ok github.com/google/syzkaller/dashboard/app 0.228s ? github.com/google/syzkaller/dashboard/dashapi [no test files] ? github.com/google/syzkaller/executor [no test files] ok github.com/google/syzkaller/pkg/ast 1.852s ok github.com/google/syzkaller/pkg/bisect 11.808s ok github.com/google/syzkaller/pkg/build 6.331s ? github.com/google/syzkaller/pkg/cmdprof [no test files] ok github.com/google/syzkaller/pkg/compiler 4.096s ok github.com/google/syzkaller/pkg/config (cached) ? github.com/google/syzkaller/pkg/cover [no test files] --- FAIL: TestGenerate (1.67s) --- FAIL: TestGenerate/netbsd/amd64 (0.09s) csource_test.go:67: seed=1590025326657750258 --- FAIL: TestGenerate/netbsd/amd64/0 (0.76s) csource_test.go:123: opts: {Threaded:false Collide:false Repeat:true RepeatTimes:0 Procs:0 Sandbox:none Fault:false FaultCall:0 FaultNth:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false USB:false UseTmpDir:true HandleSegv:false Repro:false Trace:false} program: r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c) writev(r0, &(0x7f00000002c0)=[{&(0x7f0000000000)="25c5f6768692f16a6b02337bc5f24e95c2e574f7bd23da78ff2241439caced122e33ab16d377843415781fa508cd635f2fd04113204ed9bda7396e99a38a2f10e9c7398b5a64c49d98664bd14975be7076a83638a7da3095f0e027bd161ccd5c994f8b31d535a3ce4c57812d9682f3ebb10e05a7142210515b668d1357d91aaabb6ad88aed6b9f2143d062e0b5", 0x8d}, {&(0x7f00000000c0)="e8987e8f864e9d38b55615b659d14cae9e91a9532213ffb465b61b", 0x1b}, {&(0x7f0000000100)="3f97992c940fba8936a6b4", 0xb}, {&(0x7f0000000140)="c99ab604eb2e44ebf7bfb7b04c084321a30f4351aeb0676bb21aefc3bc2322d99a5b034f880aa25d61ae4076397c30357b22ccb779ebd3206ac648fab90836dd4d9e73dc3c077270b57dc3222284dd3cae4737957d947d765a5e0e919cbd3ef2d3d9522a827f3fe60ddc", 0x6a}, {&(0x7f00000001c0)="2bc5a9fd6cc3450082405ab607a0f5627b40589a690ac59158acf10f2a1cc46152fa5f493a8599cc6eaab5d96968bef1a27f62dacf64d06c80cfb5b320b977c9432c446fa6f6551444ee4c5998853260d65d2cb3c778f44fe270363b4eb309e24fc47797b5bd454bf4d3d4656fa078ff56b30f4f0e9d5e6e8943830ad6d342968c224f7c35af01a61d10e155fee7e0227cd79a7977b3f40351ca01834840abba557d36bc8a4208f90dc5f51e3f3d445c5feea79368164edef05d24748ce9f0a58451b43d9891902bc45ec67d00df1deb74e65b29c0d095dbdd5b9a7c", 0xdc}], 0x5) getgroups(0x3, &(0x7f0000000340)=[0x0, 0xffffffffffffffff, 0x0]) getsockopt$sock_cred(0xffffffffffffffff, 0xffff, 0x11, &(0x7f0000000380)={0x0, 0x0, 0x0}, &(0x7f00000003c0)=0xc) setregid(r1, r2) r3 = semget(0x1, 0x0, 0xb2603d964b180ce8) stat(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0}) r5 = getgid() semctl$IPC_SET(r3, 0x0, 0x1, &(0x7f0000000500)={{0xfffff834, r4, r5, 0xffffffffffffffff, 0x0, 0x3, 0x9}, 0xfffffffffffffffd, 0x4535, 0x2}) seteuid(0x0) syz_emit_ethernet(0x88, &(0x7f0000000000)="bf5bc2c4ddcd9baa7f7c66f91726a8c490f69185140b5b4251e86701c6c5a60d84802d382a0c38df4a28fd840d7e1406a5c2eb5d3b6bc323bd49386c4a924950314fe617f8cd3437a4aa6d1c6d62640309f9de2393999b114768d510d734fd72d198b261bd618114bf3fa3e2fe84ffe65c80e47212c49e47bb3aaa8689462f21d51880d97cb445d3") syz_execute_func(&(0x7f00000000c0)="c4a184582caa26440fae04c4410f74ab00000100c423f5784ce99d4044df345926410fae4101646466440fe5b94e9ab0c4c4227d470f410f457f56660fdde8") syz_extract_tcp_res(&(0x7f0000000100), 0x6, 0x1) syz_usb_connect(0x0, 0xc9, &(0x7f0000000140)="64d32f16ebd817d004dcb801718205bca1d86dad3cb132a286609214b7395a97a0e8feda5fad02cce9deea94d55a750c17b234075002b9df629fa68e3f7da97e9c2a2e0a95d15d359561b1477440342cd79c7cebd6bf008acd1c7ff146a6fe22013661d8c8ce8eb17f5cf3892ae08bba46545b2b690ab7e0368aec4d32b76d7fc15dd7c2aba184d41a5e5abb8d716f5e645e1767138ed738f315795ac99e22fd44db06096313f4729ce0d3bd938f5b6520ef9376fa909df6b205c2d3f52ee43e3f59ea441b7c4e4d5c", &(0x7f0000000240)="c1b01d40739935b1217d0e393cdd4fa4ef8bbd9957ee996877e4ca155c195dc166f9486ac4db17f754c48938a43419f082a8c30effbef064f6c8b87bc930e439c719ec0a1199040b86286d271f25af26ebed3f55c32e68ac70330df76931bf55fae880256b74a923f8a3022c310f94cc0c623302a5d14b3f8e18f41599882866ea0242864b37d5ae87fbcb745c3e26423d05c5483833dfcdd43dc0c6507329037273de282e3a16ac00c5539c309463984b153ec6250a781975a277017280db1e9c18ce664df5947c6c18bef2367e6163b46b9503f700705fd0e89eae6df0884bf27c00e05fc5efc64907") r6 = syz_usb_connect(0x4, 0xbf, &(0x7f0000000340)="364fb1a417263de22797ec760861f3852cf24f79e2b7a5c62afad7d6d4d09d862f8eccd02e1bb989e0f8a8ad915442016404c9826a5c0a284fc7a840304759b684f357b2e6fecfb3cc8157c008ff0dcff2108984548a2ad695fad9512f06fd12d66bc443047512ab4ef3058ae6c0c6ec3fd627e370a151ae719b8e3a77d682dc06a93be9c2aa8018b58a9492cb39031bb5abf3124eaab85330f181fccca7597b4ec0879fcbcf51143f98c443c16720a6e01b7e07df4727e288e13dcc0b7e11", &(0x7f0000000400)="5903923c7a1b2838f3c12156785a11c81b2e82d9a1190e1b9c45976a917c00294dc94d5354e8c5d6a4e8986da074eb461ed0736bcbede2cef1f19e0216c09eb794d8b9754fea26f110c83248c286eaa05a69844eb1292f594f59f6c9beca47d894d44dfd15ff81b76b4635392eb5ed431ca3092230") syz_usb_disconnect(r6) csource_test.go:124: failed to build program: // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include static unsigned long long procid; static void kill_and_wait(int pid, int* status) { kill(pid, SIGKILL); while (waitpid(-1, status, 0) != pid) { } } static void sleep_ms(uint64_t ms) { usleep(ms * 1000); } static uint64_t current_time_ms(void) { struct timespec ts; if (clock_gettime(CLOCK_MONOTONIC, &ts)) exit(1); return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; } static void use_temporary_dir(void) { char tmpdir_template[] = "./syzkaller.XXXXXX"; char* tmpdir = mkdtemp(tmpdir_template); if (!tmpdir) exit(1); if (chmod(tmpdir, 0777)) exit(1); if (chdir(tmpdir)) exit(1); } static void remove_dir(const char* dir) { DIR* dp; struct dirent* ep; dp = opendir(dir); if (dp == NULL) exit(1); while ((ep = readdir(dp))) { if (strcmp(ep->d_name, ".") == 0 || strcmp(ep->d_name, "..") == 0) continue; char filename[FILENAME_MAX]; snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name); struct stat st; if (lstat(filename, &st)) exit(1); if (S_ISDIR(st.st_mode)) { remove_dir(filename); continue; } if (unlink(filename)) exit(1); } closedir(dp); if (rmdir(dir)) exit(1); } /* -------------------------------------------------------------------------- */ /* * Redefinitions to match the linux types used in common_usb.h. */ struct usb_endpoint_descriptor { uint8_t_t bLength; uint8_t_t bDescriptorType; uint8_t_t bEndpointAddress; uint8_t_t bmAttributes; uint16_t_t wMaxPacketSize; uint8_t_t bInterval; uint8_t_t bRefresh; uint8_t_t bSynchAddress; } __attribute__((packed)); struct usb_device_descriptor { uint8_t_t bLength; uint8_t_t bDescriptorType; uint16_t_t bcdUSB; uint8_t_t bDeviceClass; uint8_t_t bDeviceSubClass; uint8_t_t bDeviceProtocol; uint8_t_t bMaxPacketSize0; uint16_t_t idVendor; uint16_t_t idProduct; uint16_t_t bcdDevice; uint8_t_t iManufacturer; uint8_t_t iProduct; uint8_t_t iSerialNumber; uint8_t_t bNumConfigurations; } __attribute__((packed)); struct usb_config_descriptor { uint8_t_t bLength; uint8_t_t bDescriptorType; uint16_t_t wTotalLength; uint8_t_t bNumInterfaces; uint8_t_t bConfigurationValue; uint8_t_t iConfiguration; uint8_t_t bmAttributes; uint8_t_t bMaxPower; } __attribute__((packed)); struct usb_interface_descriptor { uint8_t_t bLength; uint8_t_t bDescriptorType; uint8_t_t bInterfaceNumber; uint8_t_t bAlternateSetting; uint8_t_t bNumEndpoints; uint8_t_t bInterfaceClass; uint8_t_t bInterfaceSubClass; uint8_t_t bInterfaceProtocol; uint8_t_t iInterface; } __attribute__((packed)); struct usb_ctrlrequest { uint8_t_t bRequestType; uint8_t_t bRequest; uint16_t_t wValue; uint16_t_t wIndex; uint16_t_t wLength; } __attribute__((packed)); struct usb_qualifier_descriptor { uint8_t_t bLength; uint8_t_t bDescriptorType; uint16_t_t bcdUSB; uint8_t_t bDeviceClass; uint8_t_t bDeviceSubClass; uint8_t_t bDeviceProtocol; uint8_t_t bMaxPacketSize0; uint8_t_t bNumConfigurations; uint8_t_t bRESERVED; } __attribute__((packed)); #define USB_TYPE_MASK (0x03 << 5) #define USB_TYPE_STANDARD (0x00 << 5) #define USB_TYPE_CLASS (0x01 << 5) #define USB_TYPE_VENDOR (0x02 << 5) #define USB_TYPE_RESERVED (0x03 << 5) #define USB_DT_DEVICE 0x01 #define USB_DT_CONFIG 0x02 #define USB_DT_STRING 0x03 #define USB_DT_INTERFACE 0x04 #define USB_DT_ENDPOINT 0x05 #define USB_DT_DEVICE_QUALIFIER 0x06 #define USB_DT_OTHER_SPEED_CONFIG 0x07 #define USB_DT_INTERFACE_POWER 0x08 #define USB_DT_OTG 0x09 #define USB_DT_DEBUG 0x0a #define USB_DT_INTERFACE_ASSOCIATION 0x0b #define USB_DT_SECURITY 0x0c #define USB_DT_KEY 0x0d #define USB_DT_ENCRYPTION_TYPE 0x0e #define USB_DT_BOS 0x0f #define USB_DT_DEVICE_CAPABILITY 0x10 #define USB_DT_WIRELESS_ENDPOINT_COMP 0x11 #define USB_DT_WIRE_ADAPTER 0x21 #define USB_DT_RPIPE 0x22 #define USB_DT_CS_RADIO_CONTROL 0x23 #define USB_DT_PIPE_USAGE 0x24 #define USB_DT_SS_ENDPOINT_COMP 0x30 #define USB_DT_SSP_ISOC_ENDPOINT_COMP 0x31 #define USB_REQ_GET_STATUS 0x00 #define USB_REQ_CLEAR_FEATURE 0x01 #define USB_REQ_SET_FEATURE 0x03 #define USB_REQ_SET_ADDRESS 0x05 #define USB_REQ_GET_DESCRIPTOR 0x06 #define USB_REQ_SET_DESCRIPTOR 0x07 #define USB_REQ_GET_CONFIGURATION 0x08 #define USB_REQ_SET_CONFIGURATION 0x09 #define USB_REQ_GET_INTERFACE 0x0A #define USB_REQ_SET_INTERFACE 0x0B #define USB_REQ_SYNCH_FRAME 0x0C #define USB_REQ_SET_SEL 0x30 #define USB_REQ_SET_ISOCH_DELAY 0x31 #define USB_REQ_SET_ENCRYPTION 0x0D #define USB_REQ_GET_ENCRYPTION 0x0E #define USB_REQ_RPIPE_ABORT 0x0E #define USB_REQ_SET_HANDSHAKE 0x0F #define USB_REQ_RPIPE_RESET 0x0F #define USB_REQ_GET_HANDSHAKE 0x10 #define USB_REQ_SET_CONNECTION 0x11 #define USB_REQ_SET_SECURITY_DATA 0x12 #define USB_REQ_GET_SECURITY_DATA 0x13 #define USB_REQ_SET_WUSB_DATA 0x14 #define USB_REQ_LOOPBACK_DATA_WRITE 0x15 #define USB_REQ_LOOPBACK_DATA_READ 0x16 #define USB_REQ_SET_INTERFACE_DS 0x17 #define USB_REQ_GET_PARTNER_PDO 20 #define USB_REQ_GET_BATTERY_STATUS 21 #define USB_REQ_SET_PDO 22 #define USB_REQ_GET_VDM 23 #define USB_REQ_SEND_VDM 24 #define USB_MAX_IFACE_NUM 4 #define USB_MAX_EP_NUM 32 #define USB_MAX_FDS 6 struct usb_endpoint_index { struct usb_endpoint_descriptor desc; int handle; }; struct usb_iface_index { struct usb_interface_descriptor* iface; uint8_t bInterfaceNumber; uint8_t bAlternateSetting; uint8_t bInterfaceClass; struct usb_endpoint_index eps[USB_MAX_EP_NUM]; int eps_num; }; struct usb_device_index { struct usb_device_descriptor* dev; struct usb_config_descriptor* config; uint8_t bDeviceClass; uint8_t bMaxPower; int config_length; struct usb_iface_index ifaces[USB_MAX_IFACE_NUM]; int ifaces_num; int iface_cur; }; struct usb_info { int fd; struct usb_device_index index; }; static struct usb_info usb_devices[USB_MAX_FDS]; static int usb_devices_num; static bool parse_usb_descriptor(const char* buffer, size_t length, struct usb_device_index* index) { if (length < sizeof(*index->dev) + sizeof(*index->config)) return false; memset(index, 0, sizeof(*index)); index->dev = (struct usb_device_descriptor*)buffer; index->config = (struct usb_config_descriptor*)(buffer + sizeof(*index->dev)); index->bDeviceClass = index->dev->bDeviceClass; index->bMaxPower = index->config->bMaxPower; index->config_length = length - sizeof(*index->dev); index->iface_cur = -1; size_t offset = 0; while (true) { if (offset + 1 >= length) break; uint8_t desc_length = buffer[offset]; uint8_t desc_type = buffer[offset + 1]; if (desc_length <= 2) break; if (offset + desc_length > length) break; if (desc_type == USB_DT_INTERFACE && index->ifaces_num < USB_MAX_IFACE_NUM) { struct usb_interface_descriptor* iface = (struct usb_interface_descriptor*)(buffer + offset); index->ifaces[index->ifaces_num].iface = iface; index->ifaces[index->ifaces_num].bInterfaceNumber = iface->bInterfaceNumber; index->ifaces[index->ifaces_num].bAlternateSetting = iface->bAlternateSetting; index->ifaces[index->ifaces_num].bInterfaceClass = iface->bInterfaceClass; index->ifaces_num++; } if (desc_type == USB_DT_ENDPOINT && index->ifaces_num > 0) { struct usb_iface_index* iface = &index->ifaces[index->ifaces_num - 1]; if (iface->eps_num < USB_MAX_EP_NUM) { memcpy(&iface->eps[iface->eps_num].desc, buffer + offset, sizeof(iface->eps[iface->eps_num].desc)); iface->eps_num++; } } offset += desc_length; } return true; } static struct usb_device_index* add_usb_index(int fd, const char* dev, size_t dev_len) { int i = __atomic_fetch_add(&usb_devices_num, 1, __ATOMIC_RELAXED); if (i >= USB_MAX_FDS) return NULL; int rv = 0; rv = parse_usb_descriptor(dev, dev_len, &usb_devices[i].index); if (!rv) return NULL; __atomic_store_n(&usb_devices[i].fd, fd, __ATOMIC_RELEASE); return &usb_devices[i].index; } static struct usb_device_index* lookup_usb_index(int fd) { int i; for (i = 0; i < USB_MAX_FDS; i++) { if (__atomic_load_n(&usb_devices[i].fd, __ATOMIC_ACQUIRE) == fd) { return &usb_devices[i].index; } } return NULL; } struct vusb_connect_string_descriptor { uint32_t len; char* str; } __attribute__((packed)); struct vusb_connect_descriptors { uint32_t qual_len; char* qual; uint32_t bos_len; char* bos; uint32_t strs_len; struct vusb_connect_string_descriptor strs[0]; } __attribute__((packed)); static const char default_string[] = { 8, USB_DT_STRING, 's', 0, 'y', 0, 'z', 0 }; static const char default_lang_id[] = { 4, USB_DT_STRING, 0x09, 0x04 }; static bool lookup_connect_response_in(int fd, const struct vusb_connect_descriptors* descs, const struct usb_ctrlrequest* ctrl, char** response_data, uint32_t* response_length) { struct usb_device_index* index = lookup_usb_index(fd); uint8_t str_idx; if (!index) return false; switch (ctrl->bRequestType & USB_TYPE_MASK) { case USB_TYPE_STANDARD: switch (ctrl->bRequest) { case USB_REQ_GET_DESCRIPTOR: switch (ctrl->wValue >> 8) { case USB_DT_DEVICE: *response_data = (char*)index->dev; *response_length = sizeof(*index->dev); return true; case USB_DT_CONFIG: *response_data = (char*)index->config; *response_length = index->config_length; return true; case USB_DT_STRING: str_idx = (uint8_t)ctrl->wValue; if (descs && str_idx < descs->strs_len) { *response_data = descs->strs[str_idx].str; *response_length = descs->strs[str_idx].len; return true; } if (str_idx == 0) { *response_data = (char*)&default_lang_id[0]; *response_length = default_lang_id[0]; return true; } *response_data = (char*)&default_string[0]; *response_length = default_string[0]; return true; case USB_DT_BOS: *response_data = descs->bos; *response_length = descs->bos_len; return true; case USB_DT_DEVICE_QUALIFIER: if (!descs->qual) { struct usb_qualifier_descriptor* qual = (struct usb_qualifier_descriptor*)response_data; qual->bLength = sizeof(*qual); qual->bDescriptorType = USB_DT_DEVICE_QUALIFIER; qual->bcdUSB = index->dev->bcdUSB; qual->bDeviceClass = index->dev->bDeviceClass; qual->bDeviceSubClass = index->dev->bDeviceSubClass; qual->bDeviceProtocol = index->dev->bDeviceProtocol; qual->bMaxPacketSize0 = index->dev->bMaxPacketSize0; qual->bNumConfigurations = index->dev->bNumConfigurations; qual->bRESERVED = 0; *response_length = sizeof(*qual); return true; } *response_data = descs->qual; *response_length = descs->qual_len; return true; default: break; } break; default: break; } break; default: break; } return false; } typedef bool (*lookup_connect_out_response_t)(int fd, const struct vusb_connect_descriptors* descs, const struct usb_ctrlrequest* ctrl, bool* done); static bool lookup_connect_response_out_generic(int fd, const struct vusb_connect_descriptors* descs, const struct usb_ctrlrequest* ctrl, bool* done) { switch (ctrl->bRequestType & USB_TYPE_MASK) { case USB_TYPE_STANDARD: switch (ctrl->bRequest) { case USB_REQ_SET_CONFIGURATION: *done = true; return true; default: break; } break; } return false; } /* -------------------------------------------------------------------------- */ static int vhci_open(void) { return open("/dev/vhci", O_RDWR); } static int vhci_setport(int fd, u_int port) { struct vhci_ioc_set_port args; args.port = port; return ioctl(fd, VHCI_IOC_SET_PORT, &args); } static int vhci_usb_attach(int fd) { return ioctl(fd, VHCI_IOC_USB_ATTACH, NULL); } static int vhci_usb_recv(int fd, void* buf, size_t size) { uint8_t_t* ptr = (uint8_t_t*)buf; ssize_t done; while (1) { done = read(fd, ptr, size); if (done < 0) return -1; if ((size_t)done == size) return 0; size -= done; ptr += done; } } static int vhci_usb_send(int fd, void* buf, size_t size) { uint8_t_t* ptr = (uint8_t_t*)buf; ssize_t done; while (1) { done = write(fd, ptr, size); if (done <= 0) return -1; if ((size_t)done == size) return 0; size -= done; ptr += done; } } /* -------------------------------------------------------------------------- */ static volatile long syz_usb_connect_impl(uint64_t speed, uint64_t dev_len, const char* dev, const struct vusb_connect_descriptors* descs, lookup_connect_out_response_t lookup_connect_response_out) { struct usb_device_index* index; int portnum, fd, rv; bool done; portnum = procid + 1; if (!dev) { return -1; } if (portnum != 1) { /* For now, we support only one proc. */ return -1; } fd = vhci_open(); if (fd < 0) { return -1; } index = add_usb_index(fd, dev, dev_len); if (!index) { goto err; } rv = vhci_setport(fd, portnum); if (rv != 0) { goto err; } rv = vhci_usb_attach(fd); if (rv != 0) { goto err; } done = false; while (!done) { vhci_request_t req; rv = vhci_usb_recv(fd, &req, sizeof(req)); if (rv != 0) { goto err; } if (req.type != VHCI_REQ_CTRL) { goto err; } char* response_data = NULL; uint32_t response_length = 0; char data[4096]; if (req.u.ctrl.bmRequestType & UE_DIR_IN) { bool response_found = false; response_found = lookup_connect_response_in(fd, descs, (const usb_ctrlrequest*)&req.u.ctrl, &response_data, &response_length); if (!response_found) { goto err; } } else { if (!lookup_connect_response_out(fd, descs, (const usb_ctrlrequest*)&req.u.ctrl, &done)) { goto err; } response_data = NULL; response_length = UGETW(req.u.ctrl.wLength); } if ((req.u.ctrl.bmRequestType & USB_TYPE_MASK) == USB_TYPE_STANDARD && req.u.ctrl.bRequest == USB_REQ_SET_CONFIGURATION) { /* TODO: possibly revisit */ } if (response_length > sizeof(data)) response_length = 0; if ((uint32_t_t)UGETW(req.u.ctrl.wLength) < response_length) response_length = UGETW(req.u.ctrl.wLength); if (response_data) memcpy(data, response_data, response_length); else memset(data, 0, response_length); if (req.u.ctrl.bmRequestType & UE_DIR_IN) { if (response_length > 0) { vhci_response_t res; res.size = response_length; rv = vhci_usb_send(fd, &res, sizeof(res)); if (rv == 0) rv = vhci_usb_send(fd, data, response_length); } } else { rv = vhci_usb_recv(fd, data, response_length); } if (rv < 0) { goto err; } } sleep_ms(200); return fd; err: close(fd); return -1; } static volatile long syz_usb_connect(volatile long a0, volatile long a1, volatile long a2, volatile long a3) { uint64_t speed = a0; uint64_t dev_len = a1; const char* dev = (const char*)a2; const struct vusb_connect_descriptors* descs = (const struct vusb_connect_descriptors*)a3; return syz_usb_connect_impl(speed, dev_len, dev, descs, &lookup_connect_response_out_generic); } static volatile long syz_usb_disconnect(volatile long a0) { int fd = a0; int rv = close(fd); sleep_ms(200); return rv; } static void setup_usb(void) { if (chmod("/dev/vhci", 0666)) exit(1); } static void sandbox_common() { if (setsid() == -1) exit(1); struct rlimit rlim; rlim.rlim_cur = rlim.rlim_max = 8 << 20; setrlimit(RLIMIT_MEMLOCK, &rlim); rlim.rlim_cur = rlim.rlim_max = 1 << 20; setrlimit(RLIMIT_FSIZE, &rlim); rlim.rlim_cur = rlim.rlim_max = 1 << 20; setrlimit(RLIMIT_STACK, &rlim); rlim.rlim_cur = rlim.rlim_max = 0; setrlimit(RLIMIT_CORE, &rlim); rlim.rlim_cur = rlim.rlim_max = 256; setrlimit(RLIMIT_NOFILE, &rlim); } static void loop(); static int do_sandbox_none(void) { sandbox_common(); loop(); return 0; } static long syz_execute_func(volatile long text) { volatile long p[8] = {0}; (void)p; asm volatile("" ::"r"(0l), "r"(1l), "r"(2l), "r"(3l), "r"(4l), "r"(5l), "r"(6l), "r"(7l), "r"(8l), "r"(9l), "r"(10l), "r"(11l), "r"(12l), "r"(13l)); ((void (*)(void))(text))(); return 0; } static void execute_one(void); #define WAIT_FLAGS 0 static void loop(void) { int iter; for (iter = 0;; iter++) { char cwdbuf[32]; sprintf(cwdbuf, "./%d", iter); if (mkdir(cwdbuf, 0777)) exit(1); int pid = fork(); if (pid < 0) exit(1); if (pid == 0) { if (chdir(cwdbuf)) exit(1); execute_one(); exit(0); } int status = 0; uint64_t start = current_time_ms(); for (;;) { if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) break; sleep_ms(1); if (current_time_ms() - start < 5 * 1000) continue; kill_and_wait(pid, &status); break; } remove_dir(cwdbuf); } } #ifndef SYS_dup2 #define SYS_dup2 90 #endif #ifndef SYS_getgid #define SYS_getgid 47 #endif #ifndef SYS_getgroups #define SYS_getgroups 79 #endif #ifndef SYS_getsockopt #define SYS_getsockopt 118 #endif #ifndef SYS_mmap #define SYS_mmap 197 #endif #ifndef SYS_semctl #define SYS_semctl 442 #endif #ifndef SYS_semget #define SYS_semget 221 #endif #ifndef SYS_seteuid #define SYS_seteuid 183 #endif #ifndef SYS_setregid #define SYS_setregid 127 #endif #ifndef SYS_stat #define SYS_stat 439 #endif #ifndef SYS_writev #define SYS_writev 121 #endif uint64_t r[7] = {0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}; void execute_one(void) { intptr_t res = 0; res = syscall(SYS_dup2, -1, 0xffffff9c); if (res != -1) r[0] = res; *(uint64_t*)0x200002c0 = 0x20000000; memcpy((void*)0x20000000, "\x25\xc5\xf6\x76\x86\x92\xf1\x6a\x6b\x02\x33\x7b\xc5\xf2\x4e\x95\xc2\xe5\x74\xf7\xbd\x23\xda\x78\xff\x22\x41\x43\x9c\xac\xed\x12\x2e\x33\xab\x16\xd3\x77\x84\x34\x15\x78\x1f\xa5\x08\xcd\x63\x5f\x2f\xd0\x41\x13\x20\x4e\xd9\xbd\xa7\x39\x6e\x99\xa3\x8a\x2f\x10\xe9\xc7\x39\x8b\x5a\x64\xc4\x9d\x98\x66\x4b\xd1\x49\x75\xbe\x70\x76\xa8\x36\x38\xa7\xda\x30\x95\xf0\xe0\x27\xbd\x16\x1c\xcd\x5c\x99\x4f\x8b\x31\xd5\x35\xa3\xce\x4c\x57\x81\x2d\x96\x82\xf3\xeb\xb1\x0e\x05\xa7\x14\x22\x10\x51\x5b\x66\x8d\x13\x57\xd9\x1a\xaa\xbb\x6a\xd8\x8a\xed\x6b\x9f\x21\x43\xd0\x62\xe0\xb5", 141); *(uint64_t*)0x200002c8 = 0x8d; *(uint64_t*)0x200002d0 = 0x200000c0; memcpy((void*)0x200000c0, "\xe8\x98\x7e\x8f\x86\x4e\x9d\x38\xb5\x56\x15\xb6\x59\xd1\x4c\xae\x9e\x91\xa9\x53\x22\x13\xff\xb4\x65\xb6\x1b", 27); *(uint64_t*)0x200002d8 = 0x1b; *(uint64_t*)0x200002e0 = 0x20000100; memcpy((void*)0x20000100, "\x3f\x97\x99\x2c\x94\x0f\xba\x89\x36\xa6\xb4", 11); *(uint64_t*)0x200002e8 = 0xb; *(uint64_t*)0x200002f0 = 0x20000140; memcpy((void*)0x20000140, "\xc9\x9a\xb6\x04\xeb\x2e\x44\xeb\xf7\xbf\xb7\xb0\x4c\x08\x43\x21\xa3\x0f\x43\x51\xae\xb0\x67\x6b\xb2\x1a\xef\xc3\xbc\x23\x22\xd9\x9a\x5b\x03\x4f\x88\x0a\xa2\x5d\x61\xae\x40\x76\x39\x7c\x30\x35\x7b\x22\xcc\xb7\x79\xeb\xd3\x20\x6a\xc6\x48\xfa\xb9\x08\x36\xdd\x4d\x9e\x73\xdc\x3c\x07\x72\x70\xb5\x7d\xc3\x22\x22\x84\xdd\x3c\xae\x47\x37\x95\x7d\x94\x7d\x76\x5a\x5e\x0e\x91\x9c\xbd\x3e\xf2\xd3\xd9\x52\x2a\x82\x7f\x3f\xe6\x0d\xdc", 106); *(uint64_t*)0x200002f8 = 0x6a; *(uint64_t*)0x20000300 = 0x200001c0; memcpy((void*)0x200001c0, "\x2b\xc5\xa9\xfd\x6c\xc3\x45\x00\x82\x40\x5a\xb6\x07\xa0\xf5\x62\x7b\x40\x58\x9a\x69\x0a\xc5\x91\x58\xac\xf1\x0f\x2a\x1c\xc4\x61\x52\xfa\x5f\x49\x3a\x85\x99\xcc\x6e\xaa\xb5\xd9\x69\x68\xbe\xf1\xa2\x7f\x62\xda\xcf\x64\xd0\x6c\x80\xcf\xb5\xb3\x20\xb9\x77\xc9\x43\x2c\x44\x6f\xa6\xf6\x55\x14\x44\xee\x4c\x59\x98\x85\x32\x60\xd6\x5d\x2c\xb3\xc7\x78\xf4\x4f\xe2\x70\x36\x3b\x4e\xb3\x09\xe2\x4f\xc4\x77\x97\xb5\xbd\x45\x4b\xf4\xd3\xd4\x65\x6f\xa0\x78\xff\x56\xb3\x0f\x4f\x0e\x9d\x5e\x6e\x89\x43\x83\x0a\xd6\xd3\x42\x96\x8c\x22\x4f\x7c\x35\xaf\x01\xa6\x1d\x10\xe1\x55\xfe\xe7\xe0\x22\x7c\xd7\x9a\x79\x77\xb3\xf4\x03\x51\xca\x01\x83\x48\x40\xab\xba\x55\x7d\x36\xbc\x8a\x42\x08\xf9\x0d\xc5\xf5\x1e\x3f\x3d\x44\x5c\x5f\xee\xa7\x93\x68\x16\x4e\xde\xf0\x5d\x24\x74\x8c\xe9\xf0\xa5\x84\x51\xb4\x3d\x98\x91\x90\x2b\xc4\x5e\xc6\x7d\x00\xdf\x1d\xeb\x74\xe6\x5b\x29\xc0\xd0\x95\xdb\xdd\x5b\x9a\x7c", 220); *(uint64_t*)0x20000308 = 0xdc; syscall(SYS_writev, r[0], 0x200002c0ul, 5ul); *(uint32_t*)0x20000340 = 0; *(uint32_t*)0x20000344 = -1; *(uint32_t*)0x20000348 = 0; res = syscall(SYS_getgroups, 3ul, 0x20000340ul); if (res != -1) r[1] = *(uint32_t*)0x20000348; *(uint32_t*)0x200003c0 = 0xc; res = syscall(SYS_getsockopt, -1, 0xffff, 0x11, 0x20000380ul, 0x200003c0ul); if (res != -1) r[2] = *(uint32_t*)0x20000388; syscall(SYS_setregid, r[1], r[2]); res = syscall(SYS_semget, 0x798e2634ul, 0ul, 0xb2603d964b180ce8ul); if (res != -1) r[3] = res; memcpy((void*)0x20000400, "./file0\000", 8); res = syscall(SYS_stat, 0x20000400ul, 0x20000440ul); if (res != -1) r[4] = *(uint32_t*)0x2000045c; res = syscall(SYS_getgid); if (res != -1) r[5] = res; *(uint32_t*)0x20000500 = 0xfffff834; *(uint32_t*)0x20000504 = r[4]; *(uint32_t*)0x20000508 = r[5]; *(uint32_t*)0x2000050c = -1; *(uint32_t*)0x20000510 = 0; *(uint32_t*)0x20000514 = 3; *(uint16_t*)0x20000518 = 9; *(uint16_t*)0x2000051a = 0; *(uint64_t*)0x20000520 = 0; *(uint64_t*)0x20000528 = 0; *(uint64_t*)0x20000530 = 0xfffffffffffffffd; *(uint64_t*)0x20000538 = 0x4535; *(uint64_t*)0x20000540 = 2; *(uint64_t*)0x20000548 = 0; *(uint64_t*)0x20000550 = 0; syscall(SYS_semctl, r[3], 0ul, 1ul, 0x20000500ul); syscall(SYS_seteuid, 0); memcpy((void*)0x20000000, "\xbf\x5b\xc2\xc4\xdd\xcd\x9b\xaa\x7f\x7c\x66\xf9\x17\x26\xa8\xc4\x90\xf6\x91\x85\x14\x0b\x5b\x42\x51\xe8\x67\x01\xc6\xc5\xa6\x0d\x84\x80\x2d\x38\x2a\x0c\x38\xdf\x4a\x28\xfd\x84\x0d\x7e\x14\x06\xa5\xc2\xeb\x5d\x3b\x6b\xc3\x23\xbd\x49\x38\x6c\x4a\x92\x49\x50\x31\x4f\xe6\x17\xf8\xcd\x34\x37\xa4\xaa\x6d\x1c\x6d\x62\x64\x03\x09\xf9\xde\x23\x93\x99\x9b\x11\x47\x68\xd5\x10\xd7\x34\xfd\x72\xd1\x98\xb2\x61\xbd\x61\x81\x14\xbf\x3f\xa3\xe2\xfe\x84\xff\xe6\x5c\x80\xe4\x72\x12\xc4\x9e\x47\xbb\x3a\xaa\x86\x89\x46\x2f\x21\xd5\x18\x80\xd9\x7c\xb4\x45\xd3", 136); memcpy((void*)0x200000c0, "\xc4\xa1\x84\x58\x2c\xaa\x26\x44\x0f\xae\x04\xc4\x41\x0f\x74\xab\x00\x00\x01\x00\xc4\x23\xf5\x78\x4c\xe9\x9d\x40\x44\xdf\x34\x59\x26\x41\x0f\xae\x41\x01\x64\x64\x66\x44\x0f\xe5\xb9\x4e\x9a\xb0\xc4\xc4\x22\x7d\x47\x0f\x41\x0f\x45\x7f\x56\x66\x0f\xdd\xe8", 63); syz_execute_func(0x200000c0); memcpy((void*)0x20000140, "\x64\xd3\x2f\x16\xeb\xd8\x17\xd0\x04\xdc\xb8\x01\x71\x82\x05\xbc\xa1\xd8\x6d\xad\x3c\xb1\x32\xa2\x86\x60\x92\x14\xb7\x39\x5a\x97\xa0\xe8\xfe\xda\x5f\xad\x02\xcc\xe9\xde\xea\x94\xd5\x5a\x75\x0c\x17\xb2\x34\x07\x50\x02\xb9\xdf\x62\x9f\xa6\x8e\x3f\x7d\xa9\x7e\x9c\x2a\x2e\x0a\x95\xd1\x5d\x35\x95\x61\xb1\x47\x74\x40\x34\x2c\xd7\x9c\x7c\xeb\xd6\xbf\x00\x8a\xcd\x1c\x7f\xf1\x46\xa6\xfe\x22\x01\x36\x61\xd8\xc8\xce\x8e\xb1\x7f\x5c\xf3\x89\x2a\xe0\x8b\xba\x46\x54\x5b\x2b\x69\x0a\xb7\xe0\x36\x8a\xec\x4d\x32\xb7\x6d\x7f\xc1\x5d\xd7\xc2\xab\xa1\x84\xd4\x1a\x5e\x5a\xbb\x8d\x71\x6f\x5e\x64\x5e\x17\x67\x13\x8e\xd7\x38\xf3\x15\x79\x5a\xc9\x9e\x22\xfd\x44\xdb\x06\x09\x63\x13\xf4\x72\x9c\xe0\xd3\xbd\x93\x8f\x5b\x65\x20\xef\x93\x76\xfa\x90\x9d\xf6\xb2\x05\xc2\xd3\xf5\x2e\xe4\x3e\x3f\x59\xea\x44\x1b\x7c\x4e\x4d\x5c", 201); memcpy((void*)0x20000240, "\xc1\xb0\x1d\x40\x73\x99\x35\xb1\x21\x7d\x0e\x39\x3c\xdd\x4f\xa4\xef\x8b\xbd\x99\x57\xee\x99\x68\x77\xe4\xca\x15\x5c\x19\x5d\xc1\x66\xf9\x48\x6a\xc4\xdb\x17\xf7\x54\xc4\x89\x38\xa4\x34\x19\xf0\x82\xa8\xc3\x0e\xff\xbe\xf0\x64\xf6\xc8\xb8\x7b\xc9\x30\xe4\x39\xc7\x19\xec\x0a\x11\x99\x04\x0b\x86\x28\x6d\x27\x1f\x25\xaf\x26\xeb\xed\x3f\x55\xc3\x2e\x68\xac\x70\x33\x0d\xf7\x69\x31\xbf\x55\xfa\xe8\x80\x25\x6b\x74\xa9\x23\xf8\xa3\x02\x2c\x31\x0f\x94\xcc\x0c\x62\x33\x02\xa5\xd1\x4b\x3f\x8e\x18\xf4\x15\x99\x88\x28\x66\xea\x02\x42\x86\x4b\x37\xd5\xae\x87\xfb\xcb\x74\x5c\x3e\x26\x42\x3d\x05\xc5\x48\x38\x33\xdf\xcd\xd4\x3d\xc0\xc6\x50\x73\x29\x03\x72\x73\xde\x28\x2e\x3a\x16\xac\x00\xc5\x53\x9c\x30\x94\x63\x98\x4b\x15\x3e\xc6\x25\x0a\x78\x19\x75\xa2\x77\x01\x72\x80\xdb\x1e\x9c\x18\xce\x66\x4d\xf5\x94\x7c\x6c\x18\xbe\xf2\x36\x7e\x61\x63\xb4\x6b\x95\x03\xf7\x00\x70\x5f\xd0\xe8\x9e\xae\x6d\xf0\x88\x4b\xf2\x7c\x00\xe0\x5f\xc5\xef\xc6\x49\x07", 234); syz_usb_connect(0, 