer 0.340s
ok github.com/google/syzkaller/pkg/vcs 5.800s
ok github.com/google/syzkaller/prog 10.261s
ok github.com/google/syzkaller/prog/test (cached)
? github.com/google/syzkaller/sys [no test files]
? github.com/google/syzkaller/sys/akaros [no test files]
? github.com/google/syzkaller/sys/akaros/gen [no test files]
? github.com/google/syzkaller/sys/freebsd [no test files]
? github.com/google/syzkaller/sys/freebsd/gen [no test files]
? github.com/google/syzkaller/sys/fuchsia [no test files]
? github.com/google/syzkaller/sys/fuchsia/fidlgen [no test files]
? github.com/google/syzkaller/sys/fuchsia/gen [no test files]
? github.com/google/syzkaller/sys/fuchsia/layout [no test files]
ok github.com/google/syzkaller/sys/linux 0.250s
? github.com/google/syzkaller/sys/linux/gen [no test files]
? github.com/google/syzkaller/sys/netbsd [no test files]
? github.com/google/syzkaller/sys/netbsd/gen [no test files]
ok github.com/google/syzkaller/sys/openbsd (cached)
? github.com/google/syzkaller/sys/openbsd/gen [no test files]
? github.com/google/syzkaller/sys/syz-extract [no test files]
? github.com/google/syzkaller/sys/syz-sysgen [no test files]
? github.com/google/syzkaller/sys/targets [no test files]
? github.com/google/syzkaller/sys/test [no test files]
? github.com/google/syzkaller/sys/test/gen [no test files]
? github.com/google/syzkaller/sys/trusty [no test files]
? github.com/google/syzkaller/sys/trusty/gen [no test files]
? github.com/google/syzkaller/sys/windows [no test files]
? github.com/google/syzkaller/sys/windows/gen [no test files]
ok github.com/google/syzkaller/syz-ci 4.137s
ok github.com/google/syzkaller/syz-fuzzer 1.334s
ok github.com/google/syzkaller/syz-hub 1.925s
ok github.com/google/syzkaller/syz-hub/state (cached)
? github.com/google/syzkaller/syz-manager [no test files]
? github.com/google/syzkaller/tools/syz-benchcmp [no test files]
? github.com/google/syzkaller/tools/syz-bisect [no test files]
? github.com/google/syzkaller/tools/syz-check [no test files]
? github.com/google/syzkaller/tools/syz-cover [no test files]
? github.com/google/syzkaller/tools/syz-crush [no test files]
? github.com/google/syzkaller/tools/syz-db [no test files]
? github.com/google/syzkaller/tools/syz-execprog [no test files]
? github.com/google/syzkaller/tools/syz-expand [no test files]
? github.com/google/syzkaller/tools/syz-fmt [no test files]
? github.com/google/syzkaller/tools/syz-imagegen [no test files]
? github.com/google/syzkaller/tools/syz-make [no test files]
? github.com/google/syzkaller/tools/syz-mutate [no test files]
? github.com/google/syzkaller/tools/syz-prog2c [no test files]
? github.com/google/syzkaller/tools/syz-repro [no test files]
? github.com/google/syzkaller/tools/syz-reprolist [no test files]
? github.com/google/syzkaller/tools/syz-runtest [no test files]
? github.com/google/syzkaller/tools/syz-showprio [no test files]
? github.com/google/syzkaller/tools/syz-stress [no test files]
? github.com/google/syzkaller/tools/syz-symbolize [no test files]
? github.com/google/syzkaller/tools/syz-testbuild [no test files]
? github.com/google/syzkaller/tools/syz-trace2syz [no test files]
ok github.com/google/syzkaller/tools/syz-trace2syz/parser 1.609s
ok github.com/google/syzkaller/tools/syz-trace2syz/proggen 2.249s
? github.com/google/syzkaller/tools/syz-tty [no test files]
? github.com/google/syzkaller/tools/syz-upgrade [no test files]
? github.com/google/syzkaller/tools/syz-usbgen [no test files]
ok github.com/google/syzkaller/vm 13.324s
? github.com/google/syzkaller/vm/adb [no test files]
? github.com/google/syzkaller/vm/bhyve [no test files]
? github.com/google/syzkaller/vm/gce [no test files]
? github.com/google/syzkaller/vm/gvisor [no test files]
ok github.com/google/syzkaller/vm/isolated (cached)
? github.com/google/syzkaller/vm/kvm [no test files]
? github.com/google/syzkaller/vm/odroid [no test files]
? github.com/google/syzkaller/vm/qemu [no test files]
ok github.com/google/syzkaller/vm/vmimpl (cached)
? github.com/google/syzkaller/vm/vmm [no test files]