0xc9, 0x20000140, 0x20000240); memcpy((void*)0x20000340, "\x36\x4f\xb1\xa4\x17\x26\x3d\xe2\x27\x97\xec\x76\x08\x61\xf3\x85\x2c\xf2\x4f\x79\xe2\xb7\xa5\xc6\x2a\xfa\xd7\xd6\xd4\xd0\x9d\x86\x2f\x8e\xcc\xd0\x2e\x1b\xb9\x89\xe0\xf8\xa8\xad\x91\x54\x42\x01\x64\x04\xc9\x82\x6a\x5c\x0a\x28\x4f\xc7\xa8\x40\x30\x47\x59\xb6\x84\xf3\x57\xb2\xe6\xfe\xcf\xb3\xcc\x81\x57\xc0\x08\xff\x0d\xcf\xf2\x10\x89\x84\x54\x8a\x2a\xd6\x95\xfa\xd9\x51\x2f\x06\xfd\x12\xd6\x6b\xc4\x43\x04\x75\x12\xab\x4e\xf3\x05\x8a\xe6\xc0\xc6\xec\x3f\xd6\x27\xe3\x70\xa1\x51\xae\x71\x9b\x8e\x3a\x77\xd6\x82\xdc\x06\xa9\x3b\xe9\xc2\xaa\x80\x18\xb5\x8a\x94\x92\xcb\x39\x03\x1b\xb5\xab\xf3\x12\x4e\xaa\xb8\x53\x30\xf1\x81\xfc\xcc\xa7\x59\x7b\x4e\xc0\x87\x9f\xcb\xcf\x51\x14\x3f\x98\xc4\x43\xc1\x67\x20\xa6\xe0\x1b\x7e\x07\xdf\x47\x27\xe2\x88\xe1\x3d\xcc\x0b\x7e\x11", 191); memcpy((void*)0x20000400, "\x59\x03\x92\x3c\x7a\x1b\x28\x38\xf3\xc1\x21\x56\x78\x5a\x11\xc8\x1b\x2e\x82\xd9\xa1\x19\x0e\x1b\x9c\x45\x97\x6a\x91\x7c\x00\x29\x4d\xc9\x4d\x53\x54\xe8\xc5\xd6\xa4\xe8\x98\x6d\xa0\x74\xeb\x46\x1e\xd0\x73\x6b\xcb\xed\xe2\xce\xf1\xf1\x9e\x02\x16\xc0\x9e\xb7\x94\xd8\xb9\x75\x4f\xea\x26\xf1\x10\xc8\x32\x48\xc2\x86\xea\xa0\x5a\x69\x84\x4e\xb1\x29\x2f\x59\x4f\x59\xf6\xc9\xbe\xca\x47\xd8\x94\xd4\x4d\xfd\x15\xff\x81\xb7\x6b\x46\x35\x39\x2e\xb5\xed\x43\x1c\xa3\x09\x22\x30", 117); res = syz_usb_connect(4, 0xbf, 0x20000340, 0x20000400); if (res != -1) r[6] = res; syz_usb_disconnect(r[6]); } int main(void) { syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 3ul, 0x1012ul, -1, 0ul, 0ul); use_temporary_dir(); do_sandbox_none(); return 0; } :96:2: error: unknown type name 'uint8_t_t' :97:2: error: unknown type name 'uint8_t_t' :98:2: error: unknown type name 'uint8_t_t' :99:2: error: unknown type name 'uint8_t_t' :100:2: error: unknown type name 'uint16_t_t' :101:2: error: unknown type name 'uint8_t_t' :102:2: error: unknown type name 'uint8_t_t' :103:2: error: unknown type name 'uint8_t_t' :107:2: error: unknown type name 'uint8_t_t' :108:2: error: unknown type name 'uint8_t_t' :109:2: error: unknown type name 'uint16_t_t' :110:2: error: unknown type name 'uint8_t_t' :111:2: error: unknown type name 'uint8_t_t' :112:2: error: unknown type name 'uint8_t_t' :113:2: error: unknown type name 'uint8_t_t' :114:2: error: unknown type name 'uint16_t_t' :115:2: error: unknown type name 'uint16_t_t' :116:2: error: unknown type name 'uint16_t_t' :117:2: error: unknown type name 'uint8_t_t' :118:2: error: unknown type name 'uint8_t_t' :119:2: error: unknown type name 'uint8_t_t' :120:2: error: unknown type name 'uint8_t_t' :124:2: error: unknown type name 'uint8_t_t' :125:2: error: unknown type name 'uint8_t_t' :126:2: error: unknown type name 'uint16_t_t' :127:2: error: unknown type name 'uint8_t_t' :128:2: error: unknown type name 'uint8_t_t' :129:2: error: unknown type name 'uint8_t_t' :130:2: error: unknown type name 'uint8_t_t' :131:2: error: unknown type name 'uint8_t_t' :135:2: error: unknown type name 'uint8_t_t' :136:2: error: unknown type name 'uint8_t_t' :137:2: error: unknown type name 'uint8_t_t' :138:2: error: unknown type name 'uint8_t_t' :139:2: error: unknown type name 'uint8_t_t' :140:2: error: unknown type name 'uint8_t_t' :141:2: error: unknown type name 'uint8_t_t' :142:2: error: unknown type name 'uint8_t_t' :143:2: error: unknown type name 'uint8_t_t' :147:2: error: unknown type name 'uint8_t_t' :148:2: error: unknown type name 'uint8_t_t' :149:2: error: unknown type name 'uint16_t_t' :150:2: error: unknown type name 'uint16_t_t' :151:2: error: unknown type name 'uint16_t_t' :155:2: error: unknown type name 'uint8_t_t' :156:2: error: unknown type name 'uint8_t_t' :157:2: error: unknown type name 'uint16_t_t' :158:2: error: unknown type name 'uint8_t_t' :159:2: error: unknown type name 'uint8_t_t' :160:2: error: unknown type name 'uint8_t_t' :161:2: error: unknown type name 'uint8_t_t' :162:2: error: unknown type name 'uint8_t_t' :163:2: error: unknown type name 'uint8_t_t' : In function 'vhci_usb_recv': :470:2: error: unknown type name 'uint8_t_t'; did you mean 'uint8_t'? :470:20: error: 'uint8_t_t' undeclared (first use in this function); did you mean 'uint8_t'? :470:20: note: each undeclared identifier is reported only once for each function it appears in :470:30: error: expected expression before ')' token : In function 'vhci_usb_send': :485:2: error: unknown type name 'uint8_t_t'; did you mean 'uint8_t'? :485:20: error: 'uint8_t_t' undeclared (first use in this function); did you mean 'uint8_t'? :485:30: error: expected expression before ')' token : In function 'syz_usb_connect_impl': :546:63: error: unknown type name 'usb_ctrlrequest' :551:55: error: unknown type name 'usb_ctrlrequest' :563:8: error: 'uint32_t_t' undeclared (first use in this function); did you mean 'uint32_t'? At top level: :611:13: error: 'setup_usb' defined but not used [-Werror=unused-function] cc1: all warnings being treated as errors compiler invocation: /syzkaller/netbsd/src/../tools/bin/x86_64--netbsd-g++ [-o /tmp/syz-executor482766479 -DGOOS_netbsd=1 -DGOARCH_amd64=1 -DHOSTGOOS_linux=1 -x c - -m64 --sysroot /syzkaller/netbsd/src/../dest/ -O2 -pthread -Wall -Werror -Wparentheses -Wframe-larger-than=16384] --- FAIL: TestGenerate/netbsd/amd64/10 (0.76s) csource_test.go:123: opts: {Threaded:true Collide:false Repeat:true RepeatTimes:0 Procs:0 Sandbox:none Fault:false FaultCall:0 FaultNth:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false USB:false UseTmpDir:false HandleSegv:false Repro:false Trace:false} program: r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c) writev(r0, &(0x7f00000002c0)=[{&(0x7f0000000000)="25c5f6768692f16a6b02337bc5f24e95c2e574f7bd23da78ff2241439caced122e33ab16d377843415781fa508cd635f2fd04113204ed9bda7396e99a38a2f10e9c7398b5a64c49d98664bd14975be7076a83638a7da3095f0e027bd161ccd5c994f8b31d535a3ce4c57812d9682f3ebb10e05a7142210515b668d1357d91aaabb6ad88aed6b9f2143d062e0b5", 0x8d}, {&(0x7f00000000c0)="e8987e8f864e9d38b55615b659d14cae9e91a9532213ffb465b61b", 0x1b}, {&(0x7f0000000100)="3f97992c940fba8936a6b4", 0xb}, {&(0x7f0000000140)="c99ab604eb2e44ebf7bfb7b04c084321a30f4351aeb0676bb21aefc3bc2322d99a5b034f880aa25d61ae4076397c30357b22ccb779ebd3206ac648fab90836dd4d9e73dc3c077270b57dc3222284dd3cae4737957d947d765a5e0e919cbd3ef2d3d9522a827f3fe60ddc", 0x6a}, {&(0x7f00000001c0)="2bc5a9fd6cc3450082405ab607a0f5627b40589a690ac59158acf10f2a1cc46152fa5f493a8599cc6eaab5d96968bef1a27f62dacf64d06c80cfb5b320b977c9432c446fa6f6551444ee4c5998853260d65d2cb3c778f44fe270363b4eb309e24fc47797b5bd454bf4d3d4656fa078ff56b30f4f0e9d5e6e8943830ad6d342968c224f7c35af01a61d10e155fee7e0227cd79a7977b3f40351ca01834840abba557d36bc8a4208f90dc5f51e3f3d445c5feea79368164edef05d24748ce9f0a58451b43d9891902bc45ec67d00df1deb74e65b29c0d095dbdd5b9a7c", 0xdc}], 0x5) getgroups(0x3, &(0x7f0000000340)=[0x0, 0xffffffffffffffff, 0x0]) getsockopt$sock_cred(0xffffffffffffffff, 0xffff, 0x11, &(0x7f0000000380)={0x0, 0x0, 0x0}, &(0x7f00000003c0)=0xc) setregid(r1, r2) r3 = semget(0x1, 0x0, 0xb2603d964b180ce8) stat(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0}) r5 = getgid() semctl$IPC_SET(r3, 0x0, 0x1, &(0x7f0000000500)={{0xfffff834, r4, r5, 0xffffffffffffffff, 0x0, 0x3, 0x9}, 0xfffffffffffffffd, 0x4535, 0x2}) seteuid(0x0) syz_emit_ethernet(0x88, &(0x7f0000000000)="bf5bc2c4ddcd9baa7f7c66f91726a8c490f69185140b5b4251e86701c6c5a60d84802d382a0c38df4a28fd840d7e1406a5c2eb5d3b6bc323bd49386c4a924950314fe617f8cd3437a4aa6d1c6d62640309f9de2393999b114768d510d734fd72d198b261bd618114bf3fa3e2fe84ffe65c80e47212c49e47bb3aaa8689462f21d51880d97cb445d3") syz_execute_func(&(0x7f00000000c0)="c4a184582caa26440fae04c4410f74ab00000100c423f5784ce99d4044df345926410fae4101646466440fe5b94e9ab0c4c4227d470f410f457f56660fdde8") syz_extract_tcp_res(&(0x7f0000000100), 0x6, 0x1) syz_usb_connect(0x0, 0xc9, &(0x7f0000000140)="64d32f16ebd817d004dcb801718205bca1d86dad3cb132a286609214b7395a97a0e8feda5fad02cce9deea94d55a750c17b234075002b9df629fa68e3f7da97e9c2a2e0a95d15d359561b1477440342cd79c7cebd6bf008acd1c7ff146a6fe22013661d8c8ce8eb17f5cf3892ae08bba46545b2b690ab7e0368aec4d32b76d7fc15dd7c2aba184d41a5e5abb8d716f5e645e1767138ed738f315795ac99e22fd44db06096313f4729ce0d3bd938f5b6520ef9376fa909df6b205c2d3f52ee43e3f59ea441b7c4e4d5c", &(0x7f0000000240)="c1b01d40739935b1217d0e393cdd4fa4ef8bbd9957ee996877e4ca155c195dc166f9486ac4db17f754c48938a43419f082a8c30effbef064f6c8b87bc930e439c719ec0a1199040b86286d271f25af26ebed3f55c32e68ac70330df76931bf55fae880256b74a923f8a3022c310f94cc0c623302a5d14b3f8e18f41599882866ea0242864b37d5ae87fbcb745c3e26423d05c5483833dfcdd43dc0c6507329037273de282e3a16ac00c5539c309463984b153ec6250a781975a277017280db1e9c18ce664df5947c6c18bef2367e6163b46b9503f700705fd0e89eae6df0884bf27c00e05fc5efc64907") r6 = syz_usb_connect(0x4, 0xbf, &(0x7f0000000340)="364fb1a417263de22797ec760861f3852cf24f79e2b7a5c62afad7d6d4d09d862f8eccd02e1bb989e0f8a8ad915442016404c9826a5c0a284fc7a840304759b684f357b2e6fecfb3cc8157c008ff0dcff2108984548a2ad695fad9512f06fd12d66bc443047512ab4ef3058ae6c0c6ec3fd627e370a151ae719b8e3a77d682dc06a93be9c2aa8018b58a9492cb39031bb5abf3124eaab85330f181fccca7597b4ec0879fcbcf51143f98c443c16720a6e01b7e07df4727e288e13dcc0b7e11", &(0x7f0000000400)="5903923c7a1b2838f3c12156785a11c81b2e82d9a1190e1b9c45976a917c00294dc94d5354e8c5d6a4e8986da074eb461ed0736bcbede2cef1f19e0216c09eb794d8b9754fea26f110c83248c286eaa05a69844eb1292f594f59f6c9beca47d894d44dfd15ff81b76b4635392eb5ed431ca3092230") syz_usb_disconnect(r6) csource_test.go:124: failed to build program: // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include static unsigned long long procid; static void kill_and_wait(int pid, int* status) { kill(pid, SIGKILL); while (waitpid(-1, status, 0) != pid) { } } static void sleep_ms(uint64_t ms) { usleep(ms * 1000); } static uint64_t current_time_ms(void) { struct timespec ts; if (clock_gettime(CLOCK_MONOTONIC, &ts)) exit(1); return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; } static void thread_start(void* (*fn)(void*), void* arg) { pthread_t th; pthread_attr_t attr; pthread_attr_init(&attr); pthread_attr_setstacksize(&attr, 128 << 10); int i; for (i = 0; i < 100; i++) { if (pthread_create(&th, &attr, fn, arg) == 0) { pthread_attr_destroy(&attr); return; } if (errno == EAGAIN) { usleep(50); continue; } break; } exit(1); } typedef struct { pthread_mutex_t mu; pthread_cond_t cv; int state; } event_t; static void event_init(event_t* ev) { if (pthread_mutex_init(&ev->mu, 0)) exit(1); if (pthread_cond_init(&ev->cv, 0)) exit(1); ev->state = 0; } static void event_reset(event_t* ev) { ev->state = 0; } static void event_set(event_t* ev) { pthread_mutex_lock(&ev->mu); if (ev->state) exit(1); ev->state = 1; pthread_mutex_unlock(&ev->mu); pthread_cond_broadcast(&ev->cv); } static void event_wait(event_t* ev) { pthread_mutex_lock(&ev->mu); while (!ev->state) pthread_cond_wait(&ev->cv, &ev->mu); pthread_mutex_unlock(&ev->mu); } static int event_isset(event_t* ev) { pthread_mutex_lock(&ev->mu); int res = ev->state; pthread_mutex_unlock(&ev->mu); return res; } static int event_timedwait(event_t* ev, uint64_t timeout) { uint64_t start = current_time_ms(); uint64_t now = start; pthread_mutex_lock(&ev->mu); for (;;) { if (ev->state) break; uint64_t remain = timeout - (now - start); struct timespec ts; ts.tv_sec = remain / 1000; ts.tv_nsec = (remain % 1000) * 1000 * 1000; pthread_cond_timedwait(&ev->cv, &ev->mu, &ts); now = current_time_ms(); if (now - start > timeout) break; } int res = ev->state; pthread_mutex_unlock(&ev->mu); return res; } /* -------------------------------------------------------------------------- */ /* * Redefinitions to match the linux types used in common_usb.h. */ struct usb_endpoint_descriptor { uint8_t_t bLength; uint8_t_t bDescriptorType; uint8_t_t bEndpointAddress; uint8_t_t bmAttributes; uint16_t_t wMaxPacketSize; uint8_t_t bInterval; uint8_t_t bRefresh; uint8_t_t bSynchAddress; } __attribute__((packed)); struct usb_device_descriptor { uint8_t_t bLength; uint8_t_t bDescriptorType; uint16_t_t bcdUSB; uint8_t_t bDeviceClass; uint8_t_t bDeviceSubClass; uint8_t_t bDeviceProtocol; uint8_t_t bMaxPacketSize0; uint16_t_t idVendor; uint16_t_t idProduct; uint16_t_t bcdDevice; uint8_t_t iManufacturer; uint8_t_t iProduct; uint8_t_t iSerialNumber; uint8_t_t bNumConfigurations; } __attribute__((packed)); struct usb_config_descriptor { uint8_t_t bLength; uint8_t_t bDescriptorType; uint16_t_t wTotalLength; uint8_t_t bNumInterfaces; uint8_t_t bConfigurationValue; uint8_t_t iConfiguration; uint8_t_t bmAttributes; uint8_t_t bMaxPower; } __attribute__((packed)); struct usb_interface_descriptor { uint8_t_t bLength; uint8_t_t bDescriptorType; uint8_t_t bInterfaceNumber; uint8_t_t bAlternateSetting; uint8_t_t bNumEndpoints; uint8_t_t bInterfaceClass; uint8_t_t bInterfaceSubClass; uint8_t_t bInterfaceProtocol; uint8_t_t iInterface; } __attribute__((packed)); struct usb_ctrlrequest { uint8_t_t bRequestType; uint8_t_t bRequest; uint16_t_t wValue; uint16_t_t wIndex; uint16_t_t wLength; } __attribute__((packed)); struct usb_qualifier_descriptor { uint8_t_t bLength; uint8_t_t bDescriptorType; uint16_t_t bcdUSB; uint8_t_t bDeviceClass; uint8_t_t bDeviceSubClass; uint8_t_t bDeviceProtocol; uint8_t_t bMaxPacketSize0; uint8_t_t bNumConfigurations; uint8_t_t bRESERVED; } __attribute__((packed)); #define USB_TYPE_MASK (0x03 << 5) #define USB_TYPE_STANDARD (0x00 << 5) #define USB_TYPE_CLASS (0x01 << 5) #define USB_TYPE_VENDOR (0x02 << 5) #define USB_TYPE_RESERVED (0x03 << 5) #define USB_DT_DEVICE 0x01 #define USB_DT_CONFIG 0x02 #define USB_DT_STRING 0x03 #define USB_DT_INTERFACE 0x04 #define USB_DT_ENDPOINT 0x05 #define USB_DT_DEVICE_QUALIFIER 0x06 #define USB_DT_OTHER_SPEED_CONFIG 0x07 #define USB_DT_INTERFACE_POWER 0x08 #define USB_DT_OTG 0x09 #define USB_DT_DEBUG 0x0a #define USB_DT_INTERFACE_ASSOCIATION 0x0b #define USB_DT_SECURITY 0x0c #define USB_DT_KEY 0x0d #define USB_DT_ENCRYPTION_TYPE 0x0e #define USB_DT_BOS 0x0f #define USB_DT_DEVICE_CAPABILITY 0x10 #define USB_DT_WIRELESS_ENDPOINT_COMP 0x11 #define USB_DT_WIRE_ADAPTER 0x21 #define USB_DT_RPIPE 0x22 #define USB_DT_CS_RADIO_CONTROL 0x23 #define USB_DT_PIPE_USAGE 0x24 #define USB_DT_SS_ENDPOINT_COMP 0x30 #define USB_DT_SSP_ISOC_ENDPOINT_COMP 0x31 #define USB_REQ_GET_STATUS 0x00 #define USB_REQ_CLEAR_FEATURE 0x01 #define USB_REQ_SET_FEATURE 0x03 #define USB_REQ_SET_ADDRESS 0x05 #define USB_REQ_GET_DESCRIPTOR 0x06 #define USB_REQ_SET_DESCRIPTOR 0x07 #define USB_REQ_GET_CONFIGURATION 0x08 #define USB_REQ_SET_CONFIGURATION 0x09 #define USB_REQ_GET_INTERFACE 0x0A #define USB_REQ_SET_INTERFACE 0x0B #define USB_REQ_SYNCH_FRAME 0x0C #define USB_REQ_SET_SEL 0x30 #define USB_REQ_SET_ISOCH_DELAY 0x31 #define USB_REQ_SET_ENCRYPTION 0x0D #define USB_REQ_GET_ENCRYPTION 0x0E #define USB_REQ_RPIPE_ABORT 0x0E #define USB_REQ_SET_HANDSHAKE 0x0F #define USB_REQ_RPIPE_RESET 0x0F #define USB_REQ_GET_HANDSHAKE 0x10 #define USB_REQ_SET_CONNECTION 0x11 #define USB_REQ_SET_SECURITY_DATA 0x12 #define USB_REQ_GET_SECURITY_DATA 0x13 #define USB_REQ_SET_WUSB_DATA 0x14 #define USB_REQ_LOOPBACK_DATA_WRITE 0x15 #define USB_REQ_LOOPBACK_DATA_READ 0x16 #define USB_REQ_SET_INTERFACE_DS 0x17 #define USB_REQ_GET_PARTNER_PDO 20 #define USB_REQ_GET_BATTERY_STATUS 21 #define USB_REQ_SET_PDO 22 #define USB_REQ_GET_VDM 23 #define USB_REQ_SEND_VDM 24 #define USB_MAX_IFACE_NUM 4 #define USB_MAX_EP_NUM 32 #define USB_MAX_FDS 6 struct usb_endpoint_index { struct usb_endpoint_descriptor desc; int handle; }; struct usb_iface_index { struct usb_interface_descriptor* iface; uint8_t bInterfaceNumber; uint8_t bAlternateSetting; uint8_t bInterfaceClass; struct usb_endpoint_index eps[USB_MAX_EP_NUM]; int eps_num; }; struct usb_device_index { struct usb_device_descriptor* dev; struct usb_config_descriptor* config; uint8_t bDeviceClass; uint8_t bMaxPower; int config_length; struct usb_iface_index ifaces[USB_MAX_IFACE_NUM]; int ifaces_num; int iface_cur; }; struct usb_info { int fd; struct usb_device_index index; }; static struct usb_info usb_devices[USB_MAX_FDS]; static int usb_devices_num; static bool parse_usb_descriptor(const char* buffer, size_t length, struct usb_device_index* index) { if (length < sizeof(*index->dev) + sizeof(*index->config)) return false; memset(index, 0, sizeof(*index)); index->dev = (struct usb_device_descriptor*)buffer; index->config = (struct usb_config_descriptor*)(buffer + sizeof(*index->dev)); index->bDeviceClass = index->dev->bDeviceClass; index->bMaxPower = index->config->bMaxPower; index->config_length = length - sizeof(*index->dev); index->iface_cur = -1; size_t offset = 0; while (true) { if (offset + 1 >= length) break; uint8_t desc_length = buffer[offset]; uint8_t desc_type = buffer[offset + 1]; if (desc_length <= 2) break; if (offset + desc_length > length) break; if (desc_type == USB_DT_INTERFACE && index->ifaces_num < USB_MAX_IFACE_NUM) { struct usb_interface_descriptor* iface = (struct usb_interface_descriptor*)(buffer + offset); index->ifaces[index->ifaces_num].iface = iface; index->ifaces[index->ifaces_num].bInterfaceNumber = iface->bInterfaceNumber; index->ifaces[index->ifaces_num].bAlternateSetting = iface->bAlternateSetting; index->ifaces[index->ifaces_num].bInterfaceClass = iface->bInterfaceClass; index->ifaces_num++; } if (desc_type == USB_DT_ENDPOINT && index->ifaces_num > 0) { struct usb_iface_index* iface = &index->ifaces[index->ifaces_num - 1]; if (iface->eps_num < USB_MAX_EP_NUM) { memcpy(&iface->eps[iface->eps_num].desc, buffer + offset, sizeof(iface->eps[iface->eps_num].desc)); iface->eps_num++; } } offset += desc_length; } return true; } static struct usb_device_index* add_usb_index(int fd, const char* dev, size_t dev_len) { int i = __atomic_fetch_add(&usb_devices_num, 1, __ATOMIC_RELAXED); if (i >= USB_MAX_FDS) return NULL; int rv = 0; rv = parse_usb_descriptor(dev, dev_len, &usb_devices[i].index); if (!rv) return NULL; __atomic_store_n(&usb_devices[i].fd, fd, __ATOMIC_RELEASE); return &usb_devices[i].index; } static struct usb_device_index* lookup_usb_index(int fd) { int i; for (i = 0; i < USB_MAX_FDS; i++) { if (__atomic_load_n(&usb_devices[i].fd, __ATOMIC_ACQUIRE) == fd) { return &usb_devices[i].index; } } return NULL; } struct vusb_connect_string_descriptor { uint32_t len; char* str; } __attribute__((packed)); struct vusb_connect_descriptors { uint32_t qual_len; char* qual; uint32_t bos_len; char* bos; uint32_t strs_len; struct vusb_connect_string_descriptor strs[0]; } __attribute__((packed)); static const char default_string[] = { 8, USB_DT_STRING, 's', 0, 'y', 0, 'z', 0 }; static const char default_lang_id[] = { 4, USB_DT_STRING, 0x09, 0x04 }; static bool lookup_connect_response_in(int fd, const struct vusb_connect_descriptors* descs, const struct usb_ctrlrequest* ctrl, char** response_data, uint32_t* response_length) { struct usb_device_index* index = lookup_usb_index(fd); uint8_t str_idx; if (!index) return false; switch (ctrl->bRequestType & USB_TYPE_MASK) { case USB_TYPE_STANDARD: switch (ctrl->bRequest) { case USB_REQ_GET_DESCRIPTOR: switch (ctrl->wValue >> 8) { case USB_DT_DEVICE: *response_data = (char*)index->dev; *response_length = sizeof(*index->dev); return true; case USB_DT_CONFIG: *response_data = (char*)index->config; *response_length = index->config_length; return true; case USB_DT_STRING: str_idx = (uint8_t)ctrl->wValue; if (descs && str_idx < descs->strs_len) { *response_data = descs->strs[str_idx].str; *response_length = descs->strs[str_idx].len; return true; } if (str_idx == 0) { *response_data = (char*)&default_lang_id[0]; *response_length = default_lang_id[0]; return true; } *response_data = (char*)&default_string[0]; *response_length = default_string[0]; return true; case USB_DT_BOS: *response_data = descs->bos; *response_length = descs->bos_len; return true; case USB_DT_DEVICE_QUALIFIER: if (!descs->qual) { struct usb_qualifier_descriptor* qual = (struct usb_qualifier_descriptor*)response_data; qual->bLength = sizeof(*qual); qual->bDescriptorType = USB_DT_DEVICE_QUALIFIER; qual->bcdUSB = index->dev->bcdUSB; qual->bDeviceClass = index->dev->bDeviceClass; qual->bDeviceSubClass = index->dev->bDeviceSubClass; qual->bDeviceProtocol = index->dev->bDeviceProtocol; qual->bMaxPacketSize0 = index->dev->bMaxPacketSize0; qual->bNumConfigurations = index->dev->bNumConfigurations; qual->bRESERVED = 0; *response_length = sizeof(*qual); return true; } *response_data = descs->qual; *response_length = descs->qual_len; return true; default: break; } break; default: break; } break; default: break; } return false; } typedef bool (*lookup_connect_out_response_t)(int fd, const struct vusb_connect_descriptors* descs, const struct usb_ctrlrequest* ctrl, bool* done); static bool lookup_connect_response_out_generic(int fd, const struct vusb_connect_descriptors* descs, const struct usb_ctrlrequest* ctrl, bool* done) { switch (ctrl->bRequestType & USB_TYPE_MASK) { case USB_TYPE_STANDARD: switch (ctrl->bRequest) { case USB_REQ_SET_CONFIGURATION: *done = true; return true; default: break; } break; } return false; } /* -------------------------------------------------------------------------- */ static int vhci_open(void) { return open("/dev/vhci", O_RDWR); } static int vhci_setport(int fd, u_int port) { struct vhci_ioc_set_port args; args.port = port; return ioctl(fd, VHCI_IOC_SET_PORT, &args); } static int vhci_usb_attach(int fd) { return ioctl(fd, VHCI_IOC_USB_ATTACH, NULL); } static int vhci_usb_recv(int fd, void* buf, size_t size) { uint8_t_t* ptr = (uint8_t_t*)buf; ssize_t done; while (1) { done = read(fd, ptr, size); if (done < 0) return -1; if ((size_t)done == size) return 0; size -= done; ptr += done; } } static int vhci_usb_send(int fd, void* buf, size_t size) { uint8_t_t* ptr = (uint8_t_t*)buf; ssize_t done; while (1) { done = write(fd, ptr, size); if (done <= 0) return -1; if ((size_t)done == size) return 0; size -= done; ptr += done; } } /* -------------------------------------------------------------------------- */ static volatile long syz_usb_connect_impl(uint64_t speed, uint64_t dev_len, const char* dev, const struct vusb_connect_descriptors* descs, lookup_connect_out_response_t lookup_connect_response_out) { struct usb_device_index* index; int portnum, fd, rv; bool done; portnum = procid + 1; if (!dev) { return -1; } if (portnum != 1) { /* For now, we support only one proc. */ return -1; } fd = vhci_open(); if (fd < 0) { return -1; } index = add_usb_index(fd, dev, dev_len); if (!index) { goto err; } rv = vhci_setport(fd, portnum); if (rv != 0) { goto err; } rv = vhci_usb_attach(fd); if (rv != 0) { goto err; } done = false; while (!done) { vhci_request_t req; rv = vhci_usb_recv(fd, &req, sizeof(req)); if (rv != 0) { goto err; } if (req.type != VHCI_REQ_CTRL) { goto err; } char* response_data = NULL; uint32_t response_length = 0; char data[4096]; if (req.u.ctrl.bmRequestType & UE_DIR_IN) { bool response_found = false; response_found = lookup_connect_response_in(fd, descs, (const usb_ctrlrequest*)&req.u.ctrl, &response_data, &response_length); if (!response_found) { goto err; } } else { if (!lookup_connect_response_out(fd, descs, (const usb_ctrlrequest*)&req.u.ctrl, &done)) { goto err; } response_data = NULL; response_length = UGETW(req.u.ctrl.wLength); } if ((req.u.ctrl.bmRequestType & USB_TYPE_MASK) == USB_TYPE_STANDARD && req.u.ctrl.bRequest == USB_REQ_SET_CONFIGURATION) { /* TODO: possibly revisit */ } if (response_length > sizeof(data)) response_length = 0; if ((uint32_t_t)UGETW(req.u.ctrl.wLength) < response_length) response_length = UGETW(req.u.ctrl.wLength); if (response_data) memcpy(data, response_data, response_length); else memset(data, 0, response_length); if (req.u.ctrl.bmRequestType & UE_DIR_IN) { if (response_length > 0) { vhci_response_t res; res.size = response_length; rv = vhci_usb_send(fd, &res, sizeof(res)); if (rv == 0) rv = vhci_usb_send(fd, data, response_length); } } else { rv = vhci_usb_recv(fd, data, response_length); } if (rv < 0) { goto err; } } sleep_ms(200); return fd; err: close(fd); return -1; } static volatile long syz_usb_connect(volatile long a0, volatile long a1, volatile long a2, volatile long a3) { uint64_t speed = a0; uint64_t dev_len = a1; const char* dev = (const char*)a2; const struct vusb_connect_descriptors* descs = (const struct vusb_connect_descriptors*)a3; return syz_usb_connect_impl(speed, dev_len, dev, descs, &lookup_connect_response_out_generic); } static volatile long syz_usb_disconnect(volatile long a0) { int fd = a0; int rv = close(fd); sleep_ms(200); return rv; } static void setup_usb(void) { if (chmod("/dev/vhci", 0666)) exit(1); } static void sandbox_common() { if (setsid() == -1) exit(1); struct rlimit rlim; rlim.rlim_cur = rlim.rlim_max = 8 << 20; setrlimit(RLIMIT_MEMLOCK, &rlim); rlim.rlim_cur = rlim.rlim_max = 1 << 20; setrlimit(RLIMIT_FSIZE, &rlim); rlim.rlim_cur = rlim.rlim_max = 1 << 20; setrlimit(RLIMIT_STACK, &rlim); rlim.rlim_cur = rlim.rlim_max = 0; setrlimit(RLIMIT_CORE, &rlim); rlim.rlim_cur = rlim.rlim_max = 256; setrlimit(RLIMIT_NOFILE, &rlim); } static void loop(); static int do_sandbox_none(void) { sandbox_common(); loop(); return 0; } static long syz_execute_func(volatile long text) { volatile long p[8] = {0}; (void)p; asm volatile("" ::"r"(0l), "r"(1l), "r"(2l), "r"(3l), "r"(4l), "r"(5l), "r"(6l), "r"(7l), "r"(8l), "r"(9l), "r"(10l), "r"(11l), "r"(12l), "r"(13l)); ((void (*)(void))(text))(); return 0; } struct thread_t { int created, call; event_t ready, done; }; static struct thread_t threads[16]; static void execute_call(int call); static int running; static void* thr(void* arg) { struct thread_t* th = (struct thread_t*)arg; for (;;) { event_wait(&th->ready); event_reset(&th->ready); execute_call(th->call); __atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED); event_set(&th->done); } return 0; } static void execute_one(void) { int i, call, thread; for (call = 0; call < 16; call++) { for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0])); thread++) { struct thread_t* th = &threads[thread]; if (!th->created) { th->created = 1; event_init(&th->ready); event_init(&th->done); event_set(&th->done); thread_start(thr, th); } if (!event_isset(&th->done)) continue; event_reset(&th->done); th->call = call; __atomic_fetch_add(&running, 1, __ATOMIC_RELAXED); event_set(&th->ready); event_timedwait(&th->done, 45 + (call == 13 ? 3000 : 0) + (call == 14 ? 3000 : 0) + (call == 15 ? 300 : 0)); break; } } for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++) sleep_ms(1); } static void execute_one(void); #define WAIT_FLAGS 0 static void loop(void) { int iter; for (iter = 0;; iter++) { int pid = fork(); if (pid < 0) exit(1); if (pid == 0) { execute_one(); exit(0); } int status = 0; uint64_t start = current_time_ms(); for (;;) { if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) break; sleep_ms(1); if (current_time_ms() - start < 5 * 1000) continue; kill_and_wait(pid, &status); break; } } } #ifndef SYS_dup2 #define SYS_dup2 90 #endif #ifndef SYS_getgid #define SYS_getgid 47 #endif #ifndef SYS_getgroups #define SYS_getgroups 79 #endif #ifndef SYS_getsockopt #define SYS_getsockopt 118 #endif #ifndef SYS_mmap #define SYS_mmap 197 #endif #ifndef SYS_semctl #define SYS_semctl 442 #endif #ifndef SYS_semget #define SYS_semget 221 #endif #ifndef SYS_seteuid #define SYS_seteuid 183 #endif #ifndef SYS_setregid #define SYS_setregid 127 #endif #ifndef SYS_stat #define SYS_stat 439 #endif #ifndef SYS_writev #define SYS_writev 121 #endif uint64_t r[7] = {0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}; void execute_call(int call) { intptr_t res = 0; switch (call) { case 0: res = syscall(SYS_dup2, -1, 0xffffff9c); if (res != -1) r[0] = res; break; case 1: *(uint64_t*)0x200002c0 = 0x20000000; memcpy((void*)0x20000000, "\x25\xc5\xf6\x76\x86\x92\xf1\x6a\x6b\x02\x33\x7b\xc5\xf2\x4e\x95\xc2\xe5\x74\xf7\xbd\x23\xda\x78\xff\x22\x41\x43\x9c\xac\xed\x12\x2e\x33\xab\x16\xd3\x77\x84\x34\x15\x78\x1f\xa5\x08\xcd\x63\x5f\x2f\xd0\x41\x13\x20\x4e\xd9\xbd\xa7\x39\x6e\x99\xa3\x8a\x2f\x10\xe9\xc7\x39\x8b\x5a\x64\xc4\x9d\x98\x66\x4b\xd1\x49\x75\xbe\x70\x76\xa8\x36\x38\xa7\xda\x30\x95\xf0\xe0\x27\xbd\x16\x1c\xcd\x5c\x99\x4f\x8b\x31\xd5\x35\xa3\xce\x4c\x57\x81\x2d\x96\x82\xf3\xeb\xb1\x0e\x05\xa7\x14\x22\x10\x51\x5b\x66\x8d\x13\x57\xd9\x1a\xaa\xbb\x6a\xd8\x8a\xed\x6b\x9f\x21\x43\xd0\x62\xe0\xb5", 141); *(uint64_t*)0x200002c8 = 0x8d; *(uint64_t*)0x200002d0 = 0x200000c0; memcpy((void*)0x200000c0, "\xe8\x98\x7e\x8f\x86\x4e\x9d\x38\xb5\x56\x15\xb6\x59\xd1\x4c\xae\x9e\x91\xa9\x53\x22\x13\xff\xb4\x65\xb6\x1b", 27); *(uint64_t*)0x200002d8 = 0x1b; *(uint64_t*)0x200002e0 = 0x20000100; memcpy((void*)0x20000100, "\x3f\x97\x99\x2c\x94\x0f\xba\x89\x36\xa6\xb4", 11); *(uint64_t*)0x200002e8 = 0xb; *(uint64_t*)0x200002f0 = 0x20000140; memcpy((void*)0x20000140, "\xc9\x9a\xb6\x04\xeb\x2e\x44\xeb\xf7\xbf\xb7\xb0\x4c\x08\x43\x21\xa3\x0f\x43\x51\xae\xb0\x67\x6b\xb2\x1a\xef\xc3\xbc\x23\x22\xd9\x9a\x5b\x03\x4f\x88\x0a\xa2\x5d\x61\xae\x40\x76\x39\x7c\x30\x35\x7b\x22\xcc\xb7\x79\xeb\xd3\x20\x6a\xc6\x48\xfa\xb9\x08\x36\xdd\x4d\x9e\x73\xdc\x3c\x07\x72\x70\xb5\x7d\xc3\x22\x22\x84\xdd\x3c\xae\x47\x37\x95\x7d\x94\x7d\x76\x5a\x5e\x0e\x91\x9c\xbd\x3e\xf2\xd3\xd9\x52\x2a\x82\x7f\x3f\xe6\x0d\xdc", 106); *(uint64_t*)0x200002f8 = 0x6a; *(uint64_t*)0x20000300 = 0x200001c0; memcpy((void*)0x200001c0, "\x2b\xc5\xa9\xfd\x6c\xc3\x45\x00\x82\x40\x5a\xb6\x07\xa0\xf5\x62\x7b\x40\x58\x9a\x69\x0a\xc5\x91\x58\xac\xf1\x0f\x2a\x1c\xc4\x61\x52\xfa\x5f\x49\x3a\x85\x99\xcc\x6e\xaa\xb5\xd9\x69\x68\xbe\xf1\xa2\x7f\x62\xda\xcf\x64\xd0\x6c\x80\xcf\xb5\xb3\x20\xb9\x77\xc9\x43\x2c\x44\x6f\xa6\xf6\x55\x14\x44\xee\x4c\x59\x98\x85\x32\x60\xd6\x5d\x2c\xb3\xc7\x78\xf4\x4f\xe2\x70\x36\x3b\x4e\xb3\x09\xe2\x4f\xc4\x77\x97\xb5\xbd\x45\x4b\xf4\xd3\xd4\x65\x6f\xa0\x78\xff\x56\xb3\x0f\x4f\x0e\x9d\x5e\x6e\x89\x43\x83\x0a\xd6\xd3\x42\x96\x8c\x22\x4f\x7c\x35\xaf\x01\xa6\x1d\x10\xe1\x55\xfe\xe7\xe0\x22\x7c\xd7\x9a\x79\x77\xb3\xf4\x03\x51\xca\x01\x83\x48\x40\xab\xba\x55\x7d\x36\xbc\x8a\x42\x08\xf9\x0d\xc5\xf5\x1e\x3f\x3d\x44\x5c\x5f\xee\xa7\x93\x68\x16\x4e\xde\xf0\x5d\x24\x74\x8c\xe9\xf0\xa5\x84\x51\xb4\x3d\x98\x91\x90\x2b\xc4\x5e\xc6\x7d\x00\xdf\x1d\xeb\x74\xe6\x5b\x29\xc0\xd0\x95\xdb\xdd\x5b\x9a\x7c", 220); *(uint64_t*)0x20000308 = 0xdc; syscall(SYS_writev, r[0], 0x200002c0ul, 5ul); break; case 2: *(uint32_t*)0x20000340 = 0; *(uint32_t*)0x20000344 = -1; *(uint32_t*)0x20000348 = 0; res = syscall(SYS_getgroups, 3ul, 0x20000340ul); if (res != -1) r[1] = *(uint32_t*)0x20000348; break; case 3: *(uint32_t*)0x200003c0 = 0xc; res = syscall(SYS_getsockopt, -1, 0xffff, 0x11, 0x20000380ul, 0x200003c0ul); if (res != -1) r[2] = *(uint32_t*)0x20000388; break; case 4: syscall(SYS_setregid, r[1], r[2]); break; case 5: res = syscall(SYS_semget, 0x798e2634ul, 0ul, 0xb2603d964b180ce8ul); if (res != -1) r[3] = res; break; case 6: memcpy((void*)0x20000400, "./file0\000", 8); res = syscall(SYS_stat, 0x20000400ul, 0x20000440ul); if (res != -1) r[4] = *(uint32_t*)0x2000045c; break; case 7: res = syscall(SYS_getgid); if (res != -1) r[5] = res; break; case 8: *(uint32_t*)0x20000500 = 0xfffff834; *(uint32_t*)0x20000504 = r[4]; *(uint32_t*)0x20000508 = r[5]; *(uint32_t*)0x2000050c = -1; *(uint32_t*)0x20000510 = 0; *(uint32_t*)0x20000514 = 3; *(uint16_t*)0x20000518 = 9; *(uint16_t*)0x2000051a = 0; *(uint64_t*)0x20000520 = 0; *(uint64_t*)0x20000528 = 0; *(uint64_t*)0x20000530 = 0xfffffffffffffffd; *(uint64_t*)0x20000538 = 0x4535; *(uint64_t*)0x20000540 = 2; *(uint64_t*)0x20000548 = 0; *(uint64_t*)0x20000550 = 0; syscall(SYS_semctl, r[3], 0ul, 1ul, 0x20000500ul); break; case 9: syscall(SYS_seteuid, 0); break; case 10: memcpy((void*)0x20000000, "\xbf\x5b\xc2\xc4\xdd\xcd\x9b\xaa\x7f\x7c\x66\xf9\x17\x26\xa8\xc4\x90\xf6\x91\x85\x14\x0b\x5b\x42\x51\xe8\x67\x01\xc6\xc5\xa6\x0d\x84\x80\x2d\x38\x2a\x0c\x38\xdf\x4a\x28\xfd\x84\x0d\x7e\x14\x06\xa5\xc2\xeb\x5d\x3b\x6b\xc3\x23\xbd\x49\x38\x6c\x4a\x92\x49\x50\x31\x4f\xe6\x17\xf8\xcd\x34\x37\xa4\xaa\x6d\x1c\x6d\x62\x64\x03\x09\xf9\xde\x23\x93\x99\x9b\x11\x47\x68\xd5\x10\xd7\x34\xfd\x72\xd1\x98\xb2\x61\xbd\x61\x81\x14\xbf\x3f\xa3\xe2\xfe\x84\xff\xe6\x5c\x80\xe4\x72\x12\xc4\x9e\x47\xbb\x3a\xaa\x86\x89\x46\x2f\x21\xd5\x18\x80\xd9\x7c\xb4\x45\xd3", 136); break; case 11: memcpy((void*)0x200000c0, "\xc4\xa1\x84\x58\x2c\xaa\x26\x44\x0f\xae\x04\xc4\x41\x0f\x74\xab\x00\x00\x01\x00\xc4\x23\xf5\x78\x4c\xe9\x9d\x40\x44\xdf\x34\x59\x26\x41\x0f\xae\x41\x01\x64\x64\x66\x44\x0f\xe5\xb9\x4e\x9a\xb0\xc4\xc4\x22\x7d\x47\x0f\x41\x0f\x45\x7f\x56\x66\x0f\xdd\xe8", 63); syz_execute_func(0x200000c0); break; case 12: break; case 13: memcpy((void*)0x20000140, "\x64\xd3\x2f\x16\xeb\xd8\x17\xd0\x04\xdc\xb8\x01\x71\x82\x05\xbc\xa1\xd8\x6d\xad\x3c\xb1\x32\xa2\x86\x60\x92\x14\xb7\x39\x5a\x97\xa0\xe8\xfe\xda\x5f\xad\x02\xcc\xe9\xde\xea\x94\xd5\x5a\x75\x0c\x17\xb2\x34\x07\x50\x02\xb9\xdf\x62\x9f\xa6\x8e\x3f\x7d\xa9\x7e\x9c\x2a\x2e\x0a\x95\xd1\x5d\x35\x95\x61\xb1\x47\x74\x40\x34\x2c\xd7\x9c\x7c\xeb\xd6\xbf\x00\x8a\xcd\x1c\x7f\xf1\x46\xa6\xfe\x22\x01\x36\x61\xd8\xc8\xce\x8e\xb1\x7f\x5c\xf3\x89\x2a\xe0\x8b\xba\x46\x54\x5b\x2b\x69\x0a\xb7\xe0\x36\x8a\xec\x4d\x32\xb7\x6d\x7f\xc1\x5d\xd7\xc2\xab\xa1\x84\xd4\x1a\x5e\x5a\xbb\x8d\x71\x6f\x5e\x64\x5e\x17\x67\x13\x8e\xd7\x38\xf3\x15\x79\x5a\xc9\x9e\x22\xfd\x44\xdb\x06\x09\x63\x13\xf4\x72\x9c\xe0\xd3\xbd\x93\x8f\x5b\x65\x20\xef\x93\x76\xfa\x90\x9d\xf6\xb2\x05\xc2\xd3\xf5\x2e\xe4\x3e\x3f\x59\xea\x44\x1b\x7c\x4e\x4d\x5c", 201); memcpy((void*)0x20000240, "\xc1\xb0\x1d\x40\x73\x99\x35\xb1\x21\x7d\x0e\x39\x3c\xdd\x4f\xa4\xef\x8b\xbd\x99\x57\xee\x99\x68\x77\xe4\xca\x15\x5c\x19\x5d\xc1\x66\xf9\x48\x6a\xc4\xdb\x17\xf7\x54\xc4\x89\x38\xa4\x34\x19\xf0\x82\xa8\xc3\x0e\xff\xbe\xf0\x64\xf6\xc8\xb8\x7b\xc9\x30\xe4\x39\xc7\x19\xec\x0a\x11\x99\x04\x0b\x86\x28\x6d\x27\x1f\x25\xaf\x26\xeb\xed\x3f\x55\xc3\x2e\x68\xac\x70\x33\x0d\xf7\x69\x31\xbf\x55\xfa\xe8\x80\x25\x6b\x74\xa9\x23\xf8\xa3\x02\x2c\x31\x0f\x94\xcc\x0c\x62\x33\x02\xa5\xd1\x4b\x3f\x8e\x18\xf4\x15\x99\x88\x28\x66\xea\x02\x42\x86\x4b\x37\xd5\xae\x87\xfb\xcb\x74\x5c\x3e\x26\x42\x3d\x05\xc5\x48\x38\x33\xdf\xcd\xd4\x3d\xc0\xc6\x50\x73\x29\x03\x72\x73\xde\x28\x2e\x3a\x16\xac\x00\xc5\x53\x9c\x30\x94\x63\x98\x4b\x15\x3e\xc6\x25\x0a\x78\x19\x75\xa2\x77\x01\x72\x80\xdb\x1e\x9c\x18\xce\x66\x4d\xf5\x94\x7c\x6c\x18\xbe\xf2\x36\x7e\x61\x63\xb4\x6b\x95\x03\xf7\x00\x70\x5f\xd0\xe8\x9e\xae\x6d\xf0\x88\x4b\xf2\x7c\x00\xe0\x5f\xc5\xef\xc6\x49\x07", 234); syz_usb_connect(0, 0xc9, 0x20000140, 0x20000240); break; case 14: memcpy((void*)0x20000340, "\x36\x4f\xb1\xa4\x17\x26\x3d\xe2\x27\x97\xec\x76\x08\x61\xf3\x85\x2c\xf2\x4f\x79\xe2\xb7\xa5\xc6\x2a\xfa\xd7\xd6\xd4\xd0\x9d\x86\x2f\x8e\xcc\xd0\x2e\x1b\xb9\x89\xe0\xf8\xa8\xad\x91\x54\x42\x01\x64\x04\xc9\x82\x6a\x5c\x0a\x28\x4f\xc7\xa8\x40\x30\x47\x59\xb6\x84\xf3\x57\xb2\xe6\xfe\xcf\xb3\xcc\x81\x57\xc0\x08\xff\x0d\xcf\xf2\x10\x89\x84\x54\x8a\x2a\xd6\x95\xfa\xd9\x51\x2f\x06\xfd\x12\xd6\x6b\xc4\x43\x04\x75\x12\xab\x4e\xf3\x05\x8a\xe6\xc0\xc6\xec\x3f\xd6\x27\xe3\x70\xa1\x51\xae\x71\x9b\x8e\x3a\x77\xd6\x82\xdc\x06\xa9\x3b\xe9\xc2\xaa\x80\x18\xb5\x8a\x94\x92\xcb\x39\x03\x1b\xb5\xab\xf3\x12\x4e\xaa\xb8\x53\x30\xf1\x81\xfc\xcc\xa7\x59\x7b\x4e\xc0\x87\x9f\xcb\xcf\x51\x14\x3f\x98\xc4\x43\xc1\x67\x20\xa6\xe0\x1b\x7e\x07\xdf\x47\x27\xe2\x88\xe1\x3d\xcc\x0b\x7e\x11", 191); memcpy((void*)0x20000400, "\x59\x03\x92\x3c\x7a\x1b\x28\x38\xf3\xc1\x21\x56\x78\x5a\x11\xc8\x1b\x2e\x82\xd9\xa1\x19\x0e\x1b\x9c\x45\x97\x6a\x91\x7c\x00\x29\x4d\xc9\x4d\x53\x54\xe8\xc5\xd6\xa4\xe8\x98\x6d\xa0\x74\xeb\x46\x1e\xd0\x73\x6b\xcb\xed\xe2\xce\xf1\xf1\x9e\x02\x16\xc0\x9e\xb7\x94\xd8\xb9\x75\x4f\xea\x26\xf1\x10\xc8\x32\x48\xc2\x86\xea\xa0\x5a\x69\x84\x4e\xb1\x29\x2f\x59\x4f\x59\xf6\xc9\xbe\xca\x47\xd8\x94\xd4\x4d\xfd\x15\xff\x81\xb7\x6b\x46\x35\x39\x2e\xb5\xed\x43\x1c\xa3\x09\x22\x30", 117); res = syz_usb_connect(4, 0xbf, 0x20000340, 0x20000400); if (res != -1) r[6] = res; break; case 15: syz_usb_disconnect(r[6]); break; } } int main(void) { syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 3ul, 0x1012ul, -1, 0ul, 0ul); do_sandbox_none(); return 0; } :146:2: error: unknown type name 'uint8_t_t' :147:2: error: unknown type name 'uint8_t_t' :148:2: error: unknown type name 'uint8_t_t' :149:2: error: unknown type name 'uint8_t_t' :150:2: error: unknown type name 'uint16_t_t' :151:2: error: unknown type name 'uint8_t_t' :152:2: error: unknown type name 'uint8_t_t' :153:2: error: unknown type name 'uint8_t_t' :157:2: error: unknown type name 'uint8_t_t' :158:2: error: unknown type name 'uint8_t_t' :159:2: error: unknown type name 'uint16_t_t' :160:2: error: unknown type name 'uint8_t_t' :161:2: error: unknown type name 'uint8_t_t' :162:2: error: unknown type name 'uint8_t_t' :163:2: error: unknown type name 'uint8_t_t' :164:2: error: unknown type name 'uint16_t_t' :165:2: error: unknown type name 'uint16_t_t' :166:2: error: unknown type name 'uint16_t_t' :167:2: error: unknown type name 'uint8_t_t' :168:2: error: unknown type name 'uint8_t_t' :169:2: error: unknown type name 'uint8_t_t' :170:2: error: unknown type name 'uint8_t_t' :174:2: error: unknown type name 'uint8_t_t' :175:2: error: unknown type name 'uint8_t_t' :176:2: error: unknown type name 'uint16_t_t' :177:2: error: unknown type name 'uint8_t_t' :178:2: error: unknown type name 'uint8_t_t' :179:2: error: unknown type name 'uint8_t_t' :180:2: error: unknown type name 'uint8_t_t' :181:2: error: unknown type name 'uint8_t_t' :185:2: error: unknown type name 'uint8_t_t' :186:2: error: unknown type name 'uint8_t_t' :187:2: error: unknown type name 'uint8_t_t' :188:2: error: unknown type name 'uint8_t_t' :189:2: error: unknown type name 'uint8_t_t' :190:2: error: unknown type name 'uint8_t_t' :191:2: error: unknown type name 'uint8_t_t' :192:2: error: unknown type name 'uint8_t_t' :193:2: error: unknown type name 'uint8_t_t' :197:2: error: unknown type name 'uint8_t_t' :198:2: error: unknown type name 'uint8_t_t' :199:2: error: unknown type name 'uint16_t_t' :200:2: error: unknown type name 'uint16_t_t' :201:2: error: unknown type name 'uint16_t_t' :205:2: error: unknown type name 'uint8_t_t' :206:2: error: unknown type name 'uint8_t_t' :207:2: error: unknown type name 'uint16_t_t' :208:2: error: unknown type name 'uint8_t_t' :209:2: error: unknown type name 'uint8_t_t' :210:2: error: unknown type name 'uint8_t_t' :211:2: error: unknown type name 'uint8_t_t' :212:2: error: unknown type name 'uint8_t_t' :213:2: error: unknown type name 'uint8_t_t' : In function 'vhci_usb_recv': :520:2: error: unknown type name 'uint8_t_t'; did you mean 'uint8_t'? :520:20: error: 'uint8_t_t' undeclared (first use in this function); did you mean 'uint8_t'? :520:20: note: each undeclared identifier is reported only once for each function it appears in :520:30: error: expected expression before ')' token : In function 'vhci_usb_send': :535:2: error: unknown type name 'uint8_t_t'; did you mean 'uint8_t'? :535:20: error: 'uint8_t_t' undeclared (first use in this function); did you mean 'uint8_t'? :535:30: error: expected expression before ')' token : In function 'syz_usb_connect_impl': :596:63: error: unknown type name 'usb_ctrlrequest' :601:55: error: unknown type name 'usb_ctrlrequest' :613:8: error: 'uint32_t_t' undeclared (first use in this function); did you mean 'uint32_t'? : In function 'setup_usb': :663:6: error: implicit declaration of function 'chmod' [-Werror=implicit-function-declaration] At top level: :661:13: error: 'setup_usb' defined but not used [-Werror=unused-function] cc1: all warnings being treated as errors compiler invocation: /syzkaller/netbsd/src/../tools/bin/x86_64--netbsd-g++ [-o /tmp/syz-executor058070425 -DGOOS_netbsd=1 -DGOARCH_amd64=1 -DHOSTGOOS_linux=1 -x c - -m64 --sysroot /syzkaller/netbsd/src/../dest/ -O2 -pthread -Wall -Werror -Wparentheses -Wframe-larger-than=16384] --- FAIL: TestGenerate/netbsd/amd64/12 (0.76s) csource_test.go:123: opts: {Threaded:true Collide:false Repeat:true RepeatTimes:0 Procs:0 Sandbox:none Fault:false FaultCall:0 FaultNth:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false USB:false UseTmpDir:true HandleSegv:false Repro:true Trace:false} program: r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c) writev(r0, &(0x7f00000002c0)=[{&(0x7f0000000000)="25c5f6768692f16a6b02337bc5f24e95c2e574f7bd23da78ff2241439caced122e33ab16d377843415781fa508cd635f2fd04113204ed9bda7396e99a38a2f10e9c7398b5a64c49d98664bd14975be7076a83638a7da3095f0e027bd161ccd5c994f8b31d535a3ce4c57812d9682f3ebb10e05a7142210515b668d1357d91aaabb6ad88aed6b9f2143d062e0b5", 0x8d}, {&(0x7f00000000c0)="e8987e8f864e9d38b55615b659d14cae9e91a9532213ffb465b61b", 0x1b}, {&(0x7f0000000100)="3f97992c940fba8936a6b4", 0xb}, {&(0x7f0000000140)="c99ab604eb2e44ebf7bfb7b04c084321a30f4351aeb0676bb21aefc3bc2322d99a5b034f880aa25d61ae4076397c30357b22ccb779ebd3206ac648fab90836dd4d9e73dc3c077270b57dc3222284dd3cae4737957d947d765a5e0e919cbd3ef2d3d9522a827f3fe60ddc", 0x6a}, {&(0x7f00000001c0)="2bc5a9fd6cc3450082405ab607a0f5627b40589a690ac59158acf10f2a1cc46152fa5f493a8599cc6eaab5d96968bef1a27f62dacf64d06c80cfb5b320b977c9432c446fa6f6551444ee4c5998853260d65d2cb3c778f44fe270363b4eb309e24fc47797b5bd454bf4d3d4656fa078ff56b30f4f0e9d5e6e8943830ad6d342968c224f7c35af01a61d10e155fee7e0227cd79a7977b3f40351ca01834840abba557d36bc8a4208f90dc5f51e3f3d445c5feea79368164edef05d24748ce9f0a58451b43d9891902bc45ec67d00df1deb74e65b29c0d095dbdd5b9a7c", 0xdc}], 0x5) getgroups(0x3, &(0x7f0000000340)=[0x0, 0xffffffffffffffff, 0x0]) getsockopt$sock_cred(0xffffffffffffffff, 0xffff, 0x11, &(0x7f0000000380)={0x0, 0x0, 0x0}, &(0x7f00000003c0)=0xc) setregid(r1, r2) r3 = semget(0x1, 0x0, 0xb2603d964b180ce8) stat(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0}) r5 = getgid() semctl$IPC_SET(r3, 0x0, 0x1, &(0x7f0000000500)={{0xfffff834, r4, r5, 0xffffffffffffffff, 0x0, 0x3, 0x9}, 0xfffffffffffffffd, 0x4535, 0x2}) seteuid(0x0) syz_emit_ethernet(0x88, &(0x7f0000000000)="bf5bc2c4ddcd9baa7f7c66f91726a8c490f69185140b5b4251e86701c6c5a60d84802d382a0c38df4a28fd840d7e1406a5c2eb5d3b6bc323bd49386c4a924950314fe617f8cd3437a4aa6d1c6d62640309f9de2393999b114768d510d734fd72d198b261bd618114bf3fa3e2fe84ffe65c80e47212c49e47bb3aaa8689462f21d51880d97cb445d3") syz_execute_func(&(0x7f00000000c0)="c4a184582caa26440fae04c4410f74ab00000100c423f5784ce99d4044df345926410fae4101646466440fe5b94e9ab0c4c4227d470f410f457f56660fdde8") syz_extract_tcp_res(&(0x7f0000000100), 0x6, 0x1) syz_usb_connect(0x0, 0xc9, &(0x7f0000000140)="64d32f16ebd817d004dcb801718205bca1d86dad3cb132a286609214b7395a97a0e8feda5fad02cce9deea94d55a750c17b234075002b9df629fa68e3f7da97e9c2a2e0a95d15d359561b1477440342cd79c7cebd6bf008acd1c7ff146a6fe22013661d8c8ce8eb17f5cf3892ae08bba46545b2b690ab7e0368aec4d32b76d7fc15dd7c2aba184d41a5e5abb8d716f5e645e1767138ed738f315795ac99e22fd44db06096313f4729ce0d3bd938f5b6520ef9376fa909df6b205c2d3f52ee43e3f59ea441b7c4e4d5c", &(0x7f0000000240)="c1b01d40739935b1217d0e393cdd4fa4ef8bbd9957ee996877e4ca155c195dc166f9486ac4db17f754c48938a43419f082a8c30effbef064f6c8b87bc930e439c719ec0a1199040b86286d271f25af26ebed3f55c32e68ac70330df76931bf55fae880256b74a923f8a3022c310f94cc0c623302a5d14b3f8e18f41599882866ea0242864b37d5ae87fbcb745c3e26423d05c5483833dfcdd43dc0c6507329037273de282e3a16ac00c5539c309463984b153ec6250a781975a277017280db1e9c18ce664df5947c6c18bef2367e6163b46b9503f700705fd0e89eae6df0884bf27c00e05fc5efc64907") r6 = syz_usb_connect(0x4, 0xbf, &(0x7f0000000340)="364fb1a417263de22797ec760861f3852cf24f79e2b7a5c62afad7d6d4d09d862f8eccd02e1bb989e0f8a8ad915442016404c9826a5c0a284fc7a840304759b684f357b2e6fecfb3cc8157c008ff0dcff2108984548a2ad695fad9512f06fd12d66bc443047512ab4ef3058ae6c0c6ec3fd627e370a151ae719b8e3a77d682dc06a93be9c2aa8018b58a9492cb39031bb5abf3124eaab85330f181fccca7597b4ec0879fcbcf51143f98c443c16720a6e01b7e07df4727e288e13dcc0b7e11", &(0x7f0000000400)="5903923c7a1b2838f3c12156785a11c81b2e82d9a1190e1b9c45976a917c00294dc94d5354e8c5d6a4e8986da074eb461ed0736bcbede2cef1f19e0216c09eb794d8b9754fea26f110c83248c286eaa05a69844eb1292f594f59f6c9beca47d894d44dfd15ff81b76b4635392eb5ed431ca3092230") syz_usb_disconnect(r6) csource_test.go:124: failed to build program: // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include static unsigned long long procid; static void kill_and_wait(int pid, int* status) { kill(pid, SIGKILL); while (waitpid(-1, status, 0) != pid) { } } static void sleep_ms(uint64_t ms) { usleep(ms * 1000); } static uint64_t current_time_ms(void) { struct timespec ts; if (clock_gettime(CLOCK_MONOTONIC, &ts)) exit(1); return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; } static void use_temporary_dir(void) { char tmpdir_template[] = "./syzkaller.XXXXXX"; char* tmpdir = mkdtemp(tmpdir_template); if (!tmpdir) exit(1); if (chmod(tmpdir, 0777)) exit(1); if (chdir(tmpdir)) exit(1); } static void remove_dir(const char* dir) { DIR* dp; struct dirent* ep; dp = opendir(dir); if (dp == NULL) exit(1); while ((ep = readdir(dp))) { if (strcmp(ep->d_name, ".") == 0 || strcmp(ep->d_name, "..") == 0) continue; char filename[FILENAME_MAX]; snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name); struct stat st; if (lstat(filename, &st)) exit(1); if (S_ISDIR(st.st_mode)) { remove_dir(filename); continue; } if (unlink(filename)) exit(1); } closedir(dp); if (rmdir(dir)) exit(1); } static void thread_start(void* (*fn)(void*), void* arg) { pthread_t th; pthread_attr_t attr; pthread_attr_init(&attr); pthread_attr_setstacksize(&attr, 128 << 10); int i; for (i = 0; i < 100; i++) { if (pthread_create(&th, &attr, fn, arg) == 0) { pthread_attr_destroy(&attr); return; } if (errno == EAGAIN) { usleep(50); continue; } break; } exit(1); } typedef struct { pthread_mutex_t mu; pthread_cond_t cv; int state; } event_t; static void event_init(event_t* ev) { if (pthread_mutex_init(&ev->mu, 0)) exit(1); if (pthread_cond_init(&ev->cv, 0)) exit(1); ev->state = 0; } static void event_reset(event_t* ev) { ev->state = 0; } static void event_set(event_t* ev) { pthread_mutex_lock(&ev->mu); if (ev->state) exit(1); ev->state = 1; pthread_mutex_unlock(&ev->mu); pthread_cond_broadcast(&ev->cv); } static void event_wait(event_t* ev) { pthread_mutex_lock(&ev->mu); while (!ev->state) pthread_cond_wait(&ev->cv, &ev->mu); pthread_mutex_unlock(&ev->mu); } static int event_isset(event_t* ev) { pthread_mutex_lock(&ev->mu); int res = ev->state; pthread_mutex_unlock(&ev->mu); return res; } static int event_timedwait(event_t* ev, uint64_t timeout) { uint64_t start = current_time_ms(); uint64_t now = start; pthread_mutex_lock(&ev->mu); for (;;) { if (ev->state) break; uint64_t remain = timeout - (now - start); struct timespec ts; ts.tv_sec = remain / 1000; ts.tv_nsec = (remain % 1000) * 1000 * 1000; pthread_cond_timedwait(&ev->cv, &ev->mu, &ts); now = current_time_ms(); if (now - start > timeout) break; } int res = ev->state; pthread_mutex_unlock(&ev->mu); return res; } /* -------------------------------------------------------------------------- */ /* * Redefinitions to match the linux types used in common_usb.h. */ struct usb_endpoint_descriptor { uint8_t_t bLength; uint8_t_t bDescriptorType; uint8_t_t bEndpointAddress; uint8_t_t bmAttributes; uint16_t_t wMaxPacketSize; uint8_t_t bInterval; uint8_t_t bRefresh; uint8_t_t bSynchAddress; } __attribute__((packed)); struct usb_device_descriptor { uint8_t_t bLength; uint8_t_t bDescriptorType; uint16_t_t bcdUSB; uint8_t_t bDeviceClass; uint8_t_t bDeviceSubClass; uint8_t_t bDeviceProtocol; uint8_t_t bMaxPacketSize0; uint16_t_t idVendor; uint16_t_t idProduct; uint16_t_t bcdDevice; uint8_t_t iManufacturer; uint8_t_t iProduct; uint8_t_t iSerialNumber; uint8_t_t bNumConfigurations; } __attribute__((packed)); struct usb_config_descriptor { uint8_t_t bLength; uint8_t_t bDescriptorType; uint16_t_t wTotalLength; uint8_t_t bNumInterfaces; uint8_t_t bConfigurationValue; uint8_t_t iConfiguration; uint8_t_t bmAttributes; uint8_t_t bMaxPower; } __attribute__((packed)); struct usb_interface_descriptor { uint8_t_t bLength; uint8_t_t bDescriptorType; uint8_t_t bInterfaceNumber; uint8_t_t bAlternateSetting; uint8_t_t bNumEndpoints; uint8_t_t bInterfaceClass; uint8_t_t bInterfaceSubClass; uint8_t_t bInterfaceProtocol; uint8_t_t iInterface; } __attribute__((packed)); struct usb_ctrlrequest { uint8_t_t bRequestType; uint8_t_t bRequest; uint16_t_t wValue; uint16_t_t wIndex; uint16_t_t wLength; } __attribute__((packed)); struct usb_qualifier_descriptor { uint8_t_t bLength; uint8_t_t bDescriptorType; uint16_t_t bcdUSB; uint8_t_t bDeviceClass; uint8_t_t bDeviceSubClass; uint8_t_t bDeviceProtocol; uint8_t_t bMaxPacketSize0; uint8_t_t bNumConfigurations; uint8_t_t bRESERVED; } __attribute__((packed)); #define USB_TYPE_MASK (0x03 << 5) #define USB_TYPE_STANDARD (0x00 << 5) #define USB_TYPE_CLASS (0x01 << 5) #define USB_TYPE_VENDOR (0x02 << 5) #define USB_TYPE_RESERVED (0x03 << 5) #define USB_DT_DEVICE 0x01 #define USB_DT_CONFIG 0x02 #define USB_DT_STRING 0x03 #define USB_DT_INTERFACE 0x04 #define USB_DT_ENDPOINT 0x05 #define USB_DT_DEVICE_QUALIFIER 0x06 #define USB_DT_OTHER_SPEED_CONFIG 0x07 #define USB_DT_INTERFACE_POWER 0x08 #define USB_DT_OTG 0x09 #define USB_DT_DEBUG 0x0a #define USB_DT_INTERFACE_ASSOCIATION 0x0b #define USB_DT_SECURITY 0x0c #define USB_DT_KEY 0x0d #define USB_DT_ENCRYPTION_TYPE 0x0e #define USB_DT_BOS 0x0f #define USB_DT_DEVICE_CAPABILITY 0x10 #define USB_DT_WIRELESS_ENDPOINT_COMP 0x11 #define USB_DT_WIRE_ADAPTER 0x21 #define USB_DT_RPIPE 0x22 #define USB_DT_CS_RADIO_CONTROL 0x23 #define USB_DT_PIPE_USAGE 0x24 #define USB_DT_SS_ENDPOINT_COMP 0x30 #define USB_DT_SSP_ISOC_ENDPOINT_COMP 0x31 #define USB_REQ_GET_STATUS 0x00 #define USB_REQ_CLEAR_FEATURE 0x01 #define USB_REQ_SET_FEATURE 0x03 #define USB_REQ_SET_ADDRESS 0x05 #define USB_REQ_GET_DESCRIPTOR 0x06 #define USB_REQ_SET_DESCRIPTOR 0x07 #define USB_REQ_GET_CONFIGURATION 0x08 #define USB_REQ_SET_CONFIGURATION 0x09 #define USB_REQ_GET_INTERFACE 0x0A #define USB_REQ_SET_INTERFACE 0x0B #define USB_REQ_SYNCH_FRAME 0x0C #define USB_REQ_SET_SEL 0x30 #define USB_REQ_SET_ISOCH_DELAY 0x31 #define USB_REQ_SET_ENCRYPTION 0x0D #define USB_REQ_GET_ENCRYPTION 0x0E #define USB_REQ_RPIPE_ABORT 0x0E #define USB_REQ_SET_HANDSHAKE 0x0F #define USB_REQ_RPIPE_RESET 0x0F #define USB_REQ_GET_HANDSHAKE 0x10 #define USB_REQ_SET_CONNECTION 0x11 #define USB_REQ_SET_SECURITY_DATA 0x12 #define USB_REQ_GET_SECURITY_DATA 0x13 #define USB_REQ_SET_WUSB_DATA 0x14 #define USB_REQ_LOOPBACK_DATA_WRITE 0x15 #define USB_REQ_LOOPBACK_DATA_READ 0x16 #define USB_REQ_SET_INTERFACE_DS 0x17 #define USB_REQ_GET_PARTNER_PDO 20 #define USB_REQ_GET_BATTERY_STATUS 21 #define USB_REQ_SET_PDO 22 #define USB_REQ_GET_VDM 23 #define USB_REQ_SEND_VDM 24 #define USB_MAX_IFACE_NUM 4 #define USB_MAX_EP_NUM 32 #define USB_MAX_FDS 6 struct usb_endpoint_index { struct usb_endpoint_descriptor desc; int handle; }; struct usb_iface_index { struct usb_interface_descriptor* iface; uint8_t bInterfaceNumber; uint8_t bAlternateSetting; uint8_t bInterfaceClass; struct usb_endpoint_index eps[USB_MAX_EP_NUM]; int eps_num; }; struct usb_device_index { struct usb_device_descriptor* dev; struct usb_config_descriptor* config; uint8_t bDeviceClass; uint8_t bMaxPower; int config_length; struct usb_iface_index ifaces[USB_MAX_IFACE_NUM]; int ifaces_num; int iface_cur; }; struct usb_info { int fd; struct usb_device_index index; }; static struct usb_info usb_devices[USB_MAX_FDS]; static int usb_devices_num; static bool parse_usb_descriptor(const char* buffer, size_t length, struct usb_device_index* index) { if (length < sizeof(*index->dev) + sizeof(*index->config)) return false; memset(index, 0, sizeof(*index)); index->dev = (struct usb_device_descriptor*)buffer; index->config = (struct usb_config_descriptor*)(buffer + sizeof(*index->dev)); index->bDeviceClass = index->dev->bDeviceClass; index->bMaxPower = index->config->bMaxPower; index->config_length = length - sizeof(*index->dev); index->iface_cur = -1; size_t offset = 0; while (true) { if (offset + 1 >= length) break; uint8_t desc_length = buffer[offset]; uint8_t desc_type = buffer[offset + 1]; if (desc_length <= 2) break; if (offset + desc_length > length) break; if (desc_type == USB_DT_INTERFACE && index->ifaces_num < USB_MAX_IFACE_NUM) { struct usb_interface_descriptor* iface = (struct usb_interface_descriptor*)(buffer + offset); index->ifaces[index->ifaces_num].iface = iface; index->ifaces[index->ifaces_num].bInterfaceNumber = iface->bInterfaceNumber; index->ifaces[index->ifaces_num].bAlternateSetting = iface->bAlternateSetting; index->ifaces[index->ifaces_num].bInterfaceClass = iface->bInterfaceClass; index->ifaces_num++; } if (desc_type == USB_DT_ENDPOINT && index->ifaces_num > 0) { struct usb_iface_index* iface = &index->ifaces[index->ifaces_num - 1]; if (iface->eps_num < USB_MAX_EP_NUM) { memcpy(&iface->eps[iface->eps_num].desc, buffer + offset, sizeof(iface->eps[iface->eps_num].desc)); iface->eps_num++; } } offset += desc_length; } return true; } static struct usb_device_index* add_usb_index(int fd, const char* dev, size_t dev_len) { int i = __atomic_fetch_add(&usb_devices_num, 1, __ATOMIC_RELAXED); if (i >= USB_MAX_FDS) return NULL; int rv = 0; rv = parse_usb_descriptor(dev, dev_len, &usb_devices[i].index); if (!rv) return NULL; __atomic_store_n(&usb_devices[i].fd, fd, __ATOMIC_RELEASE); return &usb_devices[i].index; } static struct usb_device_index* lookup_usb_index(int fd) { int i; for (i = 0; i < USB_MAX_FDS; i++) { if (__atomic_load_n(&usb_devices[i].fd, __ATOMIC_ACQUIRE) == fd) { return &usb_devices[i].index; } } return NULL; } struct vusb_connect_string_descriptor { uint32_t len; char* str; } __attribute__((packed)); struct vusb_connect_descriptors { uint32_t qual_len; char* qual; uint32_t bos_len; char* bos; uint32_t strs_len; struct vusb_connect_string_descriptor strs[0]; } __attribute__((packed)); static const char default_string[] = { 8, USB_DT_STRING, 's', 0, 'y', 0, 'z', 0 }; static const char default_lang_id[] = { 4, USB_DT_STRING, 0x09, 0x04 }; static bool lookup_connect_response_in(int fd, const struct vusb_connect_descriptors* descs, const struct usb_ctrlrequest* ctrl, char** response_data, uint32_t* response_length) { struct usb_device_index* index = lookup_usb_index(fd); uint8_t str_idx; if (!index) return false; switch (ctrl->bRequestType & USB_TYPE_MASK) { case USB_TYPE_STANDARD: switch (ctrl->bRequest) { case USB_REQ_GET_DESCRIPTOR: switch (ctrl->wValue >> 8) { case USB_DT_DEVICE: *response_data = (char*)index->dev; *response_length = sizeof(*index->dev); return true; case USB_DT_CONFIG: *response_data = (char*)index->config; *response_length = index->config_length; return true; case USB_DT_STRING: str_idx = (uint8_t)ctrl->wValue; if (descs && str_idx < descs->strs_len) { *response_data = descs->strs[str_idx].str; *response_length = descs->strs[str_idx].len; return true; } if (str_idx == 0) { *response_data = (char*)&default_lang_id[0]; *response_length = default_lang_id[0]; return true; } *response_data = (char*)&default_string[0]; *response_length = default_string[0]; return true; case USB_DT_BOS: *response_data = descs->bos; *response_length = descs->bos_len; return true; case USB_DT_DEVICE_QUALIFIER: if (!descs->qual) { struct usb_qualifier_descriptor* qual = (struct usb_qualifier_descriptor*)response_data; qual->bLength = sizeof(*qual); qual->bDescriptorType = USB_DT_DEVICE_QUALIFIER; qual->bcdUSB = index->dev->bcdUSB; qual->bDeviceClass = index->dev->bDeviceClass; qual->bDeviceSubClass = index->dev->bDeviceSubClass; qual->bDeviceProtocol = index->dev->bDeviceProtocol; qual->bMaxPacketSize0 = index->dev->bMaxPacketSize0; qual->bNumConfigurations = index->dev->bNumConfigurations; qual->bRESERVED = 0; *response_length = sizeof(*qual); return true; } *response_data = descs->qual; *response_length = descs->qual_len; return true; default: break; } break; default: break; } break; default: break; } return false; } typedef bool (*lookup_connect_out_response_t)(int fd, const struct vusb_connect_descriptors* descs, const struct usb_ctrlrequest* ctrl, bool* done); static bool lookup_connect_response_out_generic(int fd, const struct vusb_connect_descriptors* descs, const struct usb_ctrlrequest* ctrl, bool* done) { switch (ctrl->bRequestType & USB_TYPE_MASK) { case USB_TYPE_STANDARD: switch (ctrl->bRequest) { case USB_REQ_SET_CONFIGURATION: *done = true; return true; default: break; } break; } return false; } /* -------------------------------------------------------------------------- */ static int vhci_open(void) { return open("/dev/vhci", O_RDWR); } static int vhci_setport(int fd, u_int port) { struct vhci_ioc_set_port args; args.port = port; return ioctl(fd, VHCI_IOC_SET_PORT, &args); } static int vhci_usb_attach(int fd) { return ioctl(fd, VHCI_IOC_USB_ATTACH, NULL); } static int vhci_usb_recv(int fd, void* buf, size_t size) { uint8_t_t* ptr = (uint8_t_t*)buf; ssize_t done; while (1) { done = read(fd, ptr, size); if (done < 0) return -1; if ((size_t)done == size) return 0; size -= done; ptr += done; } } static int vhci_usb_send(int fd, void* buf, size_t size) { uint8_t_t* ptr = (uint8_t_t*)buf; ssize_t done; while (1) { done = write(fd, ptr, size); if (done <= 0) return -1; if ((size_t)done == size) return 0; size -= done; ptr += done; } } /* -------------------------------------------------------------------------- */ static volatile long syz_usb_connect_impl(uint64_t speed, uint64_t dev_len, const char* dev, const struct vusb_connect_descriptors* descs, lookup_connect_out_response_t lookup_connect_response_out) { struct usb_device_index* index; int portnum, fd, rv; bool done; portnum = procid + 1; if (!dev) { return -1; } if (portnum != 1) { /* For now, we support only one proc. */ return -1; } fd = vhci_open(); if (fd < 0) { return -1; } index = add_usb_index(fd, dev, dev_len); if (!index) { goto err; } rv = vhci_setport(fd, portnum); if (rv != 0) { goto err; } rv = vhci_usb_attach(fd); if (rv != 0) { goto err; } done = false; while (!done) { vhci_request_t req; rv = vhci_usb_recv(fd, &req, sizeof(req)); if (rv != 0) { goto err; } if (req.type != VHCI_REQ_CTRL) { goto err; } char* response_data = NULL; uint32_t response_length = 0; char data[4096]; if (req.u.ctrl.bmRequestType & UE_DIR_IN) { bool response_found = false; response_found = lookup_connect_response_in(fd, descs, (const usb_ctrlrequest*)&req.u.ctrl, &response_data, &response_length); if (!response_found) { goto err; } } else { if (!lookup_connect_response_out(fd, descs, (const usb_ctrlrequest*)&req.u.ctrl, &done)) { goto err; } response_data = NULL; response_length = UGETW(req.u.ctrl.wLength); } if ((req.u.ctrl.bmRequestType & USB_TYPE_MASK) == USB_TYPE_STANDARD && req.u.ctrl.bRequest == USB_REQ_SET_CONFIGURATION) { /* TODO: possibly revisit */ } if (response_length > sizeof(data)) response_length = 0; if ((uint32_t_t)UGETW(req.u.ctrl.wLength) < response_length) response_length = UGETW(req.u.ctrl.wLength); if (response_data) memcpy(data, response_data, response_length); else memset(data, 0, response_length); if (req.u.ctrl.bmRequestType & UE_DIR_IN) { if (response_length > 0) { vhci_response_t res; res.size = response_length; rv = vhci_usb_send(fd, &res, sizeof(res)); if (rv == 0) rv = vhci_usb_send(fd, data, response_length); } } else { rv = vhci_usb_recv(fd, data, response_length); } if (rv < 0) { goto err; } } sleep_ms(200); return fd; err: close(fd); return -1; } static volatile long syz_usb_connect(volatile long a0, volatile long a1, volatile long a2, volatile long a3) { uint64_t speed = a0; uint64_t dev_len = a1; const char* dev = (const char*)a2; const struct vusb_connect_descriptors* descs = (const struct vusb_connect_descriptors*)a3; return syz_usb_connect_impl(speed, dev_len, dev, descs, &lookup_connect_response_out_generic); } static volatile long syz_usb_disconnect(volatile long a0) { int fd = a0; int rv = close(fd); sleep_ms(200); return rv; } static void setup_usb(void) { if (chmod("/dev/vhci", 0666)) exit(1); } static void sandbox_common() { if (setsid() == -1) exit(1); struct rlimit rlim; rlim.rlim_cur = rlim.rlim_max = 8 << 20; setrlimit(RLIMIT_MEMLOCK, &rlim); rlim.rlim_cur = rlim.rlim_max = 1 << 20; setrlimit(RLIMIT_FSIZE, &rlim); rlim.rlim_cur = rlim.rlim_max = 1 << 20; setrlimit(RLIMIT_STACK, &rlim); rlim.rlim_cur = rlim.rlim_max = 0; setrlimit(RLIMIT_CORE, &rlim); rlim.rlim_cur = rlim.rlim_max = 256; setrlimit(RLIMIT_NOFILE, &rlim); } static void loop(); static int do_sandbox_none(void) { sandbox_common(); loop(); return 0; } static long syz_execute_func(volatile long text) { volatile long p[8] = {0}; (void)p; asm volatile("" ::"r"(0l), "r"(1l), "r"(2l), "r"(3l), "r"(4l), "r"(5l), "r"(6l), "r"(7l), "r"(8l), "r"(9l), "r"(10l), "r"(11l), "r"(12l), "r"(13l)); ((void (*)(void))(text))(); return 0; } struct thread_t { int created, call; event_t ready, done; }; static struct thread_t threads[16]; static void execute_call(int call); static int running; static void* thr(void* arg) { struct thread_t* th = (struct thread_t*)arg; for (;;) { event_wait(&th->ready); event_reset(&th->ready); execute_call(th->call); __atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED); event_set(&th->done); } return 0; } static void execute_one(void) { if (write(1, "executing program\n", sizeof("executing program\n") - 1)) { } int i, call, thread; for (call = 0; call < 16; call++) { for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0])); thread++) { struct thread_t* th = &threads[thread]; if (!th->created) { th->created = 1; event_init(&th->ready); event_init(&th->done); event_set(&th->done); thread_start(thr, th); } if (!event_isset(&th->done)) continue; event_reset(&th->done); th->call = call; __atomic_fetch_add(&running, 1, __ATOMIC_RELAXED); event_set(&th->ready); event_timedwait(&th->done, 45 + (call == 13 ? 3000 : 0) + (call == 14 ? 3000 : 0) + (call == 15 ? 300 : 0)); break; } } for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++) sleep_ms(1); } static void execute_one(void); #define WAIT_FLAGS 0 static void loop(void) { int iter; for (iter = 0;; iter++) { char cwdbuf[32]; sprintf(cwdbuf, "./%d", iter); if (mkdir(cwdbuf, 0777)) exit(1); int pid = fork(); if (pid < 0) exit(1); if (pid == 0) { if (chdir(cwdbuf)) exit(1); execute_one(); exit(0); } int status = 0; uint64_t start = current_time_ms(); for (;;) { if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) break; sleep_ms(1); if (current_time_ms() - start < 5 * 1000) continue; kill_and_wait(pid, &status); break; } remove_dir(cwdbuf); } } #ifndef SYS_dup2 #define SYS_dup2 90 #endif #ifndef SYS_getgid #define SYS_getgid 47 #endif #ifndef SYS_getgroups #define SYS_getgroups 79 #endif #ifndef SYS_getsockopt #define SYS_getsockopt 118 #endif #ifndef SYS_mmap #define SYS_mmap 197 #endif #ifndef SYS_semctl #define SYS_semctl 442 #endif #ifndef SYS_semget #define SYS_semget 221 #endif #ifndef SYS_seteuid #define SYS_seteuid 183 #endif #ifndef SYS_setregid #define SYS_setregid 127 #endif #ifndef SYS_stat #define SYS_stat 439 #endif #ifndef SYS_writev #define SYS_writev 121 #endif uint64_t r[7] = {0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}; void execute_call(int call) { intptr_t res = 0; switch (call) { case 0: res = syscall(SYS_dup2, -1, 0xffffff9c); if (res != -1) r[0] = res; break; case 1: *(uint64_t*)0x200002c0 = 0x20000000; memcpy((void*)0x20000000, "\x25\xc5\xf6\x76\x86\x92\xf1\x6a\x6b\x02\x33\x7b\xc5\xf2\x4e\x95\xc2\xe5\x74\xf7\xbd\x23\xda\x78\xff\x22\x41\x43\x9c\xac\xed\x12\x2e\x33\xab\x16\xd3\x77\x84\x34\x15\x78\x1f\xa5\x08\xcd\x63\x5f\x2f\xd0\x41\x13\x20\x4e\xd9\xbd\xa7\x39\x6e\x99\xa3\x8a\x2f\x10\xe9\xc7\x39\x8b\x5a\x64\xc4\x9d\x98\x66\x4b\xd1\x49\x75\xbe\x70\x76\xa8\x36\x38\xa7\xda\x30\x95\xf0\xe0\x27\xbd\x16\x1c\xcd\x5c\x99\x4f\x8b\x31\xd5\x35\xa3\xce\x4c\x57\x81\x2d\x96\x82\xf3\xeb\xb1\x0e\x05\xa7\x14\x22\x10\x51\x5b\x66\x8d\x13\x57\xd9\x1a\xaa\xbb\x6a\xd8\x8a\xed\x6b\x9f\x21\x43\xd0\x62\xe0\xb5", 141); *(uint64_t*)0x200002c8 = 0x8d; *(uint64_t*)0x200002d0 = 0x200000c0; memcpy((void*)0x200000c0, "\xe8\x98\x7e\x8f\x86\x4e\x9d\x38\xb5\x56\x15\xb6\x59\xd1\x4c\xae\x9e\x91\xa9\x53\x22\x13\xff\xb4\x65\xb6\x1b", 27); *(uint64_t*)0x200002d8 = 0x1b; *(uint64_t*)0x200002e0 = 0x20000100; memcpy((void*)0x20000100, "\x3f\x97\x99\x2c\x94\x0f\xba\x89\x36\xa6\xb4", 11); *(uint64_t*)0x200002e8 = 0xb; *(uint64_t*)0x200002f0 = 0x20000140; memcpy((void*)0x20000140, "\xc9\x9a\xb6\x04\xeb\x2e\x44\xeb\xf7\xbf\xb7\xb0\x4c\x08\x43\x21\xa3\x0f\x43\x51\xae\xb0\x67\x6b\xb2\x1a\xef\xc3\xbc\x23\x22\xd9\x9a\x5b\x03\x4f\x88\x0a\xa2\x5d\x61\xae\x40\x76\x39\x7c\x30\x35\x7b\x22\xcc\xb7\x79\xeb\xd3\x20\x6a\xc6\x48\xfa\xb9\x08\x36\xdd\x4d\x9e\x73\xdc\x3c\x07\x72\x70\xb5\x7d\xc3\x22\x22\x84\xdd\x3c\xae\x47\x37\x95\x7d\x94\x7d\x76\x5a\x5e\x0e\x91\x9c\xbd\x3e\xf2\xd3\xd9\x52\x2a\x82\x7f\x3f\xe6\x0d\xdc", 106); *(uint64_t*)0x200002f8 = 0x6a; *(uint64_t*)0x20000300 = 0x200001c0; memcpy((void*)0x200001c0, "\x2b\xc5\xa9\xfd\x6c\xc3\x45\x00\x82\x40\x5a\xb6\x07\xa0\xf5\x62\x7b\x40\x58\x9a\x69\x0a\xc5\x91\x58\xac\xf1\x0f\x2a\x1c\xc4\x61\x52\xfa\x5f\x49\x3a\x85\x99\xcc\x6e\xaa\xb5\xd9\x69\x68\xbe\xf1\xa2\x7f\x62\xda\xcf\x64\xd0\x6c\x80\xcf\xb5\xb3\x20\xb9\x77\xc9\x43\x2c\x44\x6f\xa6\xf6\x55\x14\x44\xee\x4c\x59\x98\x85\x32\x60\xd6\x5d\x2c\xb3\xc7\x78\xf4\x4f\xe2\x70\x36\x3b\x4e\xb3\x09\xe2\x4f\xc4\x77\x97\xb5\xbd\x45\x4b\xf4\xd3\xd4\x65\x6f\xa0\x78\xff\x56\xb3\x0f\x4f\x0e\x9d\x5e\x6e\x89\x43\x83\x0a\xd6\xd3\x42\x96\x8c\x22\x4f\x7c\x35\xaf\x01\xa6\x1d\x10\xe1\x55\xfe\xe7\xe0\x22\x7c\xd7\x9a\x79\x77\xb3\xf4\x03\x51\xca\x01\x83\x48\x40\xab\xba\x55\x7d\x36\xbc\x8a\x42\x08\xf9\x0d\xc5\xf5\x1e\x3f\x3d\x44\x5c\x5f\xee\xa7\x93\x68\x16\x4e\xde\xf0\x5d\x24\x74\x8c\xe9\xf0\xa5\x84\x51\xb4\x3d\x98\x91\x90\x2b\xc4\x5e\xc6\x7d\x00\xdf\x1d\xeb\x74\xe6\x5b\x29\xc0\xd0\x95\xdb\xdd\x5b\x9a\x7c", 220); *(uint64_t*)0x20000308 = 0xdc; syscall(SYS_writev, r[0], 0x200002c0ul, 5ul); break; case 2: *(uint32_t*)0x20000340 = 0; *(uint32_t*)0x20000344 = -1; *(uint32_t*)0x20000348 = 0; res = syscall(SYS_getgroups, 3ul, 0x20000340ul); if (res != -1) r[1] = *(uint32_t*)0x20000348; break; case 3: *(uint32_t*)0x200003c0 = 0xc; res = syscall(SYS_getsockopt, -1, 0xffff, 0x11, 0x20000380ul, 0x200003c0ul); if (res != -1) r[2] = *(uint32_t*)0x20000388; break; case 4: syscall(SYS_setregid, r[1], r[2]); break; case 5: res = syscall(SYS_semget, 0x798e2634ul, 0ul, 0xb2603d964b180ce8ul); if (res != -1) r[3] = res; break; case 6: memcpy((void*)0x20000400, "./file0\000", 8); res = syscall(SYS_stat, 0x20000400ul, 0x20000440ul); if (res != -1) r[4] = *(uint32_t*)0x2000045c; break; case 7: res = syscall(SYS_getgid); if (res != -1) r[5] = res; break; case 8: *(uint32_t*)0x20000500 = 0xfffff834; *(uint32_t*)0x20000504 = r[4]; *(uint32_t*)0x20000508 = r[5]; *(uint32_t*)0x2000050c = -1; *(uint32_t*)0x20000510 = 0; *(uint32_t*)0x20000514 = 3; *(uint16_t*)0x20000518 = 9; *(uint16_t*)0x2000051a = 0; *(uint64_t*)0x20000520 = 0; *(uint64_t*)0x20000528 = 0; *(uint64_t*)0x20000530 = 0xfffffffffffffffd; *(uint64_t*)0x20000538 = 0x4535; *(uint64_t*)0x20000540 = 2; *(uint64_t*)0x20000548 = 0; *(uint64_t*)0x20000550 = 0; syscall(SYS_semctl, r[3], 0ul, 1ul, 0x20000500ul); break; case 9: syscall(SYS_seteuid, 0); break; case 10: memcpy((void*)0x20000000, "\xbf\x5b\xc2\xc4\xdd\xcd\x9b\xaa\x7f\x7c\x66\xf9\x17\x26\xa8\xc4\x90\xf6\x91\x85\x14\x0b\x5b\x42\x51\xe8\x67\x01\xc6\xc5\xa6\x0d\x84\x80\x2d\x38\x2a\x0c\x38\xdf\x4a\x28\xfd\x84\x0d\x7e\x14\x06\xa5\xc2\xeb\x5d\x3b\x6b\xc3\x23\xbd\x49\x38\x6c\x4a\x92\x49\x50\x31\x4f\xe6\x17\xf8\xcd\x34\x37\xa4\xaa\x6d\x1c\x6d\x62\x64\x03\x09\xf9\xde\x23\x93\x99\x9b\x11\x47\x68\xd5\x10\xd7\x34\xfd\x72\xd1\x98\xb2\x61\xbd\x61\x81\x14\xbf\x3f\xa3\xe2\xfe\x84\xff\xe6\x5c\x80\xe4\x72\x12\xc4\x9e\x47\xbb\x3a\xaa\x86\x89\x46\x2f\x21\xd5\x18\x80\xd9\x7c\xb4\x45\xd3", 136); break; case 11: memcpy((void*)0x200000c0, "\xc4\xa1\x84\x58\x2c\xaa\x26\x44\x0f\xae\x04\xc4\x41\x0f\x74\xab\x00\x00\x01\x00\xc4\x23\xf5\x78\x4c\xe9\x9d\x40\x44\xdf\x34\x59\x26\x41\x0f\xae\x41\x01\x64\x64\x66\x44\x0f\xe5\xb9\x4e\x9a\xb0\xc4\xc4\x22\x7d\x47\x0f\x41\x0f\x45\x7f\x56\x66\x0f\xdd\xe8", 63); syz_execute_func(0x200000c0); break; case 12: break; case 13: memcpy((void*)0x20000140, "\x64\xd3\x2f\x16\xeb\xd8\x17\xd0\x04\xdc\xb8\x01\x71\x82\x05\xbc\xa1\xd8\x6d\xad\x3c\xb1\x32\xa2\x86\x60\x92\x14\xb7\x39\x5a\x97\xa0\xe8\xfe\xda\x5f\xad\x02\xcc\xe9\xde\xea\x94\xd5\x5a\x75\x0c\x17\xb2\x34\x07\x50\x02\xb9\xdf\x62\x9f\xa6\x8e\x3f\x7d\xa9\x7e\x9c\x2a\x2e\x0a\x95\xd1\x5d\x35\x95\x61\xb1\x47\x74\x40\x34\x2c\xd7\x9c\x7c\xeb\xd6\xbf\x00\x8a\xcd\x1c\x7f\xf1\x46\xa6\xfe\x22\x01\x36\x61\xd8\xc8\xce\x8e\xb1\x7f\x5c\xf3\x89\x2a\xe0\x8b\xba\x46\x54\x5b\x2b\x69\x0a\xb7\xe0\x36\x8a\xec\x4d\x32\xb7\x6d\x7f\xc1\x5d\xd7\xc2\xab\xa1\x84\xd4\x1a\x5e\x5a\xbb\x8d\x71\x6f\x5e\x64\x5e\x17\x67\x13\x8e\xd7\x38\xf3\x15\x79\x5a\xc9\x9e\x22\xfd\x44\xdb\x06\x09\x63\x13\xf4\x72\x9c\xe0\xd3\xbd\x93\x8f\x5b\x65\x20\xef\x93\x76\xfa\x90\x9d\xf6\xb2\x05\xc2\xd3\xf5\x2e\xe4\x3e\x3f\x59\xea\x44\x1b\x7c\x4e\x4d\x5c", 201); memcpy((void*)0x20000240, "\xc1\xb0\x1d\x40\x73\x99\x35\xb1\x21\x7d\x0e\x39\x3c\xdd\x4f\xa4\xef\x8b\xbd\x99\x57\xee\x99\x68\x77\xe4\xca\x15\x5c\x19\x5d\xc1\x66\xf9\x48\x6a\xc4\xdb\x17\xf7\x54\xc4\x89\x38\xa4\x34\x19\xf0\x82\xa8\xc3\x0e\xff\xbe\xf0\x64\xf6\xc8\xb8\x7b\xc9\x30\xe4\x39\xc7\x19\xec\x0a\x11\x99\x04\x0b\x86\x28\x6d\x27\x1f\x25\xaf\x26\xeb\xed\x3f\x55\xc3\x2e\x68\xac\x70\x33\x0d\xf7\x69\x31\xbf\x55\xfa\xe8\x80\x25\x6b\x74\xa9\x23\xf8\xa3\x02\x2c\x31\x0f\x94\xcc\x0c\x62\x33\x02\xa5\xd1\x4b\x3f\x8e\x18\xf4\x15\x99\x88\x28\x66\xea\x02\x42\x86\x4b\x37\xd5\xae\x87\xfb\xcb\x74\x5c\x3e\x26\x42\x3d\x05\xc5\x48\x38\x33\xdf\xcd\xd4\x3d\xc0\xc6\x50\x73\x29\x03\x72\x73\xde\x28\x2e\x3a\x16\xac\x00\xc5\x53\x9c\x30\x94\x63\x98\x4b\x15\x3e\xc6\x25\x0a\x78\x19\x75\xa2\x77\x01\x72\x80\xdb\x1e\x9c\x18\xce\x66\x4d\xf5\x94\x7c\x6c\x18\xbe\xf2\x36\x7e\x61\x63\xb4\x6b\x95\x03\xf7\x00\x70\x5f\xd0\xe8\x9e\xae\x6d\xf0\x88\x4b\xf2\x7c\x00\xe0\x5f\xc5\xef\xc6\x49\x07", 234); syz_usb_connect(0, 0xc9, 0x20000140, 0x20000240); break; case 14: memcpy((void*)0x20000340, "\x36\x4f\xb1\xa4\x17\x26\x3d\xe2\x27\x97\xec\x76\x08\x61\xf3\x85\x2c\xf2\x4f\x79\xe2\xb7\xa5\xc6\x2a\xfa\xd7\xd6\xd4\xd0\x9d\x86\x2f\x8e\xcc\xd0\x2e\x1b\xb9\x89\xe0\xf8\xa8\xad\x91\x54\x42\x01\x64\x04\xc9\x82\x6a\x5c\x0a\x28\x4f\xc7\xa8\x40\x30\x47\x59\xb6\x84\xf3\x57\xb2\xe6\xfe\xcf\xb3\xcc\x81\x57\xc0\x08\xff\x0d\xcf\xf2\x10\x89\x84\x54\x8a\x2a\xd6\x95\xfa\xd9\x51\x2f\x06\xfd\x12\xd6\x6b\xc4\x43\x04\x75\x12\xab\x4e\xf3\x05\x8a\xe6\xc0\xc6\xec\x3f\xd6\x27\xe3\x70\xa1\x51\xae\x71\x9b\x8e\x3a\x77\xd6\x82\xdc\x06\xa9\x3b\xe9\xc2\xaa\x80\x18\xb5\x8a\x94\x92\xcb\x39\x03\x1b\xb5\xab\xf3\x12\x4e\xaa\xb8\x53\x30\xf1\x81\xfc\xcc\xa7\x59\x7b\x4e\xc0\x87\x9f\xcb\xcf\x51\x14\x3f\x98\xc4\x43\xc1\x67\x20\xa6\xe0\x1b\x7e\x07\xdf\x47\x27\xe2\x88\xe1\x3d\xcc\x0b\x7e\x11", 191); memcpy((void*)0x20000400, "\x59\x03\x92\x3c\x7a\x1b\x28\x38\xf3\xc1\x21\x56\x78\x5a\x11\xc8\x1b\x2e\x82\xd9\xa1\x19\x0e\x1b\x9c\x45\x97\x6a\x91\x7c\x00\x29\x4d\xc9\x4d\x53\x54\xe8\xc5\xd6\xa4\xe8\x98\x6d\xa0\x74\xeb\x46\x1e\xd0\x73\x6b\xcb\xed\xe2\xce\xf1\xf1\x9e\x02\x16\xc0\x9e\xb7\x94\xd8\xb9\x75\x4f\xea\x26\xf1\x10\xc8\x32\x48\xc2\x86\xea\xa0\x5a\x69\x84\x4e\xb1\x29\x2f\x59\x4f\x59\xf6\xc9\xbe\xca\x47\xd8\x94\xd4\x4d\xfd\x15\xff\x81\xb7\x6b\x46\x35\x39\x2e\xb5\xed\x43\x1c\xa3\x09\x22\x30", 117); res = syz_usb_connect(4, 0xbf, 0x20000340, 0x20000400); if (res != -1) r[6] = res; break; case 15: syz_usb_disconnect(r[6]); break; } } int main(void) { syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 3ul, 0x1012ul, -1, 0ul, 0ul); use_temporary_dir(); do_sandbox_none(); return 0; } :187:2: error: unknown type name 'uint8_t_t' :188:2: error: unknown type name 'uint8_t_t' :189:2: error: unknown type name 'uint8_t_t' :190:2: error: unknown type name 'uint8_t_t' :191:2: error: unknown type name 'uint16_t_t' :192:2: error: unknown type name 'uint8_t_t' :193:2: error: unknown type name 'uint8_t_t' :194:2: error: unknown type name 'uint8_t_t' :198:2: error: unknown type name 'uint8_t_t' :199:2: error: unknown type name 'uint8_t_t' :200:2: error: unknown type name 'uint16_t_t' :201:2: error: unknown type name 'uint8_t_t' :202:2: error: unknown type name 'uint8_t_t' :203:2: error: unknown type name 'uint8_t_t' :204:2: error: unknown type name 'uint8_t_t' :205:2: error: unknown type name 'uint16_t_t' :206:2: error: unknown type name 'uint16_t_t' :207:2: error: unknown type name 'uint16_t_t' :208:2: error: unknown type name 'uint8_t_t' :209:2: error: unknown type name 'uint8_t_t' :210:2: error: unknown type name 'uint8_t_t' :211:2: error: unknown type name 'uint8_t_t' :215:2: error: unknown type name 'uint8_t_t' :216:2: error: unknown type name 'uint8_t_t' :217:2: error: unknown type name 'uint16_t_t' :218:2: error: unknown type name 'uint8_t_t' :219:2: error: unknown type name 'uint8_t_t' :220:2: error: unknown type name 'uint8_t_t' :221:2: error: unknown type name 'uint8_t_t' :222:2: error: unknown type name 'uint8_t_t' :226:2: error: unknown type name 'uint8_t_t' :227:2: error: unknown type name 'uint8_t_t' :228:2: error: unknown type name 'uint8_t_t' :229:2: error: unknown type name 'uint8_t_t' :230:2: error: unknown type name 'uint8_t_t' :231:2: error: unknown type name 'uint8_t_t' :232:2: error: unknown type name 'uint8_t_t' :233:2: error: unknown type name 'uint8_t_t' :234:2: error: unknown type name 'uint8_t_t' :238:2: error: unknown type name 'uint8_t_t' :239:2: error: unknown type name 'uint8_t_t' :240:2: error: unknown type name 'uint16_t_t' :241:2: error: unknown type name 'uint16_t_t' :242:2: error: unknown type name 'uint16_t_t' :246:2: error: unknown type name 'uint8_t_t' :247:2: error: unknown type name 'uint8_t_t' :248:2: error: unknown type name 'uint16_t_t' :249:2: error: unknown type name 'uint8_t_t' :250:2: error: unknown type name 'uint8_t_t' :251:2: error: unknown type name 'uint8_t_t' :252:2: error: unknown type name 'uint8_t_t' :253:2: error: unknown type name 'uint8_t_t' :254:2: error: unknown type name 'uint8_t_t' : In function 'vhci_usb_recv': :561:2: error: unknown type name 'uint8_t_t'; did you mean 'uint8_t'? :561:20: error: 'uint8_t_t' undeclared (first use in this function); did you mean 'uint8_t'? :561:20: note: each undeclared identifier is reported only once for each function it appears in :561:30: error: expected expression before ')' token : In function 'vhci_usb_send': :576:2: error: unknown type name 'uint8_t_t'; did you mean 'uint8_t'? :576:20: error: 'uint8_t_t' undeclared (first use in this function); did you mean 'uint8_t'? :576:30: error: expected expression before ')' token : In function 'syz_usb_connect_impl': :637:63: error: unknown type name 'usb_ctrlrequest' :642:55: error: unknown type name 'usb_ctrlrequest' :654:8: error: 'uint32_t_t' undeclared (first use in this function); did you mean 'uint32_t'? At top level: :702:13: error: 'setup_usb' defined but not used [-Werror=unused-function] cc1: all warnings being treated as errors compiler invocation: /syzkaller/netbsd/src/../tools/bin/x86_64--netbsd-g++ [-o /tmp/syz-executor530370355 -DGOOS_netbsd=1 -DGOARCH_amd64=1 -DHOSTGOOS_linux=1 -x c - -m64 --sysroot /syzkaller/netbsd/src/../dest/ -O2 -pthread -Wall -Werror -Wparentheses -Wframe-larger-than=16384] --- FAIL: TestGenerate/netbsd/amd64/8 (0.76s) csource_test.go:123: opts: {Threaded:true Collide:false Repeat:true RepeatTimes:0 Procs:0 Sandbox:setuid Fault:false FaultCall:0 FaultNth:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false USB:false UseTmpDir:true HandleSegv:false Repro:false Trace:false} program: r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c) writev(r0, &(0x7f00000002c0)=[{&(0x7f0000000000)="25c5f6768692f16a6b02337bc5f24e95c2e574f7bd23da78ff2241439caced122e33ab16d377843415781fa508cd635f2fd04113204ed9bda7396e99a38a2f10e9c7398b5a64c49d98664bd14975be7076a83638a7da3095f0e027bd161ccd5c994f8b31d535a3ce4c57812d9682f3ebb10e05a7142210515b668d1357d91aaabb6ad88aed6b9f2143d062e0b5", 0x8d}, {&(0x7f00000000c0)="e8987e8f864e9d38b55615b659d14cae9e91a9532213ffb465b61b", 0x1b}, {&(0x7f0000000100)="3f97992c940fba8936a6b4", 0xb}, {&(0x7f0000000140)="c99ab604eb2e44ebf7bfb7b04c084321a30f4351aeb0676bb21aefc3bc2322d99a5b034f880aa25d61ae4076397c30357b22ccb779ebd3206ac648fab90836dd4d9e73dc3c077270b57dc3222284dd3cae4737957d947d765a5e0e919cbd3ef2d3d9522a827f3fe60ddc", 0x6a}, {&(0x7f00000001c0)="2bc5a9fd6cc3450082405ab607a0f5627b40589a690ac59158acf10f2a1cc46152fa5f493a8599cc6eaab5d96968bef1a27f62dacf64d06c80cfb5b320b977c9432c446fa6f6551444ee4c5998853260d65d2cb3c778f44fe270363b4eb309e24fc47797b5bd454bf4d3d4656fa078ff56b30f4f0e9d5e6e8943830ad6d342968c224f7c35af01a61d10e155fee7e0227cd79a7977b3f40351ca01834840abba557d36bc8a4208f90dc5f51e3f3d445c5feea79368164edef05d24748ce9f0a58451b43d9891902bc45ec67d00df1deb74e65b29c0d095dbdd5b9a7c", 0xdc}], 0x5) getgroups(0x3, &(0x7f0000000340)=[0x0, 0xffffffffffffffff, 0x0]) getsockopt$sock_cred(0xffffffffffffffff, 0xffff, 0x11, &(0x7f0000000380)={0x0, 0x0, 0x0}, &(0x7f00000003c0)=0xc) setregid(r1, r2) r3 = semget(0x1, 0x0, 0xb2603d964b180ce8) stat(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0}) r5 = getgid() semctl$IPC_SET(r3, 0x0, 0x1, &(0x7f0000000500)={{0xfffff834, r4, r5, 0xffffffffffffffff, 0x0, 0x3, 0x9}, 0xfffffffffffffffd, 0x4535, 0x2}) seteuid(0x0) syz_emit_ethernet(0x88, &(0x7f0000000000)="bf5bc2c4ddcd9baa7f7c66f91726a8c490f69185140b5b4251e86701c6c5a60d84802d382a0c38df4a28fd840d7e1406a5c2eb5d3b6bc323bd49386c4a924950314fe617f8cd3437a4aa6d1c6d62640309f9de2393999b114768d510d734fd72d198b261bd618114bf3fa3e2fe84ffe65c80e47212c49e47bb3aaa8689462f21d51880d97cb445d3") syz_execute_func(&(0x7f00000000c0)="c4a184582caa26440fae04c4410f74ab00000100c423f5784ce99d4044df345926410fae4101646466440fe5b94e9ab0c4c4227d470f410f457f56660fdde8") syz_extract_tcp_res(&(0x7f0000000100), 0x6, 0x1) syz_usb_connect(0x0, 0xc9, &(0x7f0000000140)="64d32f16ebd817d004dcb801718205bca1d86dad3cb132a286609214b7395a97a0e8feda5fad02cce9deea94d55a750c17b234075002b9df629fa68e3f7da97e9c2a2e0a95d15d359561b1477440342cd79c7cebd6bf008acd1c7ff146a6fe22013661d8c8ce8eb17f5cf3892ae08bba46545b2b690ab7e0368aec4d32b76d7fc15dd7c2aba184d41a5e5abb8d716f5e645e1767138ed738f315795ac99e22fd44db06096313f4729ce0d3bd938f5b6520ef9376fa909df6b205c2d3f52ee43e3f59ea441b7c4e4d5c", &(0x7f0000000240)="c1b01d40739935b1217d0e393cdd4fa4ef8bbd9957ee996877e4ca155c195dc166f9486ac4db17f754c48938a43419f082a8c30effbef064f6c8b87bc930e439c719ec0a1199040b86286d271f25af26ebed3f55c32e68ac70330df76931bf55fae880256b74a923f8a3022c310f94cc0c623302a5d14b3f8e18f41599882866ea0242864b37d5ae87fbcb745c3e26423d05c5483833dfcdd43dc0c6507329037273de282e3a16ac00c5539c309463984b153ec6250a781975a277017280db1e9c18ce664df5947c6c18bef2367e6163b46b9503f700705fd0e89eae6df0884bf27c00e05fc5efc64907") r6 = syz_usb_connect(0x4, 0xbf, &(0x7f0000000340)="364fb1a417263de22797ec760861f3852cf24f79e2b7a5c62afad7d6d4d09d862f8eccd02e1bb989e0f8a8ad915442016404c9826a5c0a284fc7a840304759b684f357b2e6fecfb3cc8157c008ff0dcff2108984548a2ad695fad9512f06fd12d66bc443047512ab4ef3058ae6c0c6ec3fd627e370a151ae719b8e3a77d682dc06a93be9c2aa8018b58a9492cb39031bb5abf3124eaab85330f181fccca7597b4ec0879fcbcf51143f98c443c16720a6e01b7e07df4727e288e13dcc0b7e11", &(0x7f0000000400)="5903923c7a1b2838f3c12156785a11c81b2e82d9a1190e1b9c45976a917c00294dc94d5354e8c5d6a4e8986da074eb461ed0736bcbede2cef1f19e0216c09eb794d8b9754fea26f110c83248c286eaa05a69844eb1292f594f59f6c9beca47d894d44dfd15ff81b76b4635392eb5ed431ca3092230") syz_usb_disconnect(r6) csource_test.go:124: failed to build program: // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include static unsigned long long procid; static void kill_and_wait(int pid, int* status) { kill(pid, SIGKILL); while (waitpid(-1, status, 0) != pid) { } } static void sleep_ms(uint64_t ms) { usleep(ms * 1000); } static uint64_t current_time_ms(void) { struct timespec ts; if (clock_gettime(CLOCK_MONOTONIC, &ts)) exit(1); return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; } static void use_temporary_dir(void) { char tmpdir_template[] = "./syzkaller.XXXXXX"; char* tmpdir = mkdtemp(tmpdir_template); if (!tmpdir) exit(1); if (chmod(tmpdir, 0777)) exit(1); if (chdir(tmpdir)) exit(1); } static void remove_dir(const char* dir) { DIR* dp; struct dirent* ep; dp = opendir(dir); if (dp == NULL) exit(1); while ((ep = readdir(dp))) { if (strcmp(ep->d_name, ".") == 0 || strcmp(ep->d_name, "..") == 0) continue; char filename[FILENAME_MAX]; snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name); struct stat st; if (lstat(filename, &st)) exit(1); if (S_ISDIR(st.st_mode)) { remove_dir(filename); continue; } if (unlink(filename)) exit(1); } closedir(dp); if (rmdir(dir)) exit(1); } static void thread_start(void* (*fn)(void*), void* arg) { pthread_t th; pthread_attr_t attr; pthread_attr_init(&attr); pthread_attr_setstacksize(&attr, 128 << 10); int i; for (i = 0; i < 100; i++) { if (pthread_create(&th, &attr, fn, arg) == 0) { pthread_attr_destroy(&attr); return; } if (errno == EAGAIN) { usleep(50); continue; } break; } exit(1); } typedef struct { pthread_mutex_t mu; pthread_cond_t cv; int state; } event_t; static void event_init(event_t* ev) { if (pthread_mutex_init(&ev->mu, 0)) exit(1); if (pthread_cond_init(&ev->cv, 0)) exit(1); ev->state = 0; } static void event_reset(event_t* ev) { ev->state = 0; } static void event_set(event_t* ev) { pthread_mutex_lock(&ev->mu); if (ev->state) exit(1); ev->state = 1; pthread_mutex_unlock(&ev->mu); pthread_cond_broadcast(&ev->cv); } static void event_wait(event_t* ev) { pthread_mutex_lock(&ev->mu); while (!ev->state) pthread_cond_wait(&ev->cv, &ev->mu); pthread_mutex_unlock(&ev->mu); } static int event_isset(event_t* ev) { pthread_mutex_lock(&ev->mu); int res = ev->state; pthread_mutex_unlock(&ev->mu); return res; } static int event_timedwait(event_t* ev, uint64_t timeout) { uint64_t start = current_time_ms(); uint64_t now = start; pthread_mutex_lock(&ev->mu); for (;;) { if (ev->state) break; uint64_t remain = timeout - (now - start); struct timespec ts; ts.tv_sec = remain / 1000; ts.tv_nsec = (remain % 1000) * 1000 * 1000; pthread_cond_timedwait(&ev->cv, &ev->mu, &ts); now = current_time_ms(); if (now - start > timeout) break; } int res = ev->state; pthread_mutex_unlock(&ev->mu); return res; } /* -------------------------------------------------------------------------- */ /* * Redefinitions to match the linux types used in common_usb.h. */ struct usb_endpoint_descriptor { uint8_t_t bLength; uint8_t_t bDescriptorType; uint8_t_t bEndpointAddress; uint8_t_t bmAttributes; uint16_t_t wMaxPacketSize; uint8_t_t bInterval; uint8_t_t bRefresh; uint8_t_t bSynchAddress; } __attribute__((packed)); struct usb_device_descriptor { uint8_t_t bLength; uint8_t_t bDescriptorType; uint16_t_t bcdUSB; uint8_t_t bDeviceClass; uint8_t_t bDeviceSubClass; uint8_t_t bDeviceProtocol; uint8_t_t bMaxPacketSize0; uint16_t_t idVendor; uint16_t_t idProduct; uint16_t_t bcdDevice; uint8_t_t iManufacturer; uint8_t_t iProduct; uint8_t_t iSerialNumber; uint8_t_t bNumConfigurations; } __attribute__((packed)); struct usb_config_descriptor { uint8_t_t bLength; uint8_t_t bDescriptorType; uint16_t_t wTotalLength; uint8_t_t bNumInterfaces; uint8_t_t bConfigurationValue; uint8_t_t iConfiguration; uint8_t_t bmAttributes; uint8_t_t bMaxPower; } __attribute__((packed)); struct usb_interface_descriptor { uint8_t_t bLength; uint8_t_t bDescriptorType; uint8_t_t bInterfaceNumber; uint8_t_t bAlternateSetting; uint8_t_t bNumEndpoints; uint8_t_t bInterfaceClass; uint8_t_t bInterfaceSubClass; uint8_t_t bInterfaceProtocol; uint8_t_t iInterface; } __attribute__((packed)); struct usb_ctrlrequest { uint8_t_t bRequestType; uint8_t_t bRequest; uint16_t_t wValue; uint16_t_t wIndex; uint16_t_t wLength; } __attribute__((packed)); struct usb_qualifier_descriptor { uint8_t_t bLength; uint8_t_t bDescriptorType; uint16_t_t bcdUSB; uint8_t_t bDeviceClass; uint8_t_t bDeviceSubClass; uint8_t_t bDeviceProtocol; uint8_t_t bMaxPacketSize0; uint8_t_t bNumConfigurations; uint8_t_t bRESERVED; } __attribute__((packed)); #define USB_TYPE_MASK (0x03 << 5) #define USB_TYPE_STANDARD (0x00 << 5) #define USB_TYPE_CLASS (0x01 << 5) #define USB_TYPE_VENDOR (0x02 << 5) #define USB_TYPE_RESERVED (0x03 << 5) #define USB_DT_DEVICE 0x01 #define USB_DT_CONFIG 0x02 #define USB_DT_STRING 0x03 #define USB_DT_INTERFACE 0x04 #define USB_DT_ENDPOINT 0x05 #define USB_DT_DEVICE_QUALIFIER 0x06 #define USB_DT_OTHER_SPEED_CONFIG 0x07 #define USB_DT_INTERFACE_POWER 0x08 #define USB_DT_OTG 0x09 #define USB_DT_DEBUG 0x0a #define USB_DT_INTERFACE_ASSOCIATION 0x0b #define USB_DT_SECURITY 0x0c #define USB_DT_KEY 0x0d #define USB_DT_ENCRYPTION_TYPE 0x0e #define USB_DT_BOS 0x0f #define USB_DT_DEVICE_CAPABILITY 0x10 #define USB_DT_WIRELESS_ENDPOINT_COMP 0x11 #define USB_DT_WIRE_ADAPTER 0x21 #define USB_DT_RPIPE 0x22 #define USB_DT_CS_RADIO_CONTROL 0x23 #define USB_DT_PIPE_USAGE 0x24 #define USB_DT_SS_ENDPOINT_COMP 0x30 #define USB_DT_SSP_ISOC_ENDPOINT_COMP 0x31 #define USB_REQ_GET_STATUS 0x00 #define USB_REQ_CLEAR_FEATURE 0x01 #define USB_REQ_SET_FEATURE 0x03 #define USB_REQ_SET_ADDRESS 0x05 #define USB_REQ_GET_DESCRIPTOR 0x06 #define USB_REQ_SET_DESCRIPTOR 0x07 #define USB_REQ_GET_CONFIGURATION 0x08 #define USB_REQ_SET_CONFIGURATION 0x09 #define USB_REQ_GET_INTERFACE 0x0A #define USB_REQ_SET_INTERFACE 0x0B #define USB_REQ_SYNCH_FRAME 0x0C #define USB_REQ_SET_SEL 0x30 #define USB_REQ_SET_ISOCH_DELAY 0x31 #define USB_REQ_SET_ENCRYPTION 0x0D #define USB_REQ_GET_ENCRYPTION 0x0E #define USB_REQ_RPIPE_ABORT 0x0E #define USB_REQ_SET_HANDSHAKE 0x0F #define USB_REQ_RPIPE_RESET 0x0F #define USB_REQ_GET_HANDSHAKE 0x10 #define USB_REQ_SET_CONNECTION 0x11 #define USB_REQ_SET_SECURITY_DATA 0x12 #define USB_REQ_GET_SECURITY_DATA 0x13 #define USB_REQ_SET_WUSB_DATA 0x14 #define USB_REQ_LOOPBACK_DATA_WRITE 0x15 #define USB_REQ_LOOPBACK_DATA_READ 0x16 #define USB_REQ_SET_INTERFACE_DS 0x17 #define USB_REQ_GET_PARTNER_PDO 20 #define USB_REQ_GET_BATTERY_STATUS 21 #define USB_REQ_SET_PDO 22 #define USB_REQ_GET_VDM 23 #define USB_REQ_SEND_VDM 24 #define USB_MAX_IFACE_NUM 4 #define USB_MAX_EP_NUM 32 #define USB_MAX_FDS 6 struct usb_endpoint_index { struct usb_endpoint_descriptor desc; int handle; }; struct usb_iface_index { struct usb_interface_descriptor* iface; uint8_t bInterfaceNumber; uint8_t bAlternateSetting; uint8_t bInterfaceClass; struct usb_endpoint_index eps[USB_MAX_EP_NUM]; int eps_num; }; struct usb_device_index { struct usb_device_descriptor* dev; struct usb_config_descriptor* config; uint8_t bDeviceClass; uint8_t bMaxPower; int config_length; struct usb_iface_index ifaces[USB_MAX_IFACE_NUM]; int ifaces_num; int iface_cur; }; struct usb_info { int fd; struct usb_device_index index; }; static struct usb_info usb_devices[USB_MAX_FDS]; static int usb_devices_num; static bool parse_usb_descriptor(const char* buffer, size_t length, struct usb_device_index* index) { if (length < sizeof(*index->dev) + sizeof(*index->config)) return false; memset(index, 0, sizeof(*index)); index->dev = (struct usb_device_descriptor*)buffer; index->config = (struct usb_config_descriptor*)(buffer + sizeof(*index->dev)); index->bDeviceClass = index->dev->bDeviceClass; index->bMaxPower = index->config->bMaxPower; index->config_length = length - sizeof(*index->dev); index->iface_cur = -1; size_t offset = 0; while (true) { if (offset + 1 >= length) break; uint8_t desc_length = buffer[offset]; uint8_t desc_type = buffer[offset + 1]; if (desc_length <= 2) break; if (offset + desc_length > length) break; if (desc_type == USB_DT_INTERFACE && index->ifaces_num < USB_MAX_IFACE_NUM) { struct usb_interface_descriptor* iface = (struct usb_interface_descriptor*)(buffer + offset); index->ifaces[index->ifaces_num].iface = iface; index->ifaces[index->ifaces_num].bInterfaceNumber = iface->bInterfaceNumber; index->ifaces[index->ifaces_num].bAlternateSetting = iface->bAlternateSetting; index->ifaces[index->ifaces_num].bInterfaceClass = iface->bInterfaceClass; index->ifaces_num++; } if (desc_type == USB_DT_ENDPOINT && index->ifaces_num > 0) { struct usb_iface_index* iface = &index->ifaces[index->ifaces_num - 1]; if (iface->eps_num < USB_MAX_EP_NUM) { memcpy(&iface->eps[iface->eps_num].desc, buffer + offset, sizeof(iface->eps[iface->eps_num].desc)); iface->eps_num++; } } offset += desc_length; } return true; } static struct usb_device_index* add_usb_index(int fd, const char* dev, size_t dev_len) { int i = __atomic_fetch_add(&usb_devices_num, 1, __ATOMIC_RELAXED); if (i >= USB_MAX_FDS) return NULL; int rv = 0; rv = parse_usb_descriptor(dev, dev_len, &usb_devices[i].index); if (!rv) return NULL; __atomic_store_n(&usb_devices[i].fd, fd, __ATOMIC_RELEASE); return &usb_devices[i].index; } static struct usb_device_index* lookup_usb_index(int fd) { int i; for (i = 0; i < USB_MAX_FDS; i++) { if (__atomic_load_n(&usb_devices[i].fd, __ATOMIC_ACQUIRE) == fd) { return &usb_devices[i].index; } } return NULL; } struct vusb_connect_string_descriptor { uint32_t len; char* str; } __attribute__((packed)); struct vusb_connect_descriptors { uint32_t qual_len; char* qual; uint32_t bos_len; char* bos; uint32_t strs_len; struct vusb_connect_string_descriptor strs[0]; } __attribute__((packed)); static const char default_string[] = { 8, USB_DT_STRING, 's', 0, 'y', 0, 'z', 0 }; static const char default_lang_id[] = { 4, USB_DT_STRING, 0x09, 0x04 }; static bool lookup_connect_response_in(int fd, const struct vusb_connect_descriptors* descs, const struct usb_ctrlrequest* ctrl, char** response_data, uint32_t* response_length) { struct usb_device_index* index = lookup_usb_index(fd); uint8_t str_idx; if (!index) return false; switch (ctrl->bRequestType & USB_TYPE_MASK) { case USB_TYPE_STANDARD: switch (ctrl->bRequest) { case USB_REQ_GET_DESCRIPTOR: switch (ctrl->wValue >> 8) { case USB_DT_DEVICE: *response_data = (char*)index->dev; *response_length = sizeof(*index->dev); return true; case USB_DT_CONFIG: *response_data = (char*)index->config; *response_length = index->config_length; return true; case USB_DT_STRING: str_idx = (uint8_t)ctrl->wValue; if (descs && str_idx < descs->strs_len) { *response_data = descs->strs[str_idx].str; *response_length = descs->strs[str_idx].len; return true; } if (str_idx == 0) { *response_data = (char*)&default_lang_id[0]; *response_length = default_lang_id[0]; return true; } *response_data = (char*)&default_string[0]; *response_length = default_string[0]; return true; case USB_DT_BOS: *response_data = descs->bos; *response_length = descs->bos_len; return true; case USB_DT_DEVICE_QUALIFIER: if (!descs->qual) { struct usb_qualifier_descriptor* qual = (struct usb_qualifier_descriptor*)response_data; qual->bLength = sizeof(*qual); qual->bDescriptorType = USB_DT_DEVICE_QUALIFIER; qual->bcdUSB = index->dev->bcdUSB; qual->bDeviceClass = index->dev->bDeviceClass; qual->bDeviceSubClass = index->dev->bDeviceSubClass; qual->bDeviceProtocol = index->dev->bDeviceProtocol; qual->bMaxPacketSize0 = index->dev->bMaxPacketSize0; qual->bNumConfigurations = index->dev->bNumConfigurations; qual->bRESERVED = 0; *response_length = sizeof(*qual); return true; } *response_data = descs->qual; *response_length = descs->qual_len; return true; default: break; } break; default: break; } break; default: break; } return false; } typedef bool (*lookup_connect_out_response_t)(int fd, const struct vusb_connect_descriptors* descs, const struct usb_ctrlrequest* ctrl, bool* done); static bool lookup_connect_response_out_generic(int fd, const struct vusb_connect_descriptors* descs, const struct usb_ctrlrequest* ctrl, bool* done) { switch (ctrl->bRequestType & USB_TYPE_MASK) { case USB_TYPE_STANDARD: switch (ctrl->bRequest) { case USB_REQ_SET_CONFIGURATION: *done = true; return true; default: break; } break; } return false; } /* -------------------------------------------------------------------------- */ static int vhci_open(void) { return open("/dev/vhci", O_RDWR); } static int vhci_setport(int fd, u_int port) { struct vhci_ioc_set_port args; args.port = port; return ioctl(fd, VHCI_IOC_SET_PORT, &args); } static int vhci_usb_attach(int fd) { return ioctl(fd, VHCI_IOC_USB_ATTACH, NULL); } static int vhci_usb_recv(int fd, void* buf, size_t size) { uint8_t_t* ptr = (uint8_t_t*)buf; ssize_t done; while (1) { done = read(fd, ptr, size); if (done < 0) return -1; if ((size_t)done == size) return 0; size -= done; ptr += done; } } static int vhci_usb_send(int fd, void* buf, size_t size) { uint8_t_t* ptr = (uint8_t_t*)buf; ssize_t done; while (1) { done = write(fd, ptr, size); if (done <= 0) return -1; if ((size_t)done == size) return 0; size -= done; ptr += done; } } /* -------------------------------------------------------------------------- */ static volatile long syz_usb_connect_impl(uint64_t speed, uint64_t dev_len, const char* dev, const struct vusb_connect_descriptors* descs, lookup_connect_out_response_t lookup_connect_response_out) { struct usb_device_index* index; int portnum, fd, rv; bool done; portnum = procid + 1; if (!dev) { return -1; } if (portnum != 1) { /* For now, we support only one proc. */ return -1; } fd = vhci_open(); if (fd < 0) { return -1; } index = add_usb_index(fd, dev, dev_len); if (!index) { goto err; } rv = vhci_setport(fd, portnum); if (rv != 0) { goto err; } rv = vhci_usb_attach(fd); if (rv != 0) { goto err; } done = false; while (!done) { vhci_request_t req; rv = vhci_usb_recv(fd, &req, sizeof(req)); if (rv != 0) { goto err; } if (req.type != VHCI_REQ_CTRL) { goto err; } char* response_data = NULL; uint32_t response_length = 0; char data[4096]; if (req.u.ctrl.bmRequestType & UE_DIR_IN) { bool response_found = false; response_found = lookup_connect_response_in(fd, descs, (const usb_ctrlrequest*)&req.u.ctrl, &response_data, &response_length); if (!response_found) { goto err; } } else { if (!lookup_connect_response_out(fd, descs, (const usb_ctrlrequest*)&req.u.ctrl, &done)) { goto err; } response_data = NULL; response_length = UGETW(req.u.ctrl.wLength); } if ((req.u.ctrl.bmRequestType & USB_TYPE_MASK) == USB_TYPE_STANDARD && req.u.ctrl.bRequest == USB_REQ_SET_CONFIGURATION) { /* TODO: possibly revisit */ } if (response_length > sizeof(data)) response_length = 0; if ((uint32_t_t)UGETW(req.u.ctrl.wLength) < response_length) response_length = UGETW(req.u.ctrl.wLength); if (response_data) memcpy(data, response_data, response_length); else memset(data, 0, response_length); if (req.u.ctrl.bmRequestType & UE_DIR_IN) { if (response_length > 0) { vhci_response_t res; res.size = response_length; rv = vhci_usb_send(fd, &res, sizeof(res)); if (rv == 0) rv = vhci_usb_send(fd, data, response_length); } } else { rv = vhci_usb_recv(fd, data, response_length); } if (rv < 0) { goto err; } } sleep_ms(200); return fd; err: close(fd); return -1; } static volatile long syz_usb_connect(volatile long a0, volatile long a1, volatile long a2, volatile long a3) { uint64_t speed = a0; uint64_t dev_len = a1; const char* dev = (const char*)a2; const struct vusb_connect_descriptors* descs = (const struct vusb_connect_descriptors*)a3; return syz_usb_connect_impl(speed, dev_len, dev, descs, &lookup_connect_response_out_generic); } static volatile long syz_usb_disconnect(volatile long a0) { int fd = a0; int rv = close(fd); sleep_ms(200); return rv; } static void setup_usb(void) { if (chmod("/dev/vhci", 0666)) exit(1); } static void sandbox_common() { if (setsid() == -1) exit(1); struct rlimit rlim; rlim.rlim_cur = rlim.rlim_max = 8 << 20; setrlimit(RLIMIT_MEMLOCK, &rlim); rlim.rlim_cur = rlim.rlim_max = 1 << 20; setrlimit(RLIMIT_FSIZE, &rlim); rlim.rlim_cur = rlim.rlim_max = 1 << 20; setrlimit(RLIMIT_STACK, &rlim); rlim.rlim_cur = rlim.rlim_max = 0; setrlimit(RLIMIT_CORE, &rlim); rlim.rlim_cur = rlim.rlim_max = 256; setrlimit(RLIMIT_NOFILE, &rlim); } static void loop(); static int wait_for_loop(int pid) { if (pid < 0) exit(1); int status = 0; while (waitpid(-1, &status, WUNTRACED) != pid) { } return WEXITSTATUS(status); } static int do_sandbox_setuid(void) { int pid = fork(); if (pid != 0) return wait_for_loop(pid); sandbox_common(); char pwbuf[1024]; struct passwd *pw, pwres; if (getpwnam_r("nobody", &pwres, pwbuf, sizeof(pwbuf), &pw) != 0 || !pw) exit(1); if (setgroups(0, NULL)) exit(1); if (setgid(pw->pw_gid)) exit(1); if (setuid(pw->pw_uid)) exit(1); loop(); exit(1); } static long syz_execute_func(volatile long text) { volatile long p[8] = {0}; (void)p; asm volatile("" ::"r"(0l), "r"(1l), "r"(2l), "r"(3l), "r"(4l), "r"(5l), "r"(6l), "r"(7l), "r"(8l), "r"(9l), "r"(10l), "r"(11l), "r"(12l), "r"(13l)); ((void (*)(void))(text))(); return 0; } struct thread_t { int created, call; event_t ready, done; }; static struct thread_t threads[16]; static void execute_call(int call); static int running; static void* thr(void* arg) { struct thread_t* th = (struct thread_t*)arg; for (;;) { event_wait(&th->ready); event_reset(&th->ready); execute_call(th->call); __atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED); event_set(&th->done); } return 0; } static void execute_one(void) { int i, call, thread; for (call = 0; call < 16; call++) { for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0])); thread++) { struct thread_t* th = &threads[thread]; if (!th->created) { th->created = 1; event_init(&th->ready); event_init(&th->done); event_set(&th->done); thread_start(thr, th); } if (!event_isset(&th->done)) continue; event_reset(&th->done); th->call = call; __atomic_fetch_add(&running, 1, __ATOMIC_RELAXED); event_set(&th->ready); event_timedwait(&th->done, 45 + (call == 13 ? 3000 : 0) + (call == 14 ? 3000 : 0) + (call == 15 ? 300 : 0)); break; } } for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++) sleep_ms(1); } static void execute_one(void); #define WAIT_FLAGS 0 static void loop(void) { int iter; for (iter = 0;; iter++) { char cwdbuf[32]; sprintf(cwdbuf, "./%d", iter); if (mkdir(cwdbuf, 0777)) exit(1); int pid = fork(); if (pid < 0) exit(1); if (pid == 0) { if (chdir(cwdbuf)) exit(1); execute_one(); exit(0); } int status = 0; uint64_t start = current_time_ms(); for (;;) { if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) break; sleep_ms(1); if (current_time_ms() - start < 5 * 1000) continue; kill_and_wait(pid, &status); break; } remove_dir(cwdbuf); } } #ifndef SYS_dup2 #define SYS_dup2 90 #endif #ifndef SYS_getgid #define SYS_getgid 47 #endif #ifndef SYS_getgroups #define SYS_getgroups 79 #endif #ifndef SYS_getsockopt #define SYS_getsockopt 118 #endif #ifndef SYS_mmap #define SYS_mmap 197 #endif #ifndef SYS_semctl #define SYS_semctl 442 #endif #ifndef SYS_semget #define SYS_semget 221 #endif #ifndef SYS_seteuid #define SYS_seteuid 183 #endif #ifndef SYS_setregid #define SYS_setregid 127 #endif #ifndef SYS_stat #define SYS_stat 439 #endif #ifndef SYS_writev #define SYS_writev 121 #endif uint64_t r[7] = {0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}; void execute_call(int call) { intptr_t res = 0; switch (call) { case 0: res = syscall(SYS_dup2, -1, 0xffffff9c); if (res != -1) r[0] = res; break; case 1: *(uint64_t*)0x200002c0 = 0x20000000; memcpy((void*)0x20000000, "\x25\xc5\xf6\x76\x86\x92\xf1\x6a\x6b\x02\x33\x7b\xc5\xf2\x4e\x95\xc2\xe5\x74\xf7\xbd\x23\xda\x78\xff\x22\x41\x43\x9c\xac\xed\x12\x2e\x33\xab\x16\xd3\x77\x84\x34\x15\x78\x1f\xa5\x08\xcd\x63\x5f\x2f\xd0\x41\x13\x20\x4e\xd9\xbd\xa7\x39\x6e\x99\xa3\x8a\x2f\x10\xe9\xc7\x39\x8b\x5a\x64\xc4\x9d\x98\x66\x4b\xd1\x49\x75\xbe\x70\x76\xa8\x36\x38\xa7\xda\x30\x95\xf0\xe0\x27\xbd\x16\x1c\xcd\x5c\x99\x4f\x8b\x31\xd5\x35\xa3\xce\x4c\x57\x81\x2d\x96\x82\xf3\xeb\xb1\x0e\x05\xa7\x14\x22\x10\x51\x5b\x66\x8d\x13\x57\xd9\x1a\xaa\xbb\x6a\xd8\x8a\xed\x6b\x9f\x21\x43\xd0\x62\xe0\xb5", 141); *(uint64_t*)0x200002c8 = 0x8d; *(uint64_t*)0x200002d0 = 0x200000c0; memcpy((void*)0x200000c0, "\xe8\x98\x7e\x8f\x86\x4e\x9d\x38\xb5\x56\x15\xb6\x59\xd1\x4c\xae\x9e\x91\xa9\x53\x22\x13\xff\xb4\x65\xb6\x1b", 27); *(uint64_t*)0x200002d8 = 0x1b; *(uint64_t*)0x200002e0 = 0x20000100; memcpy((void*)0x20000100, "\x3f\x97\x99\x2c\x94\x0f\xba\x89\x36\xa6\xb4", 11); *(uint64_t*)0x200002e8 = 0xb; *(uint64_t*)0x200002f0 = 0x20000140; memcpy((void*)0x20000140, "\xc9\x9a\xb6\x04\xeb\x2e\x44\xeb\xf7\xbf\xb7\xb0\x4c\x08\x43\x21\xa3\x0f\x43\x51\xae\xb0\x67\x6b\xb2\x1a\xef\xc3\xbc\x23\x22\xd9\x9a\x5b\x03\x4f\x88\x0a\xa2\x5d\x61\xae\x40\x76\x39\x7c\x30\x35\x7b\x22\xcc\xb7\x79\xeb\xd3\x20\x6a\xc6\x48\xfa\xb9\x08\x36\xdd\x4d\x9e\x73\xdc\x3c\x07\x72\x70\xb5\x7d\xc3\x22\x22\x84\xdd\x3c\xae\x47\x37\x95\x7d\x94\x7d\x76\x5a\x5e\x0e\x91\x9c\xbd\x3e\xf2\xd3\xd9\x52\x2a\x82\x7f\x3f\xe6\x0d\xdc", 106); *(uint64_t*)0x200002f8 = 0x6a; *(uint64_t*)0x20000300 = 0x200001c0; memcpy((void*)0x200001c0, "\x2b\xc5\xa9\xfd\x6c\xc3\x45\x00\x82\x40\x5a\xb6\x07\xa0\xf5\x62\x7b\x40\x58\x9a\x69\x0a\xc5\x91\x58\xac\xf1\x0f\x2a\x1c\xc4\x61\x52\xfa\x5f\x49\x3a\x85\x99\xcc\x6e\xaa\xb5\xd9\x69\x68\xbe\xf1\xa2\x7f\x62\xda\xcf\x64\xd0\x6c\x80\xcf\xb5\xb3\x20\xb9\x77\xc9\x43\x2c\x44\x6f\xa6\xf6\x55\x14\x44\xee\x4c\x59\x98\x85\x32\x60\xd6\x5d\x2c\xb3\xc7\x78\xf4\x4f\xe2\x70\x36\x3b\x4e\xb3\x09\xe2\x4f\xc4\x77\x97\xb5\xbd\x45\x4b\xf4\xd3\xd4\x65\x6f\xa0\x78\xff\x56\xb3\x0f\x4f\x0e\x9d\x5e\x6e\x89\x43\x83\x0a\xd6\xd3\x42\x96\x8c\x22\x4f\x7c\x35\xaf\x01\xa6\x1d\x10\xe1\x55\xfe\xe7\xe0\x22\x7c\xd7\x9a\x79\x77\xb3\xf4\x03\x51\xca\x01\x83\x48\x40\xab\xba\x55\x7d\x36\xbc\x8a\x42\x08\xf9\x0d\xc5\xf5\x1e\x3f\x3d\x44\x5c\x5f\xee\xa7\x93\x68\x16\x4e\xde\xf0\x5d\x24\x74\x8c\xe9\xf0\xa5\x84\x51\xb4\x3d\x98\x91\x90\x2b\xc4\x5e\xc6\x7d\x00\xdf\x1d\xeb\x74\xe6\x5b\x29\xc0\xd0\x95\xdb\xdd\x5b\x9a\x7c", 220); *(uint64_t*)0x20000308 = 0xdc; syscall(SYS_writev, r[0], 0x200002c0ul, 5ul); break; case 2: *(uint32_t*)0x20000340 = 0; *(uint32_t*)0x20000344 = -1; *(uint32_t*)0x20000348 = 0; res = syscall(SYS_getgroups, 3ul, 0x20000340ul); if (res != -1) r[1] = *(uint32_t*)0x20000348; break; case 3: *(uint32_t*)0x200003c0 = 0xc; res = syscall(SYS_getsockopt, -1, 0xffff, 0x11, 0x20000380ul, 0x200003c0ul); if (res != -1) r[2] = *(uint32_t*)0x20000388; break; case 4: syscall(SYS_setregid, r[1], r[2]); break; case 5: res = syscall(SYS_semget, 0x798e2634ul, 0ul, 0xb2603d964b180ce8ul); if (res != -1) r[3] = res; break; case 6: memcpy((void*)0x20000400, "./file0\000", 8); res = syscall(SYS_stat, 0x20000400ul, 0x20000440ul); if (res != -1) r[4] = *(uint32_t*)0x2000045c; break; case 7: res = syscall(SYS_getgid); if (res != -1) r[5] = res; break; case 8: *(uint32_t*)0x20000500 = 0xfffff834; *(uint32_t*)0x20000504 = r[4]; *(uint32_t*)0x20000508 = r[5]; *(uint32_t*)0x2000050c = -1; *(uint32_t*)0x20000510 = 0; *(uint32_t*)0x20000514 = 3; *(uint16_t*)0x20000518 = 9; *(uint16_t*)0x2000051a = 0; *(uint64_t*)0x20000520 = 0; *(uint64_t*)0x20000528 = 0; *(uint64_t*)0x20000530 = 0xfffffffffffffffd; *(uint64_t*)0x20000538 = 0x4535; *(uint64_t*)0x20000540 = 2; *(uint64_t*)0x20000548 = 0; *(uint64_t*)0x20000550 = 0; syscall(SYS_semctl, r[3], 0ul, 1ul, 0x20000500ul); break; case 9: syscall(SYS_seteuid, 0); break; case 10: memcpy((void*)0x20000000, "\xbf\x5b\xc2\xc4\xdd\xcd\x9b\xaa\x7f\x7c\x66\xf9\x17\x26\xa8\xc4\x90\xf6\x91\x85\x14\x0b\x5b\x42\x51\xe8\x67\x01\xc6\xc5\xa6\x0d\x84\x80\x2d\x38\x2a\x0c\x38\xdf\x4a\x28\xfd\x84\x0d\x7e\x14\x06\xa5\xc2\xeb\x5d\x3b\x6b\xc3\x23\xbd\x49\x38\x6c\x4a\x92\x49\x50\x31\x4f\xe6\x17\xf8\xcd\x34\x37\xa4\xaa\x6d\x1c\x6d\x62\x64\x03\x09\xf9\xde\x23\x93\x99\x9b\x11\x47\x68\xd5\x10\xd7\x34\xfd\x72\xd1\x98\xb2\x61\xbd\x61\x81\x14\xbf\x3f\xa3\xe2\xfe\x84\xff\xe6\x5c\x80\xe4\x72\x12\xc4\x9e\x47\xbb\x3a\xaa\x86\x89\x46\x2f\x21\xd5\x18\x80\xd9\x7c\xb4\x45\xd3", 136); break; case 11: memcpy((void*)0x200000c0, "\xc4\xa1\x84\x58\x2c\xaa\x26\x44\x0f\xae\x04\xc4\x41\x0f\x74\xab\x00\x00\x01\x00\xc4\x23\xf5\x78\x4c\xe9\x9d\x40\x44\xdf\x34\x59\x26\x41\x0f\xae\x41\x01\x64\x64\x66\x44\x0f\xe5\xb9\x4e\x9a\xb0\xc4\xc4\x22\x7d\x47\x0f\x41\x0f\x45\x7f\x56\x66\x0f\xdd\xe8", 63); syz_execute_func(0x200000c0); break; case 12: break; case 13: memcpy((void*)0x20000140, "\x64\xd3\x2f\x16\xeb\xd8\x17\xd0\x04\xdc\xb8\x01\x71\x82\x05\xbc\xa1\xd8\x6d\xad\x3c\xb1\x32\xa2\x86\x60\x92\x14\xb7\x39\x5a\x97\xa0\xe8\xfe\xda\x5f\xad\x02\xcc\xe9\xde\xea\x94\xd5\x5a\x75\x0c\x17\xb2\x34\x07\x50\x02\xb9\xdf\x62\x9f\xa6\x8e\x3f\x7d\xa9\x7e\x9c\x2a\x2e\x0a\x95\xd1\x5d\x35\x95\x61\xb1\x47\x74\x40\x34\x2c\xd7\x9c\x7c\xeb\xd6\xbf\x00\x8a\xcd\x1c\x7f\xf1\x46\xa6\xfe\x22\x01\x36\x61\xd8\xc8\xce\x8e\xb1\x7f\x5c\xf3\x89\x2a\xe0\x8b\xba\x46\x54\x5b\x2b\x69\x0a\xb7\xe0\x36\x8a\xec\x4d\x32\xb7\x6d\x7f\xc1\x5d\xd7\xc2\xab\xa1\x84\xd4\x1a\x5e\x5a\xbb\x8d\x71\x6f\x5e\x64\x5e\x17\x67\x13\x8e\xd7\x38\xf3\x15\x79\x5a\xc9\x9e\x22\xfd\x44\xdb\x06\x09\x63\x13\xf4\x72\x9c\xe0\xd3\xbd\x93\x8f\x5b\x65\x20\xef\x93\x76\xfa\x90\x9d\xf6\xb2\x05\xc2\xd3\xf5\x2e\xe4\x3e\x3f\x59\xea\x44\x1b\x7c\x4e\x4d\x5c", 201); memcpy((void*)0x20000240, "\xc1\xb0\x1d\x40\x73\x99\x35\xb1\x21\x7d\x0e\x39\x3c\xdd\x4f\xa4\xef\x8b\xbd\x99\x57\xee\x99\x68\x77\xe4\xca\x15\x5c\x19\x5d\xc1\x66\xf9\x48\x6a\xc4\xdb\x17\xf7\x54\xc4\x89\x38\xa4\x34\x19\xf0\x82\xa8\xc3\x0e\xff\xbe\xf0\x64\xf6\xc8\xb8\x7b\xc9\x30\xe4\x39\xc7\x19\xec\x0a\x11\x99\x04\x0b\x86\x28\x6d\x27\x1f\x25\xaf\x26\xeb\xed\x3f\x55\xc3\x2e\x68\xac\x70\x33\x0d\xf7\x69\x31\xbf\x55\xfa\xe8\x80\x25\x6b\x74\xa9\x23\xf8\xa3\x02\x2c\x31\x0f\x94\xcc\x0c\x62\x33\x02\xa5\xd1\x4b\x3f\x8e\x18\xf4\x15\x99\x88\x28\x66\xea\x02\x42\x86\x4b\x37\xd5\xae\x87\xfb\xcb\x74\x5c\x3e\x26\x42\x3d\x05\xc5\x48\x38\x33\xdf\xcd\xd4\x3d\xc0\xc6\x50\x73\x29\x03\x72\x73\xde\x28\x2e\x3a\x16\xac\x00\xc5\x53\x9c\x30\x94\x63\x98\x4b\x15\x3e\xc6\x25\x0a\x78\x19\x75\xa2\x77\x01\x72\x80\xdb\x1e\x9c\x18\xce\x66\x4d\xf5\x94\x7c\x6c\x18\xbe\xf2\x36\x7e\x61\x63\xb4\x6b\x95\x03\xf7\x00\x70\x5f\xd0\xe8\x9e\xae\x6d\xf0\x88\x4b\xf2\x7c\x00\xe0\x5f\xc5\xef\xc6\x49\x07", 234); syz_usb_connect(0, 0xc9, 0x20000140, 0x20000240); break; case 14: memcpy((void*)0x20000340, "\x36\x4f\xb1\xa4\x17\x26\x3d\xe2\x27\x97\xec\x76\x08\x61\xf3\x85\x2c\xf2\x4f\x79\xe2\xb7\xa5\xc6\x2a\xfa\xd7\xd6\xd4\xd0\x9d\x86\x2f\x8e\xcc\xd0\x2e\x1b\xb9\x89\xe0\xf8\xa8\xad\x91\x54\x42\x01\x64\x04\xc9\x82\x6a\x5c\x0a\x28\x4f\xc7\xa8\x40\x30\x47\x59\xb6\x84\xf3\x57\xb2\xe6\xfe\xcf\xb3\xcc\x81\x57\xc0\x08\xff\x0d\xcf\xf2\x10\x89\x84\x54\x8a\x2a\xd6\x95\xfa\xd9\x51\x2f\x06\xfd\x12\xd6\x6b\xc4\x43\x04\x75\x12\xab\x4e\xf3\x05\x8a\xe6\xc0\xc6\xec\x3f\xd6\x27\xe3\x70\xa1\x51\xae\x71\x9b\x8e\x3a\x77\xd6\x82\xdc\x06\xa9\x3b\xe9\xc2\xaa\x80\x18\xb5\x8a\x94\x92\xcb\x39\x03\x1b\xb5\xab\xf3\x12\x4e\xaa\xb8\x53\x30\xf1\x81\xfc\xcc\xa7\x59\x7b\x4e\xc0\x87\x9f\xcb\xcf\x51\x14\x3f\x98\xc4\x43\xc1\x67\x20\xa6\xe0\x1b\x7e\x07\xdf\x47\x27\xe2\x88\xe1\x3d\xcc\x0b\x7e\x11", 191); memcpy((void*)0x20000400, "\x59\x03\x92\x3c\x7a\x1b\x28\x38\xf3\xc1\x21\x56\x78\x5a\x11\xc8\x1b\x2e\x82\xd9\xa1\x19\x0e\x1b\x9c\x45\x97\x6a\x91\x7c\x00\x29\x4d\xc9\x4d\x53\x54\xe8\xc5\xd6\xa4\xe8\x98\x6d\xa0\x74\xeb\x46\x1e\xd0\x73\x6b\xcb\xed\xe2\xce\xf1\xf1\x9e\x02\x16\xc0\x9e\xb7\x94\xd8\xb9\x75\x4f\xea\x26\xf1\x10\xc8\x32\x48\xc2\x86\xea\xa0\x5a\x69\x84\x4e\xb1\x29\x2f\x59\x4f\x59\xf6\xc9\xbe\xca\x47\xd8\x94\xd4\x4d\xfd\x15\xff\x81\xb7\x6b\x46\x35\x39\x2e\xb5\xed\x43\x1c\xa3\x09\x22\x30", 117); res = syz_usb_connect(4, 0xbf, 0x20000340, 0x20000400); if (res != -1) r[6] = res; break; case 15: syz_usb_disconnect(r[6]); break; } } int main(void) { syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 3ul, 0x1012ul, -1, 0ul, 0ul); use_temporary_dir(); do_sandbox_setuid(); return 0; } :187:2: error: unknown type name 'uint8_t_t' :188:2: error: unknown type name 'uint8_t_t' :189:2: error: unknown type name 'uint8_t_t' :190:2: error: unknown type name 'uint8_t_t' :191:2: error: unknown type name 'uint16_t_t' :192:2: error: unknown type name 'uint8_t_t' :193:2: error: unknown type name 'uint8_t_t' :194:2: error: unknown type name 'uint8_t_t' :198:2: error: unknown type name 'uint8_t_t' :199:2: error: unknown type name 'uint8_t_t' :200:2: error: unknown type name 'uint16_t_t' :201:2: error: unknown type name 'uint8_t_t' :202:2: error: unknown type name 'uint8_t_t' :203:2: error: unknown type name 'uint8_t_t' :204:2: error: unknown type name 'uint8_t_t' :205:2: error: unknown type name 'uint16_t_t' :206:2: error: unknown type name 'uint16_t_t' :207:2: error: unknown type name 'uint16_t_t' :208:2: error: unknown type name 'uint8_t_t' :209:2: error: unknown type name 'uint8_t_t' :210:2: error: unknown type name 'uint8_t_t' :211:2: error: unknown type name 'uint8_t_t' :215:2: error: unknown type name 'uint8_t_t' :216:2: error: unknown type name 'uint8_t_t' :217:2: error: unknown type name 'uint16_t_t' :218:2: error: unknown type name 'uint8_t_t' :219:2: error: unknown type name 'uint8_t_t' :220:2: error: unknown type name 'uint8_t_t' :221:2: error: unknown type name 'uint8_t_t' :222:2: error: unknown type name 'uint8_t_t' :226:2: error: unknown type name 'uint8_t_t' :227:2: error: unknown type name 'uint8_t_t' :228:2: error: unknown type name 'uint8_t_t' :229:2: error: unknown type name 'uint8_t_t' :230:2: error: unknown type name 'uint8_t_t' :231:2: error: unknown type name 'uint8_t_t' :232:2: error: unknown type name 'uint8_t_t' :233:2: error: unknown type name 'uint8_t_t' :234:2: error: unknown type name 'uint8_t_t' :238:2: error: unknown type name 'uint8_t_t' :239:2: error: unknown type name 'uint8_t_t' :240:2: error: unknown type name 'uint16_t_t' :241:2: error: unknown type name 'uint16_t_t' :242:2: error: unknown type name 'uint16_t_t' :246:2: error: unknown type name 'uint8_t_t' :247:2: error: unknown type name 'uint8_t_t' :248:2: error: unknown type name 'uint16_t_t' :249:2: error: unknown type name 'uint8_t_t' :250:2: error: unknown type name 'uint8_t_t' :251:2: error: unknown type name 'uint8_t_t' :252:2: error: unknown type name 'uint8_t_t' :253:2: error: unknown type name 'uint8_t_t' :254:2: error: unknown type name 'uint8_t_t' : In function 'vhci_usb_recv': :561:2: error: unknown type name 'uint8_t_t'; did you mean 'uint8_t'? :561:20: error: 'uint8_t_t' undeclared (first use in this function); did you mean 'uint8_t'? :561:20: note: each undeclared identifier is reported only once for each function it appears in :561:30: error: expected expression before ')' token : In function 'vhci_usb_send': :576:2: error: unknown type name 'uint8_t_t'; did you mean 'uint8_t'? :576:20: error: 'uint8_t_t' undeclared (first use in this function); did you mean 'uint8_t'? :576:30: error: expected expression before ')' token : In function 'syz_usb_connect_impl': :637:63: error: unknown type name 'usb_ctrlrequest' :642:55: error: unknown type name 'usb_ctrlrequest' :654:8: error: 'uint32_t_t' undeclared (first use in this function); did you mean 'uint32_t'? At top level: :702:13: error: 'setup_usb' defined but not used [-Werror=unused-function] cc1: all warnings being treated as errors compiler invocation: /syzkaller/netbsd/src/../tools/bin/x86_64--netbsd-g++ [-o /tmp/syz-executor197148708 -DGOOS_netbsd=1 -DGOARCH_amd64=1 -DHOSTGOOS_linux=1 -x c - -m64 --sysroot /syzkaller/netbsd/src/../dest/ -O2 -pthread -Wall -Werror -Wparentheses -Wframe-larger-than=16384] --- FAIL: TestGenerate/netbsd/amd64/13 (0.64s) csource_test.go:123: opts: {Threaded:true Collide:false Repeat:true RepeatTimes:0 Procs:0 Sandbox:none Fault:false FaultCall:0 FaultNth:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false USB:false UseTmpDir:true HandleSegv:false Repro:false Trace:true} program: r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c) writev(r0, &(0x7f00000002c0)=[{&(0x7f0000000000)="25c5f6768692f16a6b02337bc5f24e95c2e574f7bd23da78ff2241439caced122e33ab16d377843415781fa508cd635f2fd04113204ed9bda7396e99a38a2f10e9c7398b5a64c49d98664bd14975be7076a83638a7da3095f0e027bd161ccd5c994f8b31d535a3ce4c57812d9682f3ebb10e05a7142210515b668d1357d91aaabb6ad88aed6b9f2143d062e0b5", 0x8d}, {&(0x7f00000000c0)="e8987e8f864e9d38b55615b659d14cae9e91a9532213ffb465b61b", 0x1b}, {&(0x7f0000000100)="3f97992c940fba8936a6b4", 0xb}, {&(0x7f0000000140)="c99ab604eb2e44ebf7bfb7b04c084321a30f4351aeb0676bb21aefc3bc2322d99a5b034f880aa25d61ae4076397c30357b22ccb779ebd3206ac648fab90836dd4d9e73dc3c077270b57dc3222284dd3cae4737957d947d765a5e0e919cbd3ef2d3d9522a827f3fe60ddc", 0x6a}, {&(0x7f00000001c0)="2bc5a9fd6cc3450082405ab607a0f5627b40589a690ac59158acf10f2a1cc46152fa5f493a8599cc6eaab5d96968bef1a27f62dacf64d06c80cfb5b320b977c9432c446fa6f6551444ee4c5998853260d65d2cb3c778f44fe270363b4eb309e24fc47797b5bd454bf4d3d4656fa078ff56b30f4f0e9d5e6e8943830ad6d342968c224f7c35af01a61d10e155fee7e0227cd79a7977b3f40351ca01834840abba557d36bc8a4208f90dc5f51e3f3d445c5feea79368164edef05d24748ce9f0a58451b43d9891902bc45ec67d00df1deb74e65b29c0d095dbdd5b9a7c", 0xdc}], 0x5) getgroups(0x3, &(0x7f0000000340)=[0x0, 0xffffffffffffffff, 0x0]) getsockopt$sock_cred(0xffffffffffffffff, 0xffff, 0x11, &(0x7f0000000380)={0x0, 0x0, 0x0}, &(0x7f00000003c0)=0xc) setregid(r1, r2) r3 = semget(0x1, 0x0, 0xb2603d964b180ce8) stat(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0}) r5 = getgid() semctl$IPC_SET(r3, 0x0, 0x1, &(0x7f0000000500)={{0xfffff834, r4, r5, 0xffffffffffffffff, 0x0, 0x3, 0x9}, 0xfffffffffffffffd, 0x4535, 0x2}) seteuid(0x0) syz_emit_ethernet(0x88, &(0x7f0000000000)="bf5bc2c4ddcd9baa7f7c66f91726a8c490f69185140b5b4251e86701c6c5a60d84802d382a0c38df4a28fd840d7e1406a5c2eb5d3b6bc323bd49386c4a924950314fe617f8cd3437a4aa6d1c6d62640309f9de2393999b114768d510d734fd72d198b261bd618114bf3fa3e2fe84ffe65c80e47212c49e47bb3aaa8689462f21d51880d97cb445d3") syz_execute_func(&(0x7f00000000c0)="c4a184582caa26440fae04c4410f74ab00000100c423f5784ce99d4044df345926410fae4101646466440fe5b94e9ab0c4c4227d470f410f457f56660fdde8") syz_extract_tcp_res(&(0x7f0000000100), 0x6, 0x1) syz_usb_connect(0x0, 0xc9, &(0x7f0000000140)="64d32f16ebd817d004dcb801718205bca1d86dad3cb132a286609214b7395a97a0e8feda5fad02cce9deea94d55a750c17b234075002b9df629fa68e3f7da97e9c2a2e0a95d15d359561b1477440342cd79c7cebd6bf008acd1c7ff146a6fe22013661d8c8ce8eb17f5cf3892ae08bba46545b2b690ab7e0368aec4d32b76d7fc15dd7c2aba184d41a5e5abb8d716f5e645e1767138ed738f315795ac99e22fd44db06096313f4729ce0d3bd938f5b6520ef9376fa909df6b205c2d3f52ee43e3f59ea441b7c4e4d5c", &(0x7f0000000240)="c1b01d40739935b1217d0e393cdd4fa4ef8bbd9957ee996877e4ca155c195dc166f9486ac4db17f754c48938a43419f082a8c30effbef064f6c8b87bc930e439c719ec0a1199040b86286d271f25af26ebed3f55c32e68ac70330df76931bf55fae880256b74a923f8a3022c310f94cc0c623302a5d14b3f8e18f41599882866ea0242864b37d5ae87fbcb745c3e26423d05c5483833dfcdd43dc0c6507329037273de282e3a16ac00c5539c309463984b153ec6250a781975a277017280db1e9c18ce664df5947c6c18bef2367e6163b46b9503f700705fd0e89eae6df0884bf27c00e05fc5efc64907") r6 = syz_usb_connect(0x4, 0xbf, &(0x7f0000000340)="364fb1a417263de22797ec760861f3852cf24f79e2b7a5c62afad7d6d4d09d862f8eccd02e1bb989e0f8a8ad915442016404c9826a5c0a284fc7a840304759b684f357b2e6fecfb3cc8157c008ff0dcff2108984548a2ad695fad9512f06fd12d66bc443047512ab4ef3058ae6c0c6ec3fd627e370a151ae719b8e3a77d682dc06a93be9c2aa8018b58a9492cb39031bb5abf3124eaab85330f181fccca7597b4ec0879fcbcf51143f98c443c16720a6e01b7e07df4727e288e13dcc0b7e11", &(0x7f0000000400)="5903923c7a1b2838f3c12156785a11c81b2e82d9a1190e1b9c45976a917c00294dc94d5354e8c5d6a4e8986da074eb461ed0736bcbede2cef1f19e0216c09eb794d8b9754fea26f110c83248c286eaa05a69844eb1292f594f59f6c9beca47d894d44dfd15ff81b76b4635392eb5ed431ca3092230") syz_usb_disconnect(r6) csource_test.go:124: failed to build program: // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include static unsigned long long procid; static void kill_and_wait(int pid, int* status) { kill(pid, SIGKILL); while (waitpid(-1, status, 0) != pid) { } } static void sleep_ms(uint64_t ms) { usleep(ms * 1000); } static uint64_t current_time_ms(void) { struct timespec ts; if (clock_gettime(CLOCK_MONOTONIC, &ts)) exit(1); return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; } static void use_temporary_dir(void) { char tmpdir_template[] = "./syzkaller.XXXXXX"; char* tmpdir = mkdtemp(tmpdir_template); if (!tmpdir) exit(1); if (chmod(tmpdir, 0777)) exit(1); if (chdir(tmpdir)) exit(1); } static void remove_dir(const char* dir) { DIR* dp; struct dirent* ep; dp = opendir(dir); if (dp == NULL) exit(1); while ((ep = readdir(dp))) { if (strcmp(ep->d_name, ".") == 0 || strcmp(ep->d_name, "..") == 0) continue; char filename[FILENAME_MAX]; snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name); struct stat st; if (lstat(filename, &st)) exit(1); if (S_ISDIR(st.st_mode)) { remove_dir(filename); continue; } if (unlink(filename)) exit(1); } closedir(dp); if (rmdir(dir)) exit(1); } static void thread_start(void* (*fn)(void*), void* arg) { pthread_t th; pthread_attr_t attr; pthread_attr_init(&attr); pthread_attr_setstacksize(&attr, 128 << 10); int i; for (i = 0; i < 100; i++) { if (pthread_create(&th, &attr, fn, arg) == 0) { pthread_attr_destroy(&attr); return; } if (errno == EAGAIN) { usleep(50); continue; } break; } exit(1); } typedef struct { pthread_mutex_t mu; pthread_cond_t cv; int state; } event_t; static void event_init(event_t* ev) { if (pthread_mutex_init(&ev->mu, 0)) exit(1); if (pthread_cond_init(&ev->cv, 0)) exit(1); ev->state = 0; } static void event_reset(event_t* ev) { ev->state = 0; } static void event_set(event_t* ev) { pthread_mutex_lock(&ev->mu); if (ev->state) exit(1); ev->state = 1; pthread_mutex_unlock(&ev->mu); pthread_cond_broadcast(&ev->cv); } static void event_wait(event_t* ev) { pthread_mutex_lock(&ev->mu); while (!ev->state) pthread_cond_wait(&ev->cv, &ev->mu); pthread_mutex_unlock(&ev->mu); } static int event_isset(event_t* ev) { pthread_mutex_lock(&ev->mu); int res = ev->state; pthread_mutex_unlock(&ev->mu); return res; } static int event_timedwait(event_t* ev, uint64_t timeout) { uint64_t start = current_time_ms(); uint64_t now = start; pthread_mutex_lock(&ev->mu); for (;;) { if (ev->state) break; uint64_t remain = timeout - (now - start); struct timespec ts; ts.tv_sec = remain / 1000; ts.tv_nsec = (remain % 1000) * 1000 * 1000; pthread_cond_timedwait(&ev->cv, &ev->mu, &ts); now = current_time_ms(); if (now - start > timeout) break; } int res = ev->state; pthread_mutex_unlock(&ev->mu); return res; } /* -------------------------------------------------------------------------- */ /* * Redefinitions to match the linux types used in common_usb.h. */ struct usb_endpoint_descriptor { uint8_t_t bLength; uint8_t_t bDescriptorType; uint8_t_t bEndpointAddress; uint8_t_t bmAttributes; uint16_t_t wMaxPacketSize; uint8_t_t bInterval; uint8_t_t bRefresh; uint8_t_t bSynchAddress; } __attribute__((packed)); struct usb_device_descriptor { uint8_t_t bLength; uint8_t_t bDescriptorType; uint16_t_t bcdUSB; uint8_t_t bDeviceClass; uint8_t_t bDeviceSubClass; uint8_t_t bDeviceProtocol; uint8_t_t bMaxPacketSize0; uint16_t_t idVendor; uint16_t_t idProduct; uint16_t_t bcdDevice; uint8_t_t iManufacturer; uint8_t_t iProduct; uint8_t_t iSerialNumber; uint8_t_t bNumConfigurations; } __attribute__((packed)); struct usb_config_descriptor { uint8_t_t bLength; uint8_t_t bDescriptorType; uint16_t_t wTotalLength; uint8_t_t bNumInterfaces; uint8_t_t bConfigurationValue; uint8_t_t iConfiguration; uint8_t_t bmAttributes; uint8_t_t bMaxPower; } __attribute__((packed)); struct usb_interface_descriptor { uint8_t_t bLength; uint8_t_t bDescriptorType; uint8_t_t bInterfaceNumber; uint8_t_t bAlternateSetting; uint8_t_t bNumEndpoints; uint8_t_t bInterfaceClass; uint8_t_t bInterfaceSubClass; uint8_t_t bInterfaceProtocol; uint8_t_t iInterface; } __attribute__((packed)); struct usb_ctrlrequest { uint8_t_t bRequestType; uint8_t_t bRequest; uint16_t_t wValue; uint16_t_t wIndex; uint16_t_t wLength; } __attribute__((packed)); struct usb_qualifier_descriptor { uint8_t_t bLength; uint8_t_t bDescriptorType; uint16_t_t bcdUSB; uint8_t_t bDeviceClass; uint8_t_t bDeviceSubClass; uint8_t_t bDeviceProtocol; uint8_t_t bMaxPacketSize0; uint8_t_t bNumConfigurations; uint8_t_t bRESERVED; } __attribute__((packed)); #define USB_TYPE_MASK (0x03 << 5) #define USB_TYPE_STANDARD (0x00 << 5) #define USB_TYPE_CLASS (0x01 << 5) #define USB_TYPE_VENDOR (0x02 << 5) #define USB_TYPE_RESERVED (0x03 << 5) #define USB_DT_DEVICE 0x01 #define USB_DT_CONFIG 0x02 #define USB_DT_STRING 0x03 #define USB_DT_INTERFACE 0x04 #define USB_DT_ENDPOINT 0x05 #define USB_DT_DEVICE_QUALIFIER 0x06 #define USB_DT_OTHER_SPEED_CONFIG 0x07 #define USB_DT_INTERFACE_POWER 0x08 #define USB_DT_OTG 0x09 #define USB_DT_DEBUG 0x0a #define USB_DT_INTERFACE_ASSOCIATION 0x0b #define USB_DT_SECURITY 0x0c #define USB_DT_KEY 0x0d #define USB_DT_ENCRYPTION_TYPE 0x0e #define USB_DT_BOS 0x0f #define USB_DT_DEVICE_CAPABILITY 0x10 #define USB_DT_WIRELESS_ENDPOINT_COMP 0x11 #define USB_DT_WIRE_ADAPTER 0x21 #define USB_DT_RPIPE 0x22 #define USB_DT_CS_RADIO_CONTROL 0x23 #define USB_DT_PIPE_USAGE 0x24 #define USB_DT_SS_ENDPOINT_COMP 0x30 #define USB_DT_SSP_ISOC_ENDPOINT_COMP 0x31 #define USB_REQ_GET_STATUS 0x00 #define USB_REQ_CLEAR_FEATURE 0x01 #define USB_REQ_SET_FEATURE 0x03 #define USB_REQ_SET_ADDRESS 0x05 #define USB_REQ_GET_DESCRIPTOR 0x06 #define USB_REQ_SET_DESCRIPTOR 0x07 #define USB_REQ_GET_CONFIGURATION 0x08 #define USB_REQ_SET_CONFIGURATION 0x09 #define USB_REQ_GET_INTERFACE 0x0A #define USB_REQ_SET_INTERFACE 0x0B #define USB_REQ_SYNCH_FRAME 0x0C #define USB_REQ_SET_SEL 0x30 #define USB_REQ_SET_ISOCH_DELAY 0x31 #define USB_REQ_SET_ENCRYPTION 0x0D #define USB_REQ_GET_ENCRYPTION 0x0E #define USB_REQ_RPIPE_ABORT 0x0E #define USB_REQ_SET_HANDSHAKE 0x0F #define USB_REQ_RPIPE_RESET 0x0F #define USB_REQ_GET_HANDSHAKE 0x10 #define USB_REQ_SET_CONNECTION 0x11 #define USB_REQ_SET_SECURITY_DATA 0x12 #define USB_REQ_GET_SECURITY_DATA 0x13 #define USB_REQ_SET_WUSB_DATA 0x14 #define USB_REQ_LOOPBACK_DATA_WRITE 0x15 #define USB_REQ_LOOPBACK_DATA_READ 0x16 #define USB_REQ_SET_INTERFACE_DS 0x17 #define USB_REQ_GET_PARTNER_PDO 20 #define USB_REQ_GET_BATTERY_STATUS 21 #define USB_REQ_SET_PDO 22 #define USB_REQ_GET_VDM 23 #define USB_REQ_SEND_VDM 24 #define USB_MAX_IFACE_NUM 4 #define USB_MAX_EP_NUM 32 #define USB_MAX_FDS 6 struct usb_endpoint_index { struct usb_endpoint_descriptor desc; int handle; }; struct usb_iface_index { struct usb_interface_descriptor* iface; uint8_t bInterfaceNumber; uint8_t bAlternateSetting; uint8_t bInterfaceClass; struct usb_endpoint_index eps[USB_MAX_EP_NUM]; int eps_num; }; struct usb_device_index { struct usb_device_descriptor* dev; struct usb_config_descriptor* config; uint8_t bDeviceClass; uint8_t bMaxPower; int config_length; struct usb_iface_index ifaces[USB_MAX_IFACE_NUM]; int ifaces_num; int iface_cur; }; struct usb_info { int fd; struct usb_device_index index; }; static struct usb_info usb_devices[USB_MAX_FDS]; static int usb_devices_num; static bool parse_usb_descriptor(const char* buffer, size_t length, struct usb_device_index* index) { if (length < sizeof(*index->dev) + sizeof(*index->config)) return false; memset(index, 0, sizeof(*index)); index->dev = (struct usb_device_descriptor*)buffer; index->config = (struct usb_config_descriptor*)(buffer + sizeof(*index->dev)); index->bDeviceClass = index->dev->bDeviceClass; index->bMaxPower = index->config->bMaxPower; index->config_length = length - sizeof(*index->dev); index->iface_cur = -1; size_t offset = 0; while (true) { if (offset + 1 >= length) break; uint8_t desc_length = buffer[offset]; uint8_t desc_type = buffer[offset + 1]; if (desc_length <= 2) break; if (offset + desc_length > length) break; if (desc_type == USB_DT_INTERFACE && index->ifaces_num < USB_MAX_IFACE_NUM) { struct usb_interface_descriptor* iface = (struct usb_interface_descriptor*)(buffer + offset); index->ifaces[index->ifaces_num].iface = iface; index->ifaces[index->ifaces_num].bInterfaceNumber = iface->bInterfaceNumber; index->ifaces[index->ifaces_num].bAlternateSetting = iface->bAlternateSetting; index->ifaces[index->ifaces_num].bInterfaceClass = iface->bInterfaceClass; index->ifaces_num++; } if (desc_type == USB_DT_ENDPOINT && index->ifaces_num > 0) { struct usb_iface_index* iface = &index->ifaces[index->ifaces_num - 1]; if (iface->eps_num < USB_MAX_EP_NUM) { memcpy(&iface->eps[iface->eps_num].desc, buffer + offset, sizeof(iface->eps[iface->eps_num].desc)); iface->eps_num++; } } offset += desc_length; } return true; } static struct usb_device_index* add_usb_index(int fd, const char* dev, size_t dev_len) { int i = __atomic_fetch_add(&usb_devices_num, 1, __ATOMIC_RELAXED); if (i >= USB_MAX_FDS) return NULL; int rv = 0; rv = parse_usb_descriptor(dev, dev_len, &usb_devices[i].index); if (!rv) return NULL; __atomic_store_n(&usb_devices[i].fd, fd, __ATOMIC_RELEASE); return &usb_devices[i].index; } static struct usb_device_index* lookup_usb_index(int fd) { int i; for (i = 0; i < USB_MAX_FDS; i++) { if (__atomic_load_n(&usb_devices[i].fd, __ATOMIC_ACQUIRE) == fd) { return &usb_devices[i].index; } } return NULL; } struct vusb_connect_string_descriptor { uint32_t len; char* str; } __attribute__((packed)); struct vusb_connect_descriptors { uint32_t qual_len; char* qual; uint32_t bos_len; char* bos; uint32_t strs_len; struct vusb_connect_string_descriptor strs[0]; } __attribute__((packed)); static const char default_string[] = { 8, USB_DT_STRING, 's', 0, 'y', 0, 'z', 0 }; static const char default_lang_id[] = { 4, USB_DT_STRING, 0x09, 0x04 }; static bool lookup_connect_response_in(int fd, const struct vusb_connect_descriptors* descs, const struct usb_ctrlrequest* ctrl, char** response_data, uint32_t* response_length) { struct usb_device_index* index = lookup_usb_index(fd); uint8_t str_idx; if (!index) return false; switch (ctrl->bRequestType & USB_TYPE_MASK) { case USB_TYPE_STANDARD: switch (ctrl->bRequest) { case USB_REQ_GET_DESCRIPTOR: switch (ctrl->wValue >> 8) { case USB_DT_DEVICE: *response_data = (char*)index->dev; *response_length = sizeof(*index->dev); return true; case USB_DT_CONFIG: *response_data = (char*)index->config; *response_length = index->config_length; return true; case USB_DT_STRING: str_idx = (uint8_t)ctrl->wValue; if (descs && str_idx < descs->strs_len) { *response_data = descs->strs[str_idx].str; *response_length = descs->strs[str_idx].len; return true; } if (str_idx == 0) { *response_data = (char*)&default_lang_id[0]; *response_length = default_lang_id[0]; return true; } *response_data = (char*)&default_string[0]; *response_length = default_string[0]; return true; case USB_DT_BOS: *response_data = descs->bos; *response_length = descs->bos_len; return true; case USB_DT_DEVICE_QUALIFIER: if (!descs->qual) { struct usb_qualifier_descriptor* qual = (struct usb_qualifier_descriptor*)response_data; qual->bLength = sizeof(*qual); qual->bDescriptorType = USB_DT_DEVICE_QUALIFIER; qual->bcdUSB = index->dev->bcdUSB; qual->bDeviceClass = index->dev->bDeviceClass; qual->bDeviceSubClass = index->dev->bDeviceSubClass; qual->bDeviceProtocol = index->dev->bDeviceProtocol; qual->bMaxPacketSize0 = index->dev->bMaxPacketSize0; qual->bNumConfigurations = index->dev->bNumConfigurations; qual->bRESERVED = 0; *response_length = sizeof(*qual); return true; } *response_data = descs->qual; *response_length = descs->qual_len; return true; default: break; } break; default: break; } break; default: break; } return false; } typedef bool (*lookup_connect_out_response_t)(int fd, const struct vusb_connect_descriptors* descs, const struct usb_ctrlrequest* ctrl, bool* done); static bool lookup_connect_response_out_generic(int fd, const struct vusb_connect_descriptors* descs, const struct usb_ctrlrequest* ctrl, bool* done) { switch (ctrl->bRequestType & USB_TYPE_MASK) { case USB_TYPE_STANDARD: switch (ctrl->bRequest) { case USB_REQ_SET_CONFIGURATION: *done = true; return true; default: break; } break; } return false; } /* -------------------------------------------------------------------------- */ static int vhci_open(void) { return open("/dev/vhci", O_RDWR); } static int vhci_setport(int fd, u_int port) { struct vhci_ioc_set_port args; args.port = port; return ioctl(fd, VHCI_IOC_SET_PORT, &args); } static int vhci_usb_attach(int fd) { return ioctl(fd, VHCI_IOC_USB_ATTACH, NULL); } static int vhci_usb_recv(int fd, void* buf, size_t size) { uint8_t_t* ptr = (uint8_t_t*)buf; ssize_t done; while (1) { done = read(fd, ptr, size); if (done < 0) return -1; if ((size_t)done == size) return 0; size -= done; ptr += done; } } static int vhci_usb_send(int fd, void* buf, size_t size) { uint8_t_t* ptr = (uint8_t_t*)buf; ssize_t done; while (1) { done = write(fd, ptr, size); if (done <= 0) return -1; if ((size_t)done == size) return 0; size -= done; ptr += done; } } /* -------------------------------------------------------------------------- */ static volatile long syz_usb_connect_impl(uint64_t speed, uint64_t dev_len, const char* dev, const struct vusb_connect_descriptors* descs, lookup_connect_out_response_t lookup_connect_response_out) { struct usb_device_index* index; int portnum, fd, rv; bool done; portnum = procid + 1; if (!dev) { return -1; } if (portnum != 1) { /* For now, we support only one proc. */ return -1; } fd = vhci_open(); if (fd < 0) { return -1; } index = add_usb_index(fd, dev, dev_len); if (!index) { goto err; } rv = vhci_setport(fd, portnum); if (rv != 0) { goto err; } rv = vhci_usb_attach(fd); if (rv != 0) { goto err; } done = false; while (!done) { vhci_request_t req; rv = vhci_usb_recv(fd, &req, sizeof(req)); if (rv != 0) { goto err; } if (req.type != VHCI_REQ_CTRL) { goto err; } char* response_data = NULL; uint32_t response_length = 0; char data[4096]; if (req.u.ctrl.bmRequestType & UE_DIR_IN) { bool response_found = false; response_found = lookup_connect_response_in(fd, descs, (const usb_ctrlrequest*)&req.u.ctrl, &response_data, &response_length); if (!response_found) { goto err; } } else { if (!lookup_connect_response_out(fd, descs, (const usb_ctrlrequest*)&req.u.ctrl, &done)) { goto err; } response_data = NULL; response_length = UGETW(req.u.ctrl.wLength); } if ((req.u.ctrl.bmRequestType & USB_TYPE_MASK) == USB_TYPE_STANDARD && req.u.ctrl.bRequest == USB_REQ_SET_CONFIGURATION) { /* TODO: possibly revisit */ } if (response_length > sizeof(data)) response_length = 0; if ((uint32_t_t)UGETW(req.u.ctrl.wLength) < response_length) response_length = UGETW(req.u.ctrl.wLength); if (response_data) memcpy(data, response_data, response_length); else memset(data, 0, response_length); if (req.u.ctrl.bmRequestType & UE_DIR_IN) { if (response_length > 0) { vhci_response_t res; res.size = response_length; rv = vhci_usb_send(fd, &res, sizeof(res)); if (rv == 0) rv = vhci_usb_send(fd, data, response_length); } } else { rv = vhci_usb_recv(fd, data, response_length); } if (rv < 0) { goto err; } } sleep_ms(200); return fd; err: close(fd); return -1; } static volatile long syz_usb_connect(volatile long a0, volatile long a1, volatile long a2, volatile long a3) { uint64_t speed = a0; uint64_t dev_len = a1; const char* dev = (const char*)a2; const struct vusb_connect_descriptors* descs = (const struct vusb_connect_descriptors*)a3; return syz_usb_connect_impl(speed, dev_len, dev, descs, &lookup_connect_response_out_generic); } static volatile long syz_usb_disconnect(volatile long a0) { int fd = a0; int rv = close(fd); sleep_ms(200); return rv; } static void setup_usb(void) { if (chmod("/dev/vhci", 0666)) exit(1); } static void sandbox_common() { if (setsid() == -1) exit(1); struct rlimit rlim; rlim.rlim_cur = rlim.rlim_max = 8 << 20; setrlimit(RLIMIT_MEMLOCK, &rlim); rlim.rlim_cur = rlim.rlim_max = 1 << 20; setrlimit(RLIMIT_FSIZE, &rlim); rlim.rlim_cur = rlim.rlim_max = 1 << 20; setrlimit(RLIMIT_STACK, &rlim); rlim.rlim_cur = rlim.rlim_max = 0; setrlimit(RLIMIT_CORE, &rlim); rlim.rlim_cur = rlim.rlim_max = 256; setrlimit(RLIMIT_NOFILE, &rlim); } static void loop(); static int do_sandbox_none(void) { sandbox_common(); loop(); return 0; } static long syz_execute_func(volatile long text) { volatile long p[8] = {0}; (void)p; asm volatile("" ::"r"(0l), "r"(1l), "r"(2l), "r"(3l), "r"(4l), "r"(5l), "r"(6l), "r"(7l), "r"(8l), "r"(9l), "r"(10l), "r"(11l), "r"(12l), "r"(13l)); ((void (*)(void))(text))(); return 0; } struct thread_t { int created, call; event_t ready, done; }; static struct thread_t threads[16]; static void execute_call(int call); static int running; static void* thr(void* arg) { struct thread_t* th = (struct thread_t*)arg; for (;;) { event_wait(&th->ready); event_reset(&th->ready); execute_call(th->call); __atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED); event_set(&th->done); } return 0; } static void execute_one(void) { fprintf(stderr, "### start\n"); int i, call, thread; for (call = 0; call < 16; call++) { for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0])); thread++) { struct thread_t* th = &threads[thread]; if (!th->created) { th->created = 1; event_init(&th->ready); event_init(&th->done); event_set(&th->done); thread_start(thr, th); } if (!event_isset(&th->done)) continue; event_reset(&th->done); th->call = call; __atomic_fetch_add(&running, 1, __ATOMIC_RELAXED); event_set(&th->ready); event_timedwait(&th->done, 45 + (call == 13 ? 3000 : 0) + (call == 14 ? 3000 : 0) + (call == 15 ? 300 : 0)); break; } } for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++) sleep_ms(1); } static void execute_one(void); #define WAIT_FLAGS 0 static void loop(void) { int iter; for (iter = 0;; iter++) { char cwdbuf[32]; sprintf(cwdbuf, "./%d", iter); if (mkdir(cwdbuf, 0777)) exit(1); int pid = fork(); if (pid < 0) exit(1); if (pid == 0) { if (chdir(cwdbuf)) exit(1); execute_one(); exit(0); } int status = 0; uint64_t start = current_time_ms(); for (;;) { if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) break; sleep_ms(1); if (current_time_ms() - start < 5 * 1000) continue; kill_and_wait(pid, &status); break; } remove_dir(cwdbuf); } } #ifndef SYS_dup2 #define SYS_dup2 90 #endif #ifndef SYS_getgid #define SYS_getgid 47 #endif #ifndef SYS_getgroups #define SYS_getgroups 79 #endif #ifndef SYS_getsockopt #define SYS_getsockopt 118 #endif #ifndef SYS_mmap #define SYS_mmap 197 #endif #ifndef SYS_semctl #define SYS_semctl 442 #endif #ifndef SYS_semget #define SYS_semget 221 #endif #ifndef SYS_seteuid #define SYS_seteuid 183 #endif #ifndef SYS_setregid #define SYS_setregid 127 #endif #ifndef SYS_stat #define SYS_stat 439 #endif #ifndef SYS_writev #define SYS_writev 121 #endif uint64_t r[7] = {0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}; void execute_call(int call) { intptr_t res = 0; switch (call) { case 0: res = syscall(SYS_dup2, -1, 0xffffff9c); fprintf(stderr, "### call=0 errno=%u\n", res == -1 ? errno : 0); if (res != -1) r[0] = res; break; case 1: *(uint64_t*)0x200002c0 = 0x20000000; memcpy((void*)0x20000000, "\x25\xc5\xf6\x76\x86\x92\xf1\x6a\x6b\x02\x33\x7b\xc5\xf2\x4e\x95\xc2\xe5\x74\xf7\xbd\x23\xda\x78\xff\x22\x41\x43\x9c\xac\xed\x12\x2e\x33\xab\x16\xd3\x77\x84\x34\x15\x78\x1f\xa5\x08\xcd\x63\x5f\x2f\xd0\x41\x13\x20\x4e\xd9\xbd\xa7\x39\x6e\x99\xa3\x8a\x2f\x10\xe9\xc7\x39\x8b\x5a\x64\xc4\x9d\x98\x66\x4b\xd1\x49\x75\xbe\x70\x76\xa8\x36\x38\xa7\xda\x30\x95\xf0\xe0\x27\xbd\x16\x1c\xcd\x5c\x99\x4f\x8b\x31\xd5\x35\xa3\xce\x4c\x57\x81\x2d\x96\x82\xf3\xeb\xb1\x0e\x05\xa7\x14\x22\x10\x51\x5b\x66\x8d\x13\x57\xd9\x1a\xaa\xbb\x6a\xd8\x8a\xed\x6b\x9f\x21\x43\xd0\x62\xe0\xb5", 141); *(uint64_t*)0x200002c8 = 0x8d; *(uint64_t*)0x200002d0 = 0x200000c0; memcpy((void*)0x200000c0, "\xe8\x98\x7e\x8f\x86\x4e\x9d\x38\xb5\x56\x15\xb6\x59\xd1\x4c\xae\x9e\x91\xa9\x53\x22\x13\xff\xb4\x65\xb6\x1b", 27); *(uint64_t*)0x200002d8 = 0x1b; *(uint64_t*)0x200002e0 = 0x20000100; memcpy((void*)0x20000100, "\x3f\x97\x99\x2c\x94\x0f\xba\x89\x36\xa6\xb4", 11); *(uint64_t*)0x200002e8 = 0xb; *(uint64_t*)0x200002f0 = 0x20000140; memcpy((void*)0x20000140, "\xc9\x9a\xb6\x04\xeb\x2e\x44\xeb\xf7\xbf\xb7\xb0\x4c\x08\x43\x21\xa3\x0f\x43\x51\xae\xb0\x67\x6b\xb2\x1a\xef\xc3\xbc\x23\x22\xd9\x9a\x5b\x03\x4f\x88\x0a\xa2\x5d\x61\xae\x40\x76\x39\x7c\x30\x35\x7b\x22\xcc\xb7\x79\xeb\xd3\x20\x6a\xc6\x48\xfa\xb9\x08\x36\xdd\x4d\x9e\x73\xdc\x3c\x07\x72\x70\xb5\x7d\xc3\x22\x22\x84\xdd\x3c\xae\x47\x37\x95\x7d\x94\x7d\x76\x5a\x5e\x0e\x91\x9c\xbd\x3e\xf2\xd3\xd9\x52\x2a\x82\x7f\x3f\xe6\x0d\xdc", 106); *(uint64_t*)0x200002f8 = 0x6a; *(uint64_t*)0x20000300 = 0x200001c0; memcpy((void*)0x200001c0, "\x2b\xc5\xa9\xfd\x6c\xc3\x45\x00\x82\x40\x5a\xb6\x07\xa0\xf5\x62\x7b\x40\x58\x9a\x69\x0a\xc5\x91\x58\xac\xf1\x0f\x2a\x1c\xc4\x61\x52\xfa\x5f\x49\x3a\x85\x99\xcc\x6e\xaa\xb5\xd9\x69\x68\xbe\xf1\xa2\x7f\x62\xda\xcf\x64\xd0\x6c\x80\xcf\xb5\xb3\x20\xb9\x77\xc9\x43\x2c\x44\x6f\xa6\xf6\x55\x14\x44\xee\x4c\x59\x98\x85\x32\x60\xd6\x5d\x2c\xb3\xc7\x78\xf4\x4f\xe2\x70\x36\x3b\x4e\xb3\x09\xe2\x4f\xc4\x77\x97\xb5\xbd\x45\x4b\xf4\xd3\xd4\x65\x6f\xa0\x78\xff\x56\xb3\x0f\x4f\x0e\x9d\x5e\x6e\x89\x43\x83\x0a\xd6\xd3\x42\x96\x8c\x22\x4f\x7c\x35\xaf\x01\xa6\x1d\x10\xe1\x55\xfe\xe7\xe0\x22\x7c\xd7\x9a\x79\x77\xb3\xf4\x03\x51\xca\x01\x83\x48\x40\xab\xba\x55\x7d\x36\xbc\x8a\x42\x08\xf9\x0d\xc5\xf5\x1e\x3f\x3d\x44\x5c\x5f\xee\xa7\x93\x68\x16\x4e\xde\xf0\x5d\x24\x74\x8c\xe9\xf0\xa5\x84\x51\xb4\x3d\x98\x91\x90\x2b\xc4\x5e\xc6\x7d\x00\xdf\x1d\xeb\x74\xe6\x5b\x29\xc0\xd0\x95\xdb\xdd\x5b\x9a\x7c", 220); *(uint64_t*)0x20000308 = 0xdc; res = syscall(SYS_writev, r[0], 0x200002c0ul, 5ul); fprintf(stderr, "### call=1 errno=%u\n", res == -1 ? errno : 0); break; case 2: *(uint32_t*)0x20000340 = 0; *(uint32_t*)0x20000344 = -1; *(uint32_t*)0x20000348 = 0; res = syscall(SYS_getgroups, 3ul, 0x20000340ul); fprintf(stderr, "### call=2 errno=%u\n", res == -1 ? errno : 0); if (res != -1) r[1] = *(uint32_t*)0x20000348; break; case 3: *(uint32_t*)0x200003c0 = 0xc; res = syscall(SYS_getsockopt, -1, 0xffff, 0x11, 0x20000380ul, 0x200003c0ul); fprintf(stderr, "### call=3 errno=%u\n", res == -1 ? errno : 0); if (res != -1) r[2] = *(uint32_t*)0x20000388; break; case 4: res = syscall(SYS_setregid, r[1], r[2]); fprintf(stderr, "### call=4 errno=%u\n", res == -1 ? errno : 0); break; case 5: res = syscall(SYS_semget, 0x798e2634ul, 0ul, 0xb2603d964b180ce8ul); fprintf(stderr, "### call=5 errno=%u\n", res == -1 ? errno : 0); if (res != -1) r[3] = res; break; case 6: memcpy((void*)0x20000400, "./file0\000", 8); res = syscall(SYS_stat, 0x20000400ul, 0x20000440ul); fprintf(stderr, "### call=6 errno=%u\n", res == -1 ? errno : 0); if (res != -1) r[4] = *(uint32_t*)0x2000045c; break; case 7: res = syscall(SYS_getgid); fprintf(stderr, "### call=7 errno=%u\n", res == -1 ? errno : 0); if (res != -1) r[5] = res; break; case 8: *(uint32_t*)0x20000500 = 0xfffff834; *(uint32_t*)0x20000504 = r[4]; *(uint32_t*)0x20000508 = r[5]; *(uint32_t*)0x2000050c = -1; *(uint32_t*)0x20000510 = 0; *(uint32_t*)0x20000514 = 3; *(uint16_t*)0x20000518 = 9; *(uint16_t*)0x2000051a = 0; *(uint64_t*)0x20000520 = 0; *(uint64_t*)0x20000528 = 0; *(uint64_t*)0x20000530 = 0xfffffffffffffffd; *(uint64_t*)0x20000538 = 0x4535; *(uint64_t*)0x20000540 = 2; *(uint64_t*)0x20000548 = 0; *(uint64_t*)0x20000550 = 0; res = syscall(SYS_semctl, r[3], 0ul, 1ul, 0x20000500ul); fprintf(stderr, "### call=8 errno=%u\n", res == -1 ? errno : 0); break; case 9: res = syscall(SYS_seteuid, 0); fprintf(stderr, "### call=9 errno=%u\n", res == -1 ? errno : 0); break; case 10: memcpy((void*)0x20000000, "\xbf\x5b\xc2\xc4\xdd\xcd\x9b\xaa\x7f\x7c\x66\xf9\x17\x26\xa8\xc4\x90\xf6\x91\x85\x14\x0b\x5b\x42\x51\xe8\x67\x01\xc6\xc5\xa6\x0d\x84\x80\x2d\x38\x2a\x0c\x38\xdf\x4a\x28\xfd\x84\x0d\x7e\x14\x06\xa5\xc2\xeb\x5d\x3b\x6b\xc3\x23\xbd\x49\x38\x6c\x4a\x92\x49\x50\x31\x4f\xe6\x17\xf8\xcd\x34\x37\xa4\xaa\x6d\x1c\x6d\x62\x64\x03\x09\xf9\xde\x23\x93\x99\x9b\x11\x47\x68\xd5\x10\xd7\x34\xfd\x72\xd1\x98\xb2\x61\xbd\x61\x81\x14\xbf\x3f\xa3\xe2\xfe\x84\xff\xe6\x5c\x80\xe4\x72\x12\xc4\x9e\x47\xbb\x3a\xaa\x86\x89\x46\x2f\x21\xd5\x18\x80\xd9\x7c\xb4\x45\xd3", 136); (void)res; break; case 11: memcpy((void*)0x200000c0, "\xc4\xa1\x84\x58\x2c\xaa\x26\x44\x0f\xae\x04\xc4\x41\x0f\x74\xab\x00\x00\x01\x00\xc4\x23\xf5\x78\x4c\xe9\x9d\x40\x44\xdf\x34\x59\x26\x41\x0f\xae\x41\x01\x64\x64\x66\x44\x0f\xe5\xb9\x4e\x9a\xb0\xc4\xc4\x22\x7d\x47\x0f\x41\x0f\x45\x7f\x56\x66\x0f\xdd\xe8", 63); res = syz_execute_func(0x200000c0); fprintf(stderr, "### call=11 errno=%u\n", res == -1 ? errno : 0); break; case 12: (void)res; break; case 13: memcpy((void*)0x20000140, "\x64\xd3\x2f\x16\xeb\xd8\x17\xd0\x04\xdc\xb8\x01\x71\x82\x05\xbc\xa1\xd8\x6d\xad\x3c\xb1\x32\xa2\x86\x60\x92\x14\xb7\x39\x5a\x97\xa0\xe8\xfe\xda\x5f\xad\x02\xcc\xe9\xde\xea\x94\xd5\x5a\x75\x0c\x17\xb2\x34\x07\x50\x02\xb9\xdf\x62\x9f\xa6\x8e\x3f\x7d\xa9\x7e\x9c\x2a\x2e\x0a\x95\xd1\x5d\x35\x95\x61\xb1\x47\x74\x40\x34\x2c\xd7\x9c\x7c\xeb\xd6\xbf\x00\x8a\xcd\x1c\x7f\xf1\x46\xa6\xfe\x22\x01\x36\x61\xd8\xc8\xce\x8e\xb1\x7f\x5c\xf3\x89\x2a\xe0\x8b\xba\x46\x54\x5b\x2b\x69\x0a\xb7\xe0\x36\x8a\xec\x4d\x32\xb7\x6d\x7f\xc1\x5d\xd7\xc2\xab\xa1\x84\xd4\x1a\x5e\x5a\xbb\x8d\x71\x6f\x5e\x64\x5e\x17\x67\x13\x8e\xd7\x38\xf3\x15\x79\x5a\xc9\x9e\x22\xfd\x44\xdb\x06\x09\x63\x13\xf4\x72\x9c\xe0\xd3\xbd\x93\x8f\x5b\x65\x20\xef\x93\x76\xfa\x90\x9d\xf6\xb2\x05\xc2\xd3\xf5\x2e\xe4\x3e\x3f\x59\xea\x44\x1b\x7c\x4e\x4d\x5c", 201); memcpy((void*)0x20000240, "\xc1\xb0\x1d\x40\x73\x99\x35\xb1\x21\x7d\x0e\x39\x3c\xdd\x4f\xa4\xef\x8b\xbd\x99\x57\xee\x99\x68\x77\xe4\xca\x15\x5c\x19\x5d\xc1\x66\xf9\x48\x6a\xc4\xdb\x17\xf7\x54\xc4\x89\x38\xa4\x34\x19\xf0\x82\xa8\xc3\x0e\xff\xbe\xf0\x64\xf6\xc8\xb8\x7b\xc9\x30\xe4\x39\xc7\x19\xec\x0a\x11\x99\x04\x0b\x86\x28\x6d\x27\x1f\x25\xaf\x26\xeb\xed\x3f\x55\xc3\x2e\x68\xac\x70\x33\x0d\xf7\x69\x31\xbf\x55\xfa\xe8\x80\x25\x6b\x74\xa9\x23\xf8\xa3\x02\x2c\x31\x0f\x94\xcc\x0c\x62\x33\x02\xa5\xd1\x4b\x3f\x8e\x18\xf4\x15\x99\x88\x28\x66\xea\x02\x42\x86\x4b\x37\xd5\xae\x87\xfb\xcb\x74\x5c\x3e\x26\x42\x3d\x05\xc5\x48\x38\x33\xdf\xcd\xd4\x3d\xc0\xc6\x50\x73\x29\x03\x72\x73\xde\x28\x2e\x3a\x16\xac\x00\xc5\x53\x9c\x30\x94\x63\x98\x4b\x15\x3e\xc6\x25\x0a\x78\x19\x75\xa2\x77\x01\x72\x80\xdb\x1e\x9c\x18\xce\x66\x4d\xf5\x94\x7c\x6c\x18\xbe\xf2\x36\x7e\x61\x63\xb4\x6b\x95\x03\xf7\x00\x70\x5f\xd0\xe8\x9e\xae\x6d\xf0\x88\x4b\xf2\x7c\x00\xe0\x5f\xc5\xef\xc6\x49\x07", 234); res = syz_usb_connect(0, 0xc9, 0x20000140, 0x20000240); fprintf(stderr, "### call=13 errno=%u\n", res == -1 ? errno : 0); break; case 14: memcpy((void*)0x20000340, "\x36\x4f\xb1\xa4\x17\x26\x3d\xe2\x27\x97\xec\x76\x08\x61\xf3\x85\x2c\xf2\x4f\x79\xe2\xb7\xa5\xc6\x2a\xfa\xd7\xd6\xd4\xd0\x9d\x86\x2f\x8e\xcc\xd0\x2e\x1b\xb9\x89\xe0\xf8\xa8\xad\x91\x54\x42\x01\x64\x04\xc9\x82\x6a\x5c\x0a\x28\x4f\xc7\xa8\x40\x30\x47\x59\xb6\x84\xf3\x57\xb2\xe6\xfe\xcf\xb3\xcc\x81\x57\xc0\x08\xff\x0d\xcf\xf2\x10\x89\x84\x54\x8a\x2a\xd6\x95\xfa\xd9\x51\x2f\x06\xfd\x12\xd6\x6b\xc4\x43\x04\x75\x12\xab\x4e\xf3\x05\x8a\xe6\xc0\xc6\xec\x3f\xd6\x27\xe3\x70\xa1\x51\xae\x71\x9b\x8e\x3a\x77\xd6\x82\xdc\x06\xa9\x3b\xe9\xc2\xaa\x80\x18\xb5\x8a\x94\x92\xcb\x39\x03\x1b\xb5\xab\xf3\x12\x4e\xaa\xb8\x53\x30\xf1\x81\xfc\xcc\xa7\x59\x7b\x4e\xc0\x87\x9f\xcb\xcf\x51\x14\x3f\x98\xc4\x43\xc1\x67\x20\xa6\xe0\x1b\x7e\x07\xdf\x47\x27\xe2\x88\xe1\x3d\xcc\x0b\x7e\x11", 191); memcpy((void*)0x20000400, "\x59\x03\x92\x3c\x7a\x1b\x28\x38\xf3\xc1\x21\x56\x78\x5a\x11\xc8\x1b\x2e\x82\xd9\xa1\x19\x0e\x1b\x9c\x45\x97\x6a\x91\x7c\x00\x29\x4d\xc9\x4d\x53\x54\xe8\xc5\xd6\xa4\xe8\x98\x6d\xa0\x74\xeb\x46\x1e\xd0\x73\x6b\xcb\xed\xe2\xce\xf1\xf1\x9e\x02\x16\xc0\x9e\xb7\x94\xd8\xb9\x75\x4f\xea\x26\xf1\x10\xc8\x32\x48\xc2\x86\xea\xa0\x5a\x69\x84\x4e\xb1\x29\x2f\x59\x4f\x59\xf6\xc9\xbe\xca\x47\xd8\x94\xd4\x4d\xfd\x15\xff\x81\xb7\x6b\x46\x35\x39\x2e\xb5\xed\x43\x1c\xa3\x09\x22\x30", 117); res = syz_usb_connect(4, 0xbf, 0x20000340, 0x20000400); fprintf(stderr, "### call=14 errno=%u\n", res == -1 ? errno : 0); if (res != -1) r[6] = res; break; case 15: res = syz_usb_disconnect(r[6]); fprintf(stderr, "### call=15 errno=%u\n", res == -1 ? errno : 0); break; } } int main(void) { syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 3ul, 0x1012ul, -1, 0ul, 0ul); use_temporary_dir(); do_sandbox_none(); return 0; } :187:2: error: unknown type name 'uint8_t_t' :188:2: error: unknown type name 'uint8_t_t' :189:2: error: unknown type name 'uint8_t_t' :190:2: error: unknown type name 'uint8_t_t' :191:2: error: unknown type name 'uint16_t_t' :192:2: error: unknown type name 'uint8_t_t' :193:2: error: unknown type name 'uint8_t_t' :194:2: error: unknown type name 'uint8_t_t' :198:2: error: unknown type name 'uint8_t_t' :199:2: error: unknown type name 'uint8_t_t' :200:2: error: unknown type name 'uint16_t_t' :201:2: error: unknown type name 'uint8_t_t' :202:2: error: unknown type name 'uint8_t_t' :203:2: error: unknown type name 'uint8_t_t' :204:2: error: unknown type name 'uint8_t_t' :205:2: error: unknown type name 'uint16_t_t' :206:2: error: unknown type name 'uint16_t_t' :207:2: error: unknown type name 'uint16_t_t' :208:2: error: unknown type name 'uint8_t_t' :209:2: error: unknown type name 'uint8_t_t' :210:2: error: unknown type name 'uint8_t_t' :211:2: error: unknown type name 'uint8_t_t' :215:2: error: unknown type name 'uint8_t_t' :216:2: error: unknown type name 'uint8_t_t' :217:2: error: unknown type name 'uint16_t_t' :218:2: error: unknown type name 'uint8_t_t' :219:2: error: unknown type name 'uint8_t_t' :220:2: error: unknown type name 'uint8_t_t' :221:2: error: unknown type name 'uint8_t_t' :222:2: error: unknown type name 'uint8_t_t' :226:2: error: unknown type name 'uint8_t_t' :227:2: error: unknown type name 'uint8_t_t' :228:2: error: unknown type name 'uint8_t_t' :229:2: error: unknown type name 'uint8_t_t' :230:2: error: unknown type name 'uint8_t_t' :231:2: error: unknown type name 'uint8_t_t' :232:2: error: unknown type name 'uint8_t_t' :233:2: error: unknown type name 'uint8_t_t' :234:2: error: unknown type name 'uint8_t_t' :238:2: error: unknown type name 'uint8_t_t' :239:2: error: unknown type name 'uint8_t_t' :240:2: error: unknown type name 'uint16_t_t' :241:2: error: unknown type name 'uint16_t_t' :242:2: error: unknown type name 'uint16_t_t' :246:2: error: unknown type name 'uint8_t_t' :247:2: error: unknown type name 'uint8_t_t' :248:2: error: unknown type name 'uint16_t_t' :249:2: error: unknown type name 'uint8_t_t' :250:2: error: unknown type name 'uint8_t_t' :251:2: error: unknown type name 'uint8_t_t' :252:2: error: unknown type name 'uint8_t_t' :253:2: error: unknown type name 'uint8_t_t' :254:2: error: unknown type name 'uint8_t_t' : In function 'vhci_usb_recv': :561:2: error: unknown type name 'uint8_t_t'; did you mean 'uint8_t'? :561:20: error: 'uint8_t_t' undeclared (first use in this function); did you mean 'uint8_t'? :561:20: note: each undeclared identifier is reported only once for each function it appears in :561:30: error: expected expression before ')' token : In function 'vhci_usb_send': :576:2: error: unknown type name 'uint8_t_t'; did you mean 'uint8_t'? :576:20: error: 'uint8_t_t' undeclared (first use in this function); did you mean 'uint8_t'? :576:30: error: expected expression before ')' token : In function 'syz_usb_connect_impl': :637:63: error: unknown type name 'usb_ctrlrequest' :642:55: error: unknown type name 'usb_ctrlrequest' :654:8: error: 'uint32_t_t' undeclared (first use in this function); did you mean 'uint32_t'? At top level: :702:13: error: 'setup_usb' defined but not used [-Werror=unused-function] cc1: all warnings being treated as errors compiler invocation: /syzkaller/netbsd/src/../tools/bin/x86_64--netbsd-g++ [-o /tmp/syz-executor381236982 -DGOOS_netbsd=1 -DGOARCH_amd64=1 -DHOSTGOOS_linux=1 -x c - -m64 --sysroot /syzkaller/netbsd/src/../dest/ -O2 -pthread -Wall -Werror -Wparentheses -Wframe-larger-than=16384] --- FAIL: TestGenerate/netbsd/amd64/14 (0.77s) csource_test.go:123: opts: {Threaded:true Collide:true Repeat:true RepeatTimes:0 Procs:2 Sandbox:none Fault:false FaultCall:0 FaultNth:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false USB:false UseTmpDir:true HandleSegv:false Repro:true Trace:false} program: r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c) writev(r0, &(0x7f00000002c0)=[{&(0x7f0000000000)="25c5f6768692f16a6b02337bc5f24e95c2e574f7bd23da78ff2241439caced122e33ab16d377843415781fa508cd635f2fd04113204ed9bda7396e99a38a2f10e9c7398b5a64c49d98664bd14975be7076a83638a7da3095f0e027bd161ccd5c994f8b31d535a3ce4c57812d9682f3ebb10e05a7142210515b668d1357d91aaabb6ad88aed6b9f2143d062e0b5", 0x8d}, {&(0x7f00000000c0)="e8987e8f864e9d38b55615b659d14cae9e91a9532213ffb465b61b", 0x1b}, {&(0x7f0000000100)="3f97992c940fba8936a6b4", 0xb}, {&(0x7f0000000140)="c99ab604eb2e44ebf7bfb7b04c084321a30f4351aeb0676bb21aefc3bc2322d99a5b034f880aa25d61ae4076397c30357b22ccb779ebd3206ac648fab90836dd4d9e73dc3c077270b57dc3222284dd3cae4737957d947d765a5e0e919cbd3ef2d3d9522a827f3fe60ddc", 0x6a}, {&(0x7f00000001c0)="2bc5a9fd6cc3450082405ab607a0f5627b40589a690ac59158acf10f2a1cc46152fa5f493a8599cc6eaab5d96968bef1a27f62dacf64d06c80cfb5b320b977c9432c446fa6f6551444ee4c5998853260d65d2cb3c778f44fe270363b4eb309e24fc47797b5bd454bf4d3d4656fa078ff56b30f4f0e9d5e6e8943830ad6d342968c224f7c35af01a61d10e155fee7e0227cd79a7977b3f40351ca01834840abba557d36bc8a4208f90dc5f51e3f3d445c5feea79368164edef05d24748ce9f0a58451b43d9891902bc45ec67d00df1deb74e65b29c0d095dbdd5b9a7c", 0xdc}], 0x5) getgroups(0x3, &(0x7f0000000340)=[0x0, 0xffffffffffffffff, 0x0]) getsockopt$sock_cred(0xffffffffffffffff, 0xffff, 0x11, &(0x7f0000000380)={0x0, 0x0, 0x0}, &(0x7f00000003c0)=0xc) setregid(r1, r2) r3 = semget(0x1, 0x0, 0xb2603d964b180ce8) stat(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0}) r5 = getgid() semctl$IPC_SET(r3, 0x0, 0x1, &(0x7f0000000500)={{0xfffff834, r4, r5, 0xffffffffffffffff, 0x0, 0x3, 0x9}, 0xfffffffffffffffd, 0x4535, 0x2}) seteuid(0x0) syz_emit_ethernet(0x88, &(0x7f0000000000)="bf5bc2c4ddcd9baa7f7c66f91726a8c490f69185140b5b4251e86701c6c5a60d84802d382a0c38df4a28fd840d7e1406a5c2eb5d3b6bc323bd49386c4a924950314fe617f8cd3437a4aa6d1c6d62640309f9de2393999b114768d510d734fd72d198b261bd618114bf3fa3e2fe84ffe65c80e47212c49e47bb3aaa8689462f21d51880d97cb445d3") syz_execute_func(&(0x7f00000000c0)="c4a184582caa26440fae04c4410f74ab00000100c423f5784ce99d4044df345926410fae4101646466440fe5b94e9ab0c4c4227d470f410f457f56660fdde8") syz_extract_tcp_res(&(0x7f0000000100), 0x6, 0x1) syz_usb_connect(0x0, 0xc9, &(0x7f0000000140)="64d32f16ebd817d004dcb801718205bca1d86dad3cb132a286609214b7395a97a0e8feda5fad02cce9deea94d55a750c17b234075002b9df629fa68e3f7da97e9c2a2e0a95d15d359561b1477440342cd79c7cebd6bf008acd1c7ff146a6fe22013661d8c8ce8eb17f5cf3892ae08bba46545b2b690ab7e0368aec4d32b76d7fc15dd7c2aba184d41a5e5abb8d716f5e645e1767138ed738f315795ac99e22fd44db06096313f4729ce0d3bd938f5b6520ef9376fa909df6b205c2d3f52ee43e3f59ea441b7c4e4d5c", &(0x7f0000000240)="c1b01d40739935b1217d0e393cdd4fa4ef8bbd9957ee996877e4ca155c195dc166f9486ac4db17f754c48938a43419f082a8c30effbef064f6c8b87bc930e439c719ec0a1199040b86286d271f25af26ebed3f55c32e68ac70330df76931bf55fae880256b74a923f8a3022c310f94cc0c623302a5d14b3f8e18f41599882866ea0242864b37d5ae87fbcb745c3e26423d05c5483833dfcdd43dc0c6507329037273de282e3a16ac00c5539c309463984b153ec6250a781975a277017280db1e9c18ce664df5947c6c18bef2367e6163b46b9503f700705fd0e89eae6df0884bf27c00e05fc5efc64907") r6 = syz_usb_connect(0x4, 0xbf, &(0x7f0000000340)="364fb1a417263de22797ec760861f3852cf24f79e2b7a5c62afad7d6d4d09d862f8eccd02e1bb989e0f8a8ad915442016404c9826a5c0a284fc7a840304759b684f357b2e6fecfb3cc8157c008ff0dcff2108984548a2ad695fad9512f06fd12d66bc443047512ab4ef3058ae6c0c6ec3fd627e370a151ae719b8e3a77d682dc06a93be9c2aa8018b58a9492cb39031bb5abf3124eaab85330f181fccca7597b4ec0879fcbcf51143f98c443c16720a6e01b7e07df4727e288e13dcc0b7e11", &(0x7f0000000400)="5903923c7a1b2838f3c12156785a11c81b2e82d9a1190e1b9c45976a917c00294dc94d5354e8c5d6a4e8986da074eb461ed0736bcbede2cef1f19e0216c09eb794d8b9754fea26f110c83248c286eaa05a69844eb1292f594f59f6c9beca47d894d44dfd15ff81b76b4635392eb5ed431ca3092230") syz_usb_disconnect(r6) csource_test.go:124: failed to build program: // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include static unsigned long long procid; static void kill_and_wait(int pid, int* status) { kill(pid, SIGKILL); while (waitpid(-1, status, 0) != pid) { } } static void sleep_ms(uint64_t ms) { usleep(ms * 1000); } static uint64_t current_time_ms(void) { struct timespec ts; if (clock_gettime(CLOCK_MONOTONIC, &ts)) exit(1); return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; } static void use_temporary_dir(void) { char tmpdir_template[] = "./syzkaller.XXXXXX"; char* tmpdir = mkdtemp(tmpdir_template); if (!tmpdir) exit(1); if (chmod(tmpdir, 0777)) exit(1); if (chdir(tmpdir)) exit(1); } static void remove_dir(const char* dir) { DIR* dp; struct dirent* ep; dp = opendir(dir); if (dp == NULL) exit(1); while ((ep = readdir(dp))) { if (strcmp(ep->d_name, ".") == 0 || strcmp(ep->d_name, "..") == 0) continue; char filename[FILENAME_MAX]; snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name); struct stat st; if (lstat(filename, &st)) exit(1); if (S_ISDIR(st.st_mode)) { remove_dir(filename); continue; } if (unlink(filename)) exit(1); } closedir(dp); if (rmdir(dir)) exit(1); } static void thread_start(void* (*fn)(void*), void* arg) { pthread_t th; pthread_attr_t attr; pthread_attr_init(&attr); pthread_attr_setstacksize(&attr, 128 << 10); int i; for (i = 0; i < 100; i++) { if (pthread_create(&th, &attr, fn, arg) == 0) { pthread_attr_destroy(&attr); return; } if (errno == EAGAIN) { usleep(50); continue; } break; } exit(1); } typedef struct { pthread_mutex_t mu; pthread_cond_t cv; int state; } event_t; static void event_init(event_t* ev) { if (pthread_mutex_init(&ev->mu, 0)) exit(1); if (pthread_cond_init(&ev->cv, 0)) exit(1); ev->state = 0; } static void event_reset(event_t* ev) { ev->state = 0; } static void event_set(event_t* ev) { pthread_mutex_lock(&ev->mu); if (ev->state) exit(1); ev->state = 1; pthread_mutex_unlock(&ev->mu); pthread_cond_broadcast(&ev->cv); } static void event_wait(event_t* ev) { pthread_mutex_lock(&ev->mu); while (!ev->state) pthread_cond_wait(&ev->cv, &ev->mu); pthread_mutex_unlock(&ev->mu); } static int event_isset(event_t* ev) { pthread_mutex_lock(&ev->mu); int res = ev->state; pthread_mutex_unlock(&ev->mu); return res; } static int event_timedwait(event_t* ev, uint64_t timeout) { uint64_t start = current_time_ms(); uint64_t now = start; pthread_mutex_lock(&ev->mu); for (;;) { if (ev->state) break; uint64_t remain = timeout - (now - start); struct timespec ts; ts.tv_sec = remain / 1000; ts.tv_nsec = (remain % 1000) * 1000 * 1000; pthread_cond_timedwait(&ev->cv, &ev->mu, &ts); now = current_time_ms(); if (now - start > timeout) break; } int res = ev->state; pthread_mutex_unlock(&ev->mu); return res; } /* -------------------------------------------------------------------------- */ /* * Redefinitions to match the linux types used in common_usb.h. */ struct usb_endpoint_descriptor { uint8_t_t bLength; uint8_t_t bDescriptorType; uint8_t_t bEndpointAddress; uint8_t_t bmAttributes; uint16_t_t wMaxPacketSize; uint8_t_t bInterval; uint8_t_t bRefresh; uint8_t_t bSynchAddress; } __attribute__((packed)); struct usb_device_descriptor { uint8_t_t bLength; uint8_t_t bDescriptorType; uint16_t_t bcdUSB; uint8_t_t bDeviceClass; uint8_t_t bDeviceSubClass; uint8_t_t bDeviceProtocol; uint8_t_t bMaxPacketSize0; uint16_t_t idVendor; uint16_t_t idProduct; uint16_t_t bcdDevice; uint8_t_t iManufacturer; uint8_t_t iProduct; uint8_t_t iSerialNumber; uint8_t_t bNumConfigurations; } __attribute__((packed)); struct usb_config_descriptor { uint8_t_t bLength; uint8_t_t bDescriptorType; uint16_t_t wTotalLength; uint8_t_t bNumInterfaces; uint8_t_t bConfigurationValue; uint8_t_t iConfiguration; uint8_t_t bmAttributes; uint8_t_t bMaxPower; } __attribute__((packed)); struct usb_interface_descriptor { uint8_t_t bLength; uint8_t_t bDescriptorType; uint8_t_t bInterfaceNumber; uint8_t_t bAlternateSetting; uint8_t_t bNumEndpoints; uint8_t_t bInterfaceClass; uint8_t_t bInterfaceSubClass; uint8_t_t bInterfaceProtocol; uint8_t_t iInterface; } __attribute__((packed)); struct usb_ctrlrequest { uint8_t_t bRequestType; uint8_t_t bRequest; uint16_t_t wValue; uint16_t_t wIndex; uint16_t_t wLength; } __attribute__((packed)); struct usb_qualifier_descriptor { uint8_t_t bLength; uint8_t_t bDescriptorType; uint16_t_t bcdUSB; uint8_t_t bDeviceClass; uint8_t_t bDeviceSubClass; uint8_t_t bDeviceProtocol; uint8_t_t bMaxPacketSize0; uint8_t_t bNumConfigurations; uint8_t_t bRESERVED; } __attribute__((packed)); #define USB_TYPE_MASK (0x03 << 5) #define USB_TYPE_STANDARD (0x00 << 5) #define USB_TYPE_CLASS (0x01 << 5) #define USB_TYPE_VENDOR (0x02 << 5) #define USB_TYPE_RESERVED (0x03 << 5) #define USB_DT_DEVICE 0x01 #define USB_DT_CONFIG 0x02 #define USB_DT_STRING 0x03 #define USB_DT_INTERFACE 0x04 #define USB_DT_ENDPOINT 0x05 #define USB_DT_DEVICE_QUALIFIER 0x06 #define USB_DT_OTHER_SPEED_CONFIG 0x07 #define USB_DT_INTERFACE_POWER 0x08 #define USB_DT_OTG 0x09 #define USB_DT_DEBUG 0x0a #define USB_DT_INTERFACE_ASSOCIATION 0x0b #define USB_DT_SECURITY 0x0c #define USB_DT_KEY 0x0d #define USB_DT_ENCRYPTION_TYPE 0x0e #define USB_DT_BOS 0x0f #define USB_DT_DEVICE_CAPABILITY 0x10 #define USB_DT_WIRELESS_ENDPOINT_COMP 0x11 #define USB_DT_WIRE_ADAPTER 0x21 #define USB_DT_RPIPE 0x22 #define USB_DT_CS_RADIO_CONTROL 0x23 #define USB_DT_PIPE_USAGE 0x24 #define USB_DT_SS_ENDPOINT_COMP 0x30 #define USB_DT_SSP_ISOC_ENDPOINT_COMP 0x31 #define USB_REQ_GET_STATUS 0x00 #define USB_REQ_CLEAR_FEATURE 0x01 #define USB_REQ_SET_FEATURE 0x03 #define USB_REQ_SET_ADDRESS 0x05 #define USB_REQ_GET_DESCRIPTOR 0x06 #define USB_REQ_SET_DESCRIPTOR 0x07 #define USB_REQ_GET_CONFIGURATION 0x08 #define USB_REQ_SET_CONFIGURATION 0x09 #define USB_REQ_GET_INTERFACE 0x0A #define USB_REQ_SET_INTERFACE 0x0B #define USB_REQ_SYNCH_FRAME 0x0C #define USB_REQ_SET_SEL 0x30 #define USB_REQ_SET_ISOCH_DELAY 0x31 #define USB_REQ_SET_ENCRYPTION 0x0D #define USB_REQ_GET_ENCRYPTION 0x0E #define USB_REQ_RPIPE_ABORT 0x0E #define USB_REQ_SET_HANDSHAKE 0x0F #define USB_REQ_RPIPE_RESET 0x0F #define USB_REQ_GET_HANDSHAKE 0x10 #define USB_REQ_SET_CONNECTION 0x11 #define USB_REQ_SET_SECURITY_DATA 0x12 #define USB_REQ_GET_SECURITY_DATA 0x13 #define USB_REQ_SET_WUSB_DATA 0x14 #define USB_REQ_LOOPBACK_DATA_WRITE 0x15 #define USB_REQ_LOOPBACK_DATA_READ 0x16 #define USB_REQ_SET_INTERFACE_DS 0x17 #define USB_REQ_GET_PARTNER_PDO 20 #define USB_REQ_GET_BATTERY_STATUS 21 #define USB_REQ_SET_PDO 22 #define USB_REQ_GET_VDM 23 #define USB_REQ_SEND_VDM 24 #define USB_MAX_IFACE_NUM 4 #define USB_MAX_EP_NUM 32 #define USB_MAX_FDS 6 struct usb_endpoint_index { struct usb_endpoint_descriptor desc; int handle; }; struct usb_iface_index { struct usb_interface_descriptor* iface; uint8_t bInterfaceNumber; uint8_t bAlternateSetting; uint8_t bInterfaceClass; struct usb_endpoint_index eps[USB_MAX_EP_NUM]; int eps_num; }; struct usb_device_index { struct usb_device_descriptor* dev; struct usb_config_descriptor* config; uint8_t bDeviceClass; uint8_t bMaxPower; int config_length; struct usb_iface_index ifaces[USB_MAX_IFACE_NUM]; int ifaces_num; int iface_cur; }; struct usb_info { int fd; struct usb_device_index index; }; static struct usb_info usb_devices[USB_MAX_FDS]; static int usb_devices_num; static bool parse_usb_descriptor(const char* buffer, size_t length, struct usb_device_index* index) { if (length < sizeof(*index->dev) + sizeof(*index->config)) return false; memset(index, 0, sizeof(*index)); index->dev = (struct usb_device_descriptor*)buffer; index->config = (struct usb_config_descriptor*)(buffer + sizeof(*index->dev)); index->bDeviceClass = index->dev->bDeviceClass; index->bMaxPower = index->config->bMaxPower; index->config_length = length - sizeof(*index->dev); index->iface_cur = -1; size_t offset = 0; while (true) { if (offset + 1 >= length) break; uint8_t desc_length = buffer[offset]; uint8_t desc_type = buffer[offset + 1]; if (desc_length <= 2) break; if (offset + desc_length > length) break; if (desc_type == USB_DT_INTERFACE && index->ifaces_num < USB_MAX_IFACE_NUM) { struct usb_interface_descriptor* iface = (struct usb_interface_descriptor*)(buffer + offset); index->ifaces[index->ifaces_num].iface = iface; index->ifaces[index->ifaces_num].bInterfaceNumber = iface->bInterfaceNumber; index->ifaces[index->ifaces_num].bAlternateSetting = iface->bAlternateSetting; index->ifaces[index->ifaces_num].bInterfaceClass = iface->bInterfaceClass; index->ifaces_num++; } if (desc_type == USB_DT_ENDPOINT && index->ifaces_num > 0) { struct usb_iface_index* iface = &index->ifaces[index->ifaces_num - 1]; if (iface->eps_num < USB_MAX_EP_NUM) { memcpy(&iface->eps[iface->eps_num].desc, buffer + offset, sizeof(iface->eps[iface->eps_num].desc)); iface->eps_num++; } } offset += desc_length; } return true; } static struct usb_device_index* add_usb_index(int fd, const char* dev, size_t dev_len) { int i = __atomic_fetch_add(&usb_devices_num, 1, __ATOMIC_RELAXED); if (i >= USB_MAX_FDS) return NULL; int rv = 0; rv = parse_usb_descriptor(dev, dev_len, &usb_devices[i].index); if (!rv) return NULL; __atomic_store_n(&usb_devices[i].fd, fd, __ATOMIC_RELEASE); return &usb_devices[i].index; } static struct usb_device_index* lookup_usb_index(int fd) { int i; for (i = 0; i < USB_MAX_FDS; i++) { if (__atomic_load_n(&usb_devices[i].fd, __ATOMIC_ACQUIRE) == fd) { return &usb_devices[i].index; } } return NULL; } struct vusb_connect_string_descriptor { uint32_t len; char* str; } __attribute__((packed)); struct vusb_connect_descriptors { uint32_t qual_len; char* qual; uint32_t bos_len; char* bos; uint32_t strs_len; struct vusb_connect_string_descriptor strs[0]; } __attribute__((packed)); static const char default_string[] = { 8, USB_DT_STRING, 's', 0, 'y', 0, 'z', 0 }; static const char default_lang_id[] = { 4, USB_DT_STRING, 0x09, 0x04 }; static bool lookup_connect_response_in(int fd, const struct vusb_connect_descriptors* descs, const struct usb_ctrlrequest* ctrl, char** response_data, uint32_t* response_length) { struct usb_device_index* index = lookup_usb_index(fd); uint8_t str_idx; if (!index) return false; switch (ctrl->bRequestType & USB_TYPE_MASK) { case USB_TYPE_STANDARD: switch (ctrl->bRequest) { case USB_REQ_GET_DESCRIPTOR: switch (ctrl->wValue >> 8) { case USB_DT_DEVICE: *response_data = (char*)index->dev; *response_length = sizeof(*index->dev); return true; case USB_DT_CONFIG: *response_data = (char*)index->config; *response_length = index->config_length; return true; case USB_DT_STRING: str_idx = (uint8_t)ctrl->wValue; if (descs && str_idx < descs->strs_len) { *response_data = descs->strs[str_idx].str; *response_length = descs->strs[str_idx].len; return true; } if (str_idx == 0) { *response_data = (char*)&default_lang_id[0]; *response_length = default_lang_id[0]; return true; } *response_data = (char*)&default_string[0]; *response_length = default_string[0]; return true; case USB_DT_BOS: *response_data = descs->bos; *response_length = descs->bos_len; return true; case USB_DT_DEVICE_QUALIFIER: if (!descs->qual) { struct usb_qualifier_descriptor* qual = (struct usb_qualifier_descriptor*)response_data; qual->bLength = sizeof(*qual); qual->bDescriptorType = USB_DT_DEVICE_QUALIFIER; qual->bcdUSB = index->dev->bcdUSB; qual->bDeviceClass = index->dev->bDeviceClass; qual->bDeviceSubClass = index->dev->bDeviceSubClass; qual->bDeviceProtocol = index->dev->bDeviceProtocol; qual->bMaxPacketSize0 = index->dev->bMaxPacketSize0; qual->bNumConfigurations = index->dev->bNumConfigurations; qual->bRESERVED = 0; *response_length = sizeof(*qual); return true; } *response_data = descs->qual; *response_length = descs->qual_len; return true; default: break; } break; default: break; } break; default: break; } return false; } typedef bool (*lookup_connect_out_response_t)(int fd, const struct vusb_connect_descriptors* descs, const struct usb_ctrlrequest* ctrl, bool* done); static bool lookup_connect_response_out_generic(int fd, const struct vusb_connect_descriptors* descs, const struct usb_ctrlrequest* ctrl, bool* done) { switch (ctrl->bRequestType & USB_TYPE_MASK) { case USB_TYPE_STANDARD: switch (ctrl->bRequest) { case USB_REQ_SET_CONFIGURATION: *done = true; return true; default: break; } break; } return false; } /* -------------------------------------------------------------------------- */ static int vhci_open(void) { return open("/dev/vhci", O_RDWR); } static int vhci_setport(int fd, u_int port) { struct vhci_ioc_set_port args; args.port = port; return ioctl(fd, VHCI_IOC_SET_PORT, &args); } static int vhci_usb_attach(int fd) { return ioctl(fd, VHCI_IOC_USB_ATTACH, NULL); } static int vhci_usb_recv(int fd, void* buf, size_t size) { uint8_t_t* ptr = (uint8_t_t*)buf; ssize_t done; while (1) { done = read(fd, ptr, size); if (done < 0) return -1; if ((size_t)done == size) return 0; size -= done; ptr += done; } } static int vhci_usb_send(int fd, void* buf, size_t size) { uint8_t_t* ptr = (uint8_t_t*)buf; ssize_t done; while (1) { done = write(fd, ptr, size); if (done <= 0) return -1; if ((size_t)done == size) return 0; size -= done; ptr += done; } } /* -------------------------------------------------------------------------- */ static volatile long syz_usb_connect_impl(uint64_t speed, uint64_t dev_len, const char* dev, const struct vusb_connect_descriptors* descs, lookup_connect_out_response_t lookup_connect_response_out) { struct usb_device_index* index; int portnum, fd, rv; bool done; portnum = procid + 1; if (!dev) { return -1; } if (portnum != 1) { /* For now, we support only one proc. */ return -1; } fd = vhci_open(); if (fd < 0) { return -1; } index = add_usb_index(fd, dev, dev_len); if (!index) { goto err; } rv = vhci_setport(fd, portnum); if (rv != 0) { goto err; } rv = vhci_usb_attach(fd); if (rv != 0) { goto err; } done = false; while (!done) { vhci_request_t req; rv = vhci_usb_recv(fd, &req, sizeof(req)); if (rv != 0) { goto err; } if (req.type != VHCI_REQ_CTRL) { goto err; } char* response_data = NULL; uint32_t response_length = 0; char data[4096]; if (req.u.ctrl.bmRequestType & UE_DIR_IN) { bool response_found = false; response_found = lookup_connect_response_in(fd, descs, (const usb_ctrlrequest*)&req.u.ctrl, &response_data, &response_length); if (!response_found) { goto err; } } else { if (!lookup_connect_response_out(fd, descs, (const usb_ctrlrequest*)&req.u.ctrl, &done)) { goto err; } response_data = NULL; response_length = UGETW(req.u.ctrl.wLength); } if ((req.u.ctrl.bmRequestType & USB_TYPE_MASK) == USB_TYPE_STANDARD && req.u.ctrl.bRequest == USB_REQ_SET_CONFIGURATION) { /* TODO: possibly revisit */ } if (response_length > sizeof(data)) response_length = 0; if ((uint32_t_t)UGETW(req.u.ctrl.wLength) < response_length) response_length = UGETW(req.u.ctrl.wLength); if (response_data) memcpy(data, response_data, response_length); else memset(data, 0, response_length); if (req.u.ctrl.bmRequestType & UE_DIR_IN) { if (response_length > 0) { vhci_response_t res; res.size = response_length; rv = vhci_usb_send(fd, &res, sizeof(res)); if (rv == 0) rv = vhci_usb_send(fd, data, response_length); } } else { rv = vhci_usb_recv(fd, data, response_length); } if (rv < 0) { goto err; } } sleep_ms(200); return fd; err: close(fd); return -1; } static volatile long syz_usb_connect(volatile long a0, volatile long a1, volatile long a2, volatile long a3) { uint64_t speed = a0; uint64_t dev_len = a1; const char* dev = (const char*)a2; const struct vusb_connect_descriptors* descs = (const struct vusb_connect_descriptors*)a3; return syz_usb_connect_impl(speed, dev_len, dev, descs, &lookup_connect_response_out_generic); } static volatile long syz_usb_disconnect(volatile long a0) { int fd = a0; int rv = close(fd); sleep_ms(200); return rv; } static void setup_usb(void) { if (chmod("/dev/vhci", 0666)) exit(1); } static void sandbox_common() { if (setsid() == -1) exit(1); struct rlimit rlim; rlim.rlim_cur = rlim.rlim_max = 8 << 20; setrlimit(RLIMIT_MEMLOCK, &rlim); rlim.rlim_cur = rlim.rlim_max = 1 << 20; setrlimit(RLIMIT_FSIZE, &rlim); rlim.rlim_cur = rlim.rlim_max = 1 << 20; setrlimit(RLIMIT_STACK, &rlim); rlim.rlim_cur = rlim.rlim_max = 0; setrlimit(RLIMIT_CORE, &rlim); rlim.rlim_cur = rlim.rlim_max = 256; setrlimit(RLIMIT_NOFILE, &rlim); } static void loop(); static int do_sandbox_none(void) { sandbox_common(); loop(); return 0; } static long syz_execute_func(volatile long text) { volatile long p[8] = {0}; (void)p; asm volatile("" ::"r"(0l), "r"(1l), "r"(2l), "r"(3l), "r"(4l), "r"(5l), "r"(6l), "r"(7l), "r"(8l), "r"(9l), "r"(10l), "r"(11l), "r"(12l), "r"(13l)); ((void (*)(void))(text))(); return 0; } struct thread_t { int created, call; event_t ready, done; }; static struct thread_t threads[16]; static void execute_call(int call); static int running; static void* thr(void* arg) { struct thread_t* th = (struct thread_t*)arg; for (;;) { event_wait(&th->ready); event_reset(&th->ready); execute_call(th->call); __atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED); event_set(&th->done); } return 0; } static void execute_one(void) { if (write(1, "executing program\n", sizeof("executing program\n") - 1)) { } int i, call, thread; int collide = 0; again: for (call = 0; call < 16; call++) { for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0])); thread++) { struct thread_t* th = &threads[thread]; if (!th->created) { th->created = 1; event_init(&th->ready); event_init(&th->done); event_set(&th->done); thread_start(thr, th); } if (!event_isset(&th->done)) continue; event_reset(&th->done); th->call = call; __atomic_fetch_add(&running, 1, __ATOMIC_RELAXED); event_set(&th->ready); if (collide && (call % 2) == 0) break; event_timedwait(&th->done, 45 + (call == 13 ? 3000 : 0) + (call == 14 ? 3000 : 0) + (call == 15 ? 300 : 0)); break; } } for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++) sleep_ms(1); if (!collide) { collide = 1; goto again; } } static void execute_one(void); #define WAIT_FLAGS 0 static void loop(void) { int iter; for (iter = 0;; iter++) { char cwdbuf[32]; sprintf(cwdbuf, "./%d", iter); if (mkdir(cwdbuf, 0777)) exit(1); int pid = fork(); if (pid < 0) exit(1); if (pid == 0) { if (chdir(cwdbuf)) exit(1); execute_one(); exit(0); } int status = 0; uint64_t start = current_time_ms(); for (;;) { if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) break; sleep_ms(1); if (current_time_ms() - start < 5 * 1000) continue; kill_and_wait(pid, &status); break; } remove_dir(cwdbuf); } } #ifndef SYS_dup2 #define SYS_dup2 90 #endif #ifndef SYS_getgid #define SYS_getgid 47 #endif #ifndef SYS_getgroups #define SYS_getgroups 79 #endif #ifndef SYS_getsockopt #define SYS_getsockopt 118 #endif #ifndef SYS_mmap #define SYS_mmap 197 #endif #ifndef SYS_semctl #define SYS_semctl 442 #endif #ifndef SYS_semget #define SYS_semget 221 #endif #ifndef SYS_seteuid #define SYS_seteuid 183 #endif #ifndef SYS_setregid #define SYS_setregid 127 #endif #ifndef SYS_stat #define SYS_stat 439 #endif #ifndef SYS_writev #define SYS_writev 121 #endif uint64_t r[7] = {0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}; void execute_call(int call) { intptr_t res = 0; switch (call) { case 0: res = syscall(SYS_dup2, -1, 0xffffff9c); if (res != -1) r[0] = res; break; case 1: *(uint64_t*)0x200002c0 = 0x20000000; memcpy((void*)0x20000000, "\x25\xc5\xf6\x76\x86\x92\xf1\x6a\x6b\x02\x33\x7b\xc5\xf2\x4e\x95\xc2\xe5\x74\xf7\xbd\x23\xda\x78\xff\x22\x41\x43\x9c\xac\xed\x12\x2e\x33\xab\x16\xd3\x77\x84\x34\x15\x78\x1f\xa5\x08\xcd\x63\x5f\x2f\xd0\x41\x13\x20\x4e\xd9\xbd\xa7\x39\x6e\x99\xa3\x8a\x2f\x10\xe9\xc7\x39\x8b\x5a\x64\xc4\x9d\x98\x66\x4b\xd1\x49\x75\xbe\x70\x76\xa8\x36\x38\xa7\xda\x30\x95\xf0\xe0\x27\xbd\x16\x1c\xcd\x5c\x99\x4f\x8b\x31\xd5\x35\xa3\xce\x4c\x57\x81\x2d\x96\x82\xf3\xeb\xb1\x0e\x05\xa7\x14\x22\x10\x51\x5b\x66\x8d\x13\x57\xd9\x1a\xaa\xbb\x6a\xd8\x8a\xed\x6b\x9f\x21\x43\xd0\x62\xe0\xb5", 141); *(uint64_t*)0x200002c8 = 0x8d; *(uint64_t*)0x200002d0 = 0x200000c0; memcpy((void*)0x200000c0, "\xe8\x98\x7e\x8f\x86\x4e\x9d\x38\xb5\x56\x15\xb6\x59\xd1\x4c\xae\x9e\x91\xa9\x53\x22\x13\xff\xb4\x65\xb6\x1b", 27); *(uint64_t*)0x200002d8 = 0x1b; *(uint64_t*)0x200002e0 = 0x20000100; memcpy((void*)0x20000100, "\x3f\x97\x99\x2c\x94\x0f\xba\x89\x36\xa6\xb4", 11); *(uint64_t*)0x200002e8 = 0xb; *(uint64_t*)0x200002f0 = 0x20000140; memcpy((void*)0x20000140, "\xc9\x9a\xb6\x04\xeb\x2e\x44\xeb\xf7\xbf\xb7\xb0\x4c\x08\x43\x21\xa3\x0f\x43\x51\xae\xb0\x67\x6b\xb2\x1a\xef\xc3\xbc\x23\x22\xd9\x9a\x5b\x03\x4f\x88\x0a\xa2\x5d\x61\xae\x40\x76\x39\x7c\x30\x35\x7b\x22\xcc\xb7\x79\xeb\xd3\x20\x6a\xc6\x48\xfa\xb9\x08\x36\xdd\x4d\x9e\x73\xdc\x3c\x07\x72\x70\xb5\x7d\xc3\x22\x22\x84\xdd\x3c\xae\x47\x37\x95\x7d\x94\x7d\x76\x5a\x5e\x0e\x91\x9c\xbd\x3e\xf2\xd3\xd9\x52\x2a\x82\x7f\x3f\xe6\x0d\xdc", 106); *(uint64_t*)0x200002f8 = 0x6a; *(uint64_t*)0x20000300 = 0x200001c0; memcpy((void*)0x200001c0, "\x2b\xc5\xa9\xfd\x6c\xc3\x45\x00\x82\x40\x5a\xb6\x07\xa0\xf5\x62\x7b\x40\x58\x9a\x69\x0a\xc5\x91\x58\xac\xf1\x0f\x2a\x1c\xc4\x61\x52\xfa\x5f\x49\x3a\x85\x99\xcc\x6e\xaa\xb5\xd9\x69\x68\xbe\xf1\xa2\x7f\x62\xda\xcf\x64\xd0\x6c\x80\xcf\xb5\xb3\x20\xb9\x77\xc9\x43\x2c\x44\x6f\xa6\xf6\x55\x14\x44\xee\x4c\x59\x98\x85\x32\x60\xd6\x5d\x2c\xb3\xc7\x78\xf4\x4f\xe2\x70\x36\x3b\x4e\xb3\x09\xe2\x4f\xc4\x77\x97\xb5\xbd\x45\x4b\xf4\xd3\xd4\x65\x6f\xa0\x78\xff\x56\xb3\x0f\x4f\x0e\x9d\x5e\x6e\x89\x43\x83\x0a\xd6\xd3\x42\x96\x8c\x22\x4f\x7c\x35\xaf\x01\xa6\x1d\x10\xe1\x55\xfe\xe7\xe0\x22\x7c\xd7\x9a\x79\x77\xb3\xf4\x03\x51\xca\x01\x83\x48\x40\xab\xba\x55\x7d\x36\xbc\x8a\x42\x08\xf9\x0d\xc5\xf5\x1e\x3f\x3d\x44\x5c\x5f\xee\xa7\x93\x68\x16\x4e\xde\xf0\x5d\x24\x74\x8c\xe9\xf0\xa5\x84\x51\xb4\x3d\x98\x91\x90\x2b\xc4\x5e\xc6\x7d\x00\xdf\x1d\xeb\x74\xe6\x5b\x29\xc0\xd0\x95\xdb\xdd\x5b\x9a\x7c", 220); *(uint64_t*)0x20000308 = 0xdc; syscall(SYS_writev, r[0], 0x200002c0ul, 5ul); break; case 2: *(uint32_t*)0x20000340 = 0; *(uint32_t*)0x20000344 = -1; *(uint32_t*)0x20000348 = 0; res = syscall(SYS_getgroups, 3ul, 0x20000340ul); if (res != -1) r[1] = *(uint32_t*)0x20000348; break; case 3: *(uint32_t*)0x200003c0 = 0xc; res = syscall(SYS_getsockopt, -1, 0xffff, 0x11, 0x20000380ul, 0x200003c0ul); if (res != -1) r[2] = *(uint32_t*)0x20000388; break; case 4: syscall(SYS_setregid, r[1], r[2]); break; case 5: res = syscall(SYS_semget, 0x798e2634ul + procid*4, 0ul, 0xb2603d964b180ce8ul); if (res != -1) r[3] = res; break; case 6: memcpy((void*)0x20000400, "./file0\000", 8); res = syscall(SYS_stat, 0x20000400ul, 0x20000440ul); if (res != -1) r[4] = *(uint32_t*)0x2000045c; break; case 7: res = syscall(SYS_getgid); if (res != -1) r[5] = res; break; case 8: *(uint32_t*)0x20000500 = 0xfffff834; *(uint32_t*)0x20000504 = r[4]; *(uint32_t*)0x20000508 = r[5]; *(uint32_t*)0x2000050c = -1; *(uint32_t*)0x20000510 = 0; *(uint32_t*)0x20000514 = 3; *(uint16_t*)0x20000518 = 9; *(uint16_t*)0x2000051a = 0; *(uint64_t*)0x20000520 = 0; *(uint64_t*)0x20000528 = 0; *(uint64_t*)0x20000530 = 0xfffffffffffffffd; *(uint64_t*)0x20000538 = 0x4535; *(uint64_t*)0x20000540 = 2; *(uint64_t*)0x20000548 = 0; *(uint64_t*)0x20000550 = 0; syscall(SYS_semctl, r[3], 0ul, 1ul, 0x20000500ul); break; case 9: syscall(SYS_seteuid, 0); break; case 10: memcpy((void*)0x20000000, "\xbf\x5b\xc2\xc4\xdd\xcd\x9b\xaa\x7f\x7c\x66\xf9\x17\x26\xa8\xc4\x90\xf6\x91\x85\x14\x0b\x5b\x42\x51\xe8\x67\x01\xc6\xc5\xa6\x0d\x84\x80\x2d\x38\x2a\x0c\x38\xdf\x4a\x28\xfd\x84\x0d\x7e\x14\x06\xa5\xc2\xeb\x5d\x3b\x6b\xc3\x23\xbd\x49\x38\x6c\x4a\x92\x49\x50\x31\x4f\xe6\x17\xf8\xcd\x34\x37\xa4\xaa\x6d\x1c\x6d\x62\x64\x03\x09\xf9\xde\x23\x93\x99\x9b\x11\x47\x68\xd5\x10\xd7\x34\xfd\x72\xd1\x98\xb2\x61\xbd\x61\x81\x14\xbf\x3f\xa3\xe2\xfe\x84\xff\xe6\x5c\x80\xe4\x72\x12\xc4\x9e\x47\xbb\x3a\xaa\x86\x89\x46\x2f\x21\xd5\x18\x80\xd9\x7c\xb4\x45\xd3", 136); break; case 11: memcpy((void*)0x200000c0, "\xc4\xa1\x84\x58\x2c\xaa\x26\x44\x0f\xae\x04\xc4\x41\x0f\x74\xab\x00\x00\x01\x00\xc4\x23\xf5\x78\x4c\xe9\x9d\x40\x44\xdf\x34\x59\x26\x41\x0f\xae\x41\x01\x64\x64\x66\x44\x0f\xe5\xb9\x4e\x9a\xb0\xc4\xc4\x22\x7d\x47\x0f\x41\x0f\x45\x7f\x56\x66\x0f\xdd\xe8", 63); syz_execute_func(0x200000c0); break; case 12: break; case 13: memcpy((void*)0x20000140, "\x64\xd3\x2f\x16\xeb\xd8\x17\xd0\x04\xdc\xb8\x01\x71\x82\x05\xbc\xa1\xd8\x6d\xad\x3c\xb1\x32\xa2\x86\x60\x92\x14\xb7\x39\x5a\x97\xa0\xe8\xfe\xda\x5f\xad\x02\xcc\xe9\xde\xea\x94\xd5\x5a\x75\x0c\x17\xb2\x34\x07\x50\x02\xb9\xdf\x62\x9f\xa6\x8e\x3f\x7d\xa9\x7e\x9c\x2a\x2e\x0a\x95\xd1\x5d\x35\x95\x61\xb1\x47\x74\x40\x34\x2c\xd7\x9c\x7c\xeb\xd6\xbf\x00\x8a\xcd\x1c\x7f\xf1\x46\xa6\xfe\x22\x01\x36\x61\xd8\xc8\xce\x8e\xb1\x7f\x5c\xf3\x89\x2a\xe0\x8b\xba\x46\x54\x5b\x2b\x69\x0a\xb7\xe0\x36\x8a\xec\x4d\x32\xb7\x6d\x7f\xc1\x5d\xd7\xc2\xab\xa1\x84\xd4\x1a\x5e\x5a\xbb\x8d\x71\x6f\x5e\x64\x5e\x17\x67\x13\x8e\xd7\x38\xf3\x15\x79\x5a\xc9\x9e\x22\xfd\x44\xdb\x06\x09\x63\x13\xf4\x72\x9c\xe0\xd3\xbd\x93\x8f\x5b\x65\x20\xef\x93\x76\xfa\x90\x9d\xf6\xb2\x05\xc2\xd3\xf5\x2e\xe4\x3e\x3f\x59\xea\x44\x1b\x7c\x4e\x4d\x5c", 201); memcpy((void*)0x20000240, "\xc1\xb0\x1d\x40\x73\x99\x35\xb1\x21\x7d\x0e\x39\x3c\xdd\x4f\xa4\xef\x8b\xbd\x99\x57\xee\x99\x68\x77\xe4\xca\x15\x5c\x19\x5d\xc1\x66\xf9\x48\x6a\xc4\xdb\x17\xf7\x54\xc4\x89\x38\xa4\x34\x19\xf0\x82\xa8\xc3\x0e\xff\xbe\xf0\x64\xf6\xc8\xb8\x7b\xc9\x30\xe4\x39\xc7\x19\xec\x0a\x11\x99\x04\x0b\x86\x28\x6d\x27\x1f\x25\xaf\x26\xeb\xed\x3f\x55\xc3\x2e\x68\xac\x70\x33\x0d\xf7\x69\x31\xbf\x55\xfa\xe8\x80\x25\x6b\x74\xa9\x23\xf8\xa3\x02\x2c\x31\x0f\x94\xcc\x0c\x62\x33\x02\xa5\xd1\x4b\x3f\x8e\x18\xf4\x15\x99\x88\x28\x66\xea\x02\x42\x86\x4b\x37\xd5\xae\x87\xfb\xcb\x74\x5c\x3e\x26\x42\x3d\x05\xc5\x48\x38\x33\xdf\xcd\xd4\x3d\xc0\xc6\x50\x73\x29\x03\x72\x73\xde\x28\x2e\x3a\x16\xac\x00\xc5\x53\x9c\x30\x94\x63\x98\x4b\x15\x3e\xc6\x25\x0a\x78\x19\x75\xa2\x77\x01\x72\x80\xdb\x1e\x9c\x18\xce\x66\x4d\xf5\x94\x7c\x6c\x18\xbe\xf2\x36\x7e\x61\x63\xb4\x6b\x95\x03\xf7\x00\x70\x5f\xd0\xe8\x9e\xae\x6d\xf0\x88\x4b\xf2\x7c\x00\xe0\x5f\xc5\xef\xc6\x49\x07", 234); syz_usb_connect(0, 0xc9, 0x20000140, 0x20000240); break; case 14: memcpy((void*)0x20000340, "\x36\x4f\xb1\xa4\x17\x26\x3d\xe2\x27\x97\xec\x76\x08\x61\xf3\x85\x2c\xf2\x4f\x79\xe2\xb7\xa5\xc6\x2a\xfa\xd7\xd6\xd4\xd0\x9d\x86\x2f\x8e\xcc\xd0\x2e\x1b\xb9\x89\xe0\xf8\xa8\xad\x91\x54\x42\x01\x64\x04\xc9\x82\x6a\x5c\x0a\x28\x4f\xc7\xa8\x40\x30\x47\x59\xb6\x84\xf3\x57\xb2\xe6\xfe\xcf\xb3\xcc\x81\x57\xc0\x08\xff\x0d\xcf\xf2\x10\x89\x84\x54\x8a\x2a\xd6\x95\xfa\xd9\x51\x2f\x06\xfd\x12\xd6\x6b\xc4\x43\x04\x75\x12\xab\x4e\xf3\x05\x8a\xe6\xc0\xc6\xec\x3f\xd6\x27\xe3\x70\xa1\x51\xae\x71\x9b\x8e\x3a\x77\xd6\x82\xdc\x06\xa9\x3b\xe9\xc2\xaa\x80\x18\xb5\x8a\x94\x92\xcb\x39\x03\x1b\xb5\xab\xf3\x12\x4e\xaa\xb8\x53\x30\xf1\x81\xfc\xcc\xa7\x59\x7b\x4e\xc0\x87\x9f\xcb\xcf\x51\x14\x3f\x98\xc4\x43\xc1\x67\x20\xa6\xe0\x1b\x7e\x07\xdf\x47\x27\xe2\x88\xe1\x3d\xcc\x0b\x7e\x11", 191); memcpy((void*)0x20000400, "\x59\x03\x92\x3c\x7a\x1b\x28\x38\xf3\xc1\x21\x56\x78\x5a\x11\xc8\x1b\x2e\x82\xd9\xa1\x19\x0e\x1b\x9c\x45\x97\x6a\x91\x7c\x00\x29\x4d\xc9\x4d\x53\x54\xe8\xc5\xd6\xa4\xe8\x98\x6d\xa0\x74\xeb\x46\x1e\xd0\x73\x6b\xcb\xed\xe2\xce\xf1\xf1\x9e\x02\x16\xc0\x9e\xb7\x94\xd8\xb9\x75\x4f\xea\x26\xf1\x10\xc8\x32\x48\xc2\x86\xea\xa0\x5a\x69\x84\x4e\xb1\x29\x2f\x59\x4f\x59\xf6\xc9\xbe\xca\x47\xd8\x94\xd4\x4d\xfd\x15\xff\x81\xb7\x6b\x46\x35\x39\x2e\xb5\xed\x43\x1c\xa3\x09\x22\x30", 117); res = syz_usb_connect(4, 0xbf, 0x20000340, 0x20000400); if (res != -1) r[6] = res; break; case 15: syz_usb_disconnect(r[6]); break; } } int main(void) { syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 3ul, 0x1012ul, -1, 0ul, 0ul); for (procid = 0; procid < 2; procid++) { if (fork() == 0) { use_temporary_dir(); do_sandbox_none(); } } sleep(1000000); return 0; } :187:2: error: unknown type name 'uint8_t_t' :188:2: error: unknown type name 'uint8_t_t' :189:2: error: unknown type name 'uint8_t_t' :190:2: error: unknown type name 'uint8_t_t' :191:2: error: unknown type name 'uint16_t_t' :192:2: error: unknown type name 'uint8_t_t' :193:2: error: unknown type name 'uint8_t_t' :194:2: error: unknown type name 'uint8_t_t' :198:2: error: unknown type name 'uint8_t_t' :199:2: error: unknown type name 'uint8_t_t' :200:2: error: unknown type name 'uint16_t_t' :201:2: error: unknown type name 'uint8_t_t' :202:2: error: unknown type name 'uint8_t_t' :203:2: error: unknown type name 'uint8_t_t' :204:2: error: unknown type name 'uint8_t_t' :205:2: error: unknown type name 'uint16_t_t' :206:2: error: unknown type name 'uint16_t_t' :207:2: error: unknown type name 'uint16_t_t' :208:2: error: unknown type name 'uint8_t_t' :209:2: error: unknown type name 'uint8_t_t' :210:2: error: unknown type name 'uint8_t_t' :211:2: error: unknown type name 'uint8_t_t' :215:2: error: unknown type name 'uint8_t_t' :216:2: error: unknown type name 'uint8_t_t' :217:2: error: unknown type name 'uint16_t_t' :218:2: error: unknown type name 'uint8_t_t' :219:2: error: unknown type name 'uint8_t_t' :220:2: error: unknown type name 'uint8_t_t' :221:2: error: unknown type name 'uint8_t_t' :222:2: error: unknown type name 'uint8_t_t' :226:2: error: unknown type name 'uint8_t_t' :227:2: error: unknown type name 'uint8_t_t' :228:2: error: unknown type name 'uint8_t_t' :229:2: error: unknown type name 'uint8_t_t' :230:2: error: unknown type name 'uint8_t_t' :231:2: error: unknown type name 'uint8_t_t' :232:2: error: unknown type name 'uint8_t_t' :233:2: error: unknown type name 'uint8_t_t' :234:2: error: unknown type name 'uint8_t_t' :238:2: error: unknown type name 'uint8_t_t' :239:2: error: unknown type name 'uint8_t_t' :240:2: error: unknown type name 'uint16_t_t' :241:2: error: unknown type name 'uint16_t_t' :242:2: error: unknown type name 'uint16_t_t' :246:2: error: unknown type name 'uint8_t_t' :247:2: error: unknown type name 'uint8_t_t' :248:2: error: unknown type name 'uint16_t_t' :249:2: error: unknown type name 'uint8_t_t' :250:2: error: unknown type name 'uint8_t_t' :251:2: error: unknown type name 'uint8_t_t' :252:2: error: unknown type name 'uint8_t_t' :253:2: error: unknown type name 'uint8_t_t' :254:2: error: unknown type name 'uint8_t_t' : In function 'vhci_usb_recv': :561:2: error: unknown type name 'uint8_t_t'; did you mean 'uint8_t'? :561:20: error: 'uint8_t_t' undeclared (first use in this function); did you mean 'uint8_t'? :561:20: note: each undeclared identifier is reported only once for each function it appears in :561:30: error: expected expression before ')' token : In function 'vhci_usb_send': :576:2: error: unknown type name 'uint8_t_t'; did you mean 'uint8_t'? :576:20: error: 'uint8_t_t' undeclared (first use in this function); did you mean 'uint8_t'? :576:30: error: expected expression before ')' token : In function 'syz_usb_connect_impl': :637:63: error: unknown type name 'usb_ctrlrequest' :642:55: error: unknown type name 'usb_ctrlrequest' :654:8: error: 'uint32_t_t' undeclared (first use in this function); did you mean 'uint32_t'? At top level: :702:13: error: 'setup_usb' defined but not used [-Werror=unused-function] cc1: all warnings being treated as errors compiler invocation: /syzkaller/netbsd/src/../tools/bin/x86_64--netbsd-g++ [-o /tmp/syz-executor765215906 -DGOOS_netbsd=1 -DGOARCH_amd64=1 -DHOSTGOOS_linux=1 -x c - -m64 --sysroot /syzkaller/netbsd/src/../dest/ -O2 -pthread -Wall -Werror -Wparentheses -Wframe-larger-than=16384] --- FAIL: TestGenerate/netbsd/amd64/5 (0.51s) csource_test.go:121: --- FAIL: TestGenerate/netbsd/amd64/3 (0.45s) csource_test.go:121: --- FAIL: TestGenerate/netbsd/amd64/2 (0.49s) csource_test.go:121: --- FAIL: TestGenerate/netbsd/amd64/4 (0.54s) csource_test.go:121: --- FAIL: TestGenerate/netbsd/amd64/7 (0.53s) csource_test.go:121: --- FAIL: TestGenerate/netbsd/amd64/9 (0.43s) csource_test.go:123: opts: {Threaded:true Collide:false Repeat:true RepeatTimes:0 Procs:0 Sandbox:none Fault:false FaultCall:0 FaultNth:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false USB:false UseTmpDir:true HandleSegv:false Repro:false Trace:false} program: r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c) writev(r0, &(0x7f00000002c0)=[{&(0x7f0000000000)="25c5f6768692f16a6b02337bc5f24e95c2e574f7bd23da78ff2241439caced122e33ab16d377843415781fa508cd635f2fd04113204ed9bda7396e99a38a2f10e9c7398b5a64c49d98664bd14975be7076a83638a7da3095f0e027bd161ccd5c994f8b31d535a3ce4c57812d9682f3ebb10e05a7142210515b668d1357d91aaabb6ad88aed6b9f2143d062e0b5", 0x8d}, {&(0x7f00000000c0)="e8987e8f864e9d38b55615b659d14cae9e91a9532213ffb465b61b", 0x1b}, {&(0x7f0000000100)="3f97992c940fba8936a6b4", 0xb}, {&(0x7f0000000140)="c99ab604eb2e44ebf7bfb7b04c084321a30f4351aeb0676bb21aefc3bc2322d99a5b034f880aa25d61ae4076397c30357b22ccb779ebd3206ac648fab90836dd4d9e73dc3c077270b57dc3222284dd3cae4737957d947d765a5e0e919cbd3ef2d3d9522a827f3fe60ddc", 0x6a}, {&(0x7f00000001c0)="2bc5a9fd6cc3450082405ab607a0f5627b40589a690ac59158acf10f2a1cc46152fa5f493a8599cc6eaab5d96968bef1a27f62dacf64d06c80cfb5b320b977c9432c446fa6f6551444ee4c5998853260d65d2cb3c778f44fe270363b4eb309e24fc47797b5bd454bf4d3d4656fa078ff56b30f4f0e9d5e6e8943830ad6d342968c224f7c35af01a61d10e155fee7e0227cd79a7977b3f40351ca01834840abba557d36bc8a4208f90dc5f51e3f3d445c5feea79368164edef05d24748ce9f0a58451b43d9891902bc45ec67d00df1deb74e65b29c0d095dbdd5b9a7c", 0xdc}], 0x5) getgroups(0x3, &(0x7f0000000340)=[0x0, 0xffffffffffffffff, 0x0]) getsockopt$sock_cred(0xffffffffffffffff, 0xffff, 0x11, &(0x7f0000000380)={0x0, 0x0, 0x0}, &(0x7f00000003c0)=0xc) setregid(r1, r2) r3 = semget(0x1, 0x0, 0xb2603d964b180ce8) stat(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0}) r5 = getgid() semctl$IPC_SET(r3, 0x0, 0x1, &(0x7f0000000500)={{0xfffff834, r4, r5, 0xffffffffffffffff, 0x0, 0x3, 0x9}, 0xfffffffffffffffd, 0x4535, 0x2}) seteuid(0x0) syz_emit_ethernet(0x88, &(0x7f0000000000)="bf5bc2c4ddcd9baa7f7c66f91726a8c490f69185140b5b4251e86701c6c5a60d84802d382a0c38df4a28fd840d7e1406a5c2eb5d3b6bc323bd49386c4a924950314fe617f8cd3437a4aa6d1c6d62640309f9de2393999b114768d510d734fd72d198b261bd618114bf3fa3e2fe84ffe65c80e47212c49e47bb3aaa8689462f21d51880d97cb445d3") syz_execute_func(&(0x7f00000000c0)="c4a184582caa26440fae04c4410f74ab00000100c423f5784ce99d4044df345926410fae4101646466440fe5b94e9ab0c4c4227d470f410f457f56660fdde8") syz_extract_tcp_res(&(0x7f0000000100), 0x6, 0x1) syz_usb_connect(0x0, 0xc9, &(0x7f0000000140)="64d32f16ebd817d004dcb801718205bca1d86dad3cb132a286609214b7395a97a0e8feda5fad02cce9deea94d55a750c17b234075002b9df629fa68e3f7da97e9c2a2e0a95d15d359561b1477440342cd79c7cebd6bf008acd1c7ff146a6fe22013661d8c8ce8eb17f5cf3892ae08bba46545b2b690ab7e0368aec4d32b76d7fc15dd7c2aba184d41a5e5abb8d716f5e645e1767138ed738f315795ac99e22fd44db06096313f4729ce0d3bd938f5b6520ef9376fa909df6b205c2d3f52ee43e3f59ea441b7c4e4d5c", &(0x7f0000000240)="c1b01d40739935b1217d0e393cdd4fa4ef8bbd9957ee996877e4ca155c195dc166f9486ac4db17f754c48938a43419f082a8c30effbef064f6c8b87bc930e439c719ec0a1199040b86286d271f25af26ebed3f55c32e68ac70330df76931bf55fae880256b74a923f8a3022c310f94cc0c623302a5d14b3f8e18f41599882866ea0242864b37d5ae87fbcb745c3e26423d05c5483833dfcdd43dc0c6507329037273de282e3a16ac00c5539c309463984b153ec6250a781975a277017280db1e9c18ce664df5947c6c18bef2367e6163b46b9503f700705fd0e89eae6df0884bf27c00e05fc5efc64907") r6 = syz_usb_connect(0x4, 0xbf, &(0x7f0000000340)="364fb1a417263de22797ec760861f3852cf24f79e2b7a5c62afad7d6d4d09d862f8eccd02e1bb989e0f8a8ad915442016404c9826a5c0a284fc7a840304759b684f357b2e6fecfb3cc8157c008ff0dcff2108984548a2ad695fad9512f06fd12d66bc443047512ab4ef3058ae6c0c6ec3fd627e370a151ae719b8e3a77d682dc06a93be9c2aa8018b58a9492cb39031bb5abf3124eaab85330f181fccca7597b4ec0879fcbcf51143f98c443c16720a6e01b7e07df4727e288e13dcc0b7e11", &(0x7f0000000400)="5903923c7a1b2838f3c12156785a11c81b2e82d9a1190e1b9c45976a917c00294dc94d5354e8c5d6a4e8986da074eb461ed0736bcbede2cef1f19e0216c09eb794d8b9754fea26f110c83248c286eaa05a69844eb1292f594f59f6c9beca47d894d44dfd15ff81b76b4635392eb5ed431ca3092230") syz_usb_disconnect(r6) csource_test.go:124: failed to build program: // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include static unsigned long long procid; static void kill_and_wait(int pid, int* status) { kill(pid, SIGKILL); while (waitpid(-1, status, 0) != pid) { } } static void sleep_ms(uint64_t ms) { usleep(ms * 1000); } static uint64_t current_time_ms(void) { struct timespec ts; if (clock_gettime(CLOCK_MONOTONIC, &ts)) exit(1); return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; } static void use_temporary_dir(void) { char tmpdir_template[] = "./syzkaller.XXXXXX"; char* tmpdir = mkdtemp(tmpdir_template); if (!tmpdir) exit(1); if (chmod(tmpdir, 0777)) exit(1); if (chdir(tmpdir)) exit(1); } static void remove_dir(const char* dir) { DIR* dp; struct dirent* ep; dp = opendir(dir); if (dp == NULL) exit(1); while ((ep = readdir(dp))) { if (strcmp(ep->d_name, ".") == 0 || strcmp(ep->d_name, "..") == 0) continue; char filename[FILENAME_MAX]; snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name); struct stat st; if (lstat(filename, &st)) exit(1); if (S_ISDIR(st.st_mode)) { remove_dir(filename); continue; } if (unlink(filename)) exit(1); } closedir(dp); if (rmdir(dir)) exit(1); } static void thread_start(void* (*fn)(void*), void* arg) { pthread_t th; pthread_attr_t attr; pthread_attr_init(&attr); pthread_attr_setstacksize(&attr, 128 << 10); int i; for (i = 0; i < 100; i++) { if (pthread_create(&th, &attr, fn, arg) == 0) { pthread_attr_destroy(&attr); return; } if (errno == EAGAIN) { usleep(50); continue; } break; } exit(1); } typedef struct { pthread_mutex_t mu; pthread_cond_t cv; int state; } event_t; static void event_init(event_t* ev) { if (pthread_mutex_init(&ev->mu, 0)) exit(1); if (pthread_cond_init(&ev->cv, 0)) exit(1); ev->state = 0; } static void event_reset(event_t* ev) { ev->state = 0; } static void event_set(event_t* ev) { pthread_mutex_lock(&ev->mu); if (ev->state) exit(1); ev->state = 1; pthread_mutex_unlock(&ev->mu); pthread_cond_broadcast(&ev->cv); } static void event_wait(event_t* ev) { pthread_mutex_lock(&ev->mu); while (!ev->state) pthread_cond_wait(&ev->cv, &ev->mu); pthread_mutex_unlock(&ev->mu); } static int event_isset(event_t* ev) { pthread_mutex_lock(&ev->mu); int res = ev->state; pthread_mutex_unlock(&ev->mu); return res; } static int event_timedwait(event_t* ev, uint64_t timeout) { uint64_t start = current_time_ms(); uint64_t now = start; pthread_mutex_lock(&ev->mu); for (;;) { if (ev->state) break; uint64_t remain = timeout - (now - start); struct timespec ts; ts.tv_sec = remain / 1000; ts.tv_nsec = (remain % 1000) * 1000 * 1000; pthread_cond_timedwait(&ev->cv, &ev->mu, &ts); now = current_time_ms(); if (now - start > timeout) break; } int res = ev->state; pthread_mutex_unlock(&ev->mu); return res; } /* -------------------------------------------------------------------------- */ /* * Redefinitions to match the linux types used in common_usb.h. */ struct usb_endpoint_descriptor { uint8_t_t bLength; uint8_t_t bDescriptorType; uint8_t_t bEndpointAddress; uint8_t_t bmAttributes; uint16_t_t wMaxPacketSize; uint8_t_t bInterval; uint8_t_t bRefresh; uint8_t_t bSynchAddress; } __attribute__((packed)); struct usb_device_descriptor { uint8_t_t bLength; uint8_t_t bDescriptorType; uint16_t_t bcdUSB; uint8_t_t bDeviceClass; uint8_t_t bDeviceSubClass; uint8_t_t bDeviceProtocol; uint8_t_t bMaxPacketSize0; uint16_t_t idVendor; uint16_t_t idProduct; uint16_t_t bcdDevice; uint8_t_t iManufacturer; uint8_t_t iProduct; uint8_t_t iSerialNumber; uint8_t_t bNumConfigurations; } __attribute__((packed)); struct usb_config_descriptor { uint8_t_t bLength; uint8_t_t bDescriptorType; uint16_t_t wTotalLength; uint8_t_t bNumInterfaces; uint8_t_t bConfigurationValue; uint8_t_t iConfiguration; uint8_t_t bmAttributes; uint8_t_t bMaxPower; } __attribute__((packed)); struct usb_interface_descriptor { uint8_t_t bLength; uint8_t_t bDescriptorType; uint8_t_t bInterfaceNumber; uint8_t_t bAlternateSetting; uint8_t_t bNumEndpoints; uint8_t_t bInterfaceClass; uint8_t_t bInterfaceSubClass; uint8_t_t bInterfaceProtocol; uint8_t_t iInterface; } __attribute__((packed)); struct usb_ctrlrequest { uint8_t_t bRequestType; uint8_t_t bRequest; uint16_t_t wValue; uint16_t_t wIndex; uint16_t_t wLength; } __attribute__((packed)); struct usb_qualifier_descriptor { uint8_t_t bLength; uint8_t_t bDescriptorType; uint16_t_t bcdUSB; uint8_t_t bDeviceClass; uint8_t_t bDeviceSubClass; uint8_t_t bDeviceProtocol; uint8_t_t bMaxPacketSize0; uint8_t_t bNumConfigurations; uint8_t_t bRESERVED; } __attribute__((packed)); #define USB_TYPE_MASK (0x03 << 5) #define USB_TYPE_STANDARD (0x00 << 5) #define USB_TYPE_CLASS (0x01 << 5) #define USB_TYPE_VENDOR (0x02 << 5) #define USB_TYPE_RESERVED (0x03 << 5) #define USB_DT_DEVICE 0x01 #define USB_DT_CONFIG 0x02 #define USB_DT_STRING 0x03 #define USB_DT_INTERFACE 0x04 #define USB_DT_ENDPOINT 0x05 #define USB_DT_DEVICE_QUALIFIER 0x06 #define USB_DT_OTHER_SPEED_CONFIG 0x07 #define USB_DT_INTERFACE_POWER 0x08 #define USB_DT_OTG 0x09 #define USB_DT_DEBUG 0x0a #define USB_DT_INTERFACE_ASSOCIATION 0x0b #define USB_DT_SECURITY 0x0c #define USB_DT_KEY 0x0d #define USB_DT_ENCRYPTION_TYPE 0x0e #define USB_DT_BOS 0x0f #define USB_DT_DEVICE_CAPABILITY 0x10 #define USB_DT_WIRELESS_ENDPOINT_COMP 0x11 #define USB_DT_WIRE_ADAPTER 0x21 #define USB_DT_RPIPE 0x22 #define USB_DT_CS_RADIO_CONTROL 0x23 #define USB_DT_PIPE_USAGE 0x24 #define USB_DT_SS_ENDPOINT_COMP 0x30 #define USB_DT_SSP_ISOC_ENDPOINT_COMP 0x31 #define USB_REQ_GET_STATUS 0x00 #define USB_REQ_CLEAR_FEATURE 0x01 #define USB_REQ_SET_FEATURE 0x03 #define USB_REQ_SET_ADDRESS 0x05 #define USB_REQ_GET_DESCRIPTOR 0x06 #define USB_REQ_SET_DESCRIPTOR 0x07 #define USB_REQ_GET_CONFIGURATION 0x08 #define USB_REQ_SET_CONFIGURATION 0x09 #define USB_REQ_GET_INTERFACE 0x0A #define USB_REQ_SET_INTERFACE 0x0B #define USB_REQ_SYNCH_FRAME 0x0C #define USB_REQ_SET_SEL 0x30 #define USB_REQ_SET_ISOCH_DELAY 0x31 #define USB_REQ_SET_ENCRYPTION 0x0D #define USB_REQ_GET_ENCRYPTION 0x0E #define USB_REQ_RPIPE_ABORT 0x0E #define USB_REQ_SET_HANDSHAKE 0x0F #define USB_REQ_RPIPE_RESET 0x0F #define USB_REQ_GET_HANDSHAKE 0x10 #define USB_REQ_SET_CONNECTION 0x11 #define USB_REQ_SET_SECURITY_DATA 0x12 #define USB_REQ_GET_SECURITY_DATA 0x13 #define USB_REQ_SET_WUSB_DATA 0x14 #define USB_REQ_LOOPBACK_DATA_WRITE 0x15 #define USB_REQ_LOOPBACK_DATA_READ 0x16 #define USB_REQ_SET_INTERFACE_DS 0x17 #define USB_REQ_GET_PARTNER_PDO 20 #define USB_REQ_GET_BATTERY_STATUS 21 #define USB_REQ_SET_PDO 22 #define USB_REQ_GET_VDM 23 #define USB_REQ_SEND_VDM 24 #define USB_MAX_IFACE_NUM 4 #define USB_MAX_EP_NUM 32 #define USB_MAX_FDS 6 struct usb_endpoint_index { struct usb_endpoint_descriptor desc; int handle; }; struct usb_iface_index { struct usb_interface_descriptor* iface; uint8_t bInterfaceNumber; uint8_t bAlternateSetting; uint8_t bInterfaceClass; struct usb_endpoint_index eps[USB_MAX_EP_NUM]; int eps_num; }; struct usb_device_index { struct usb_device_descriptor* dev; struct usb_config_descriptor* config; uint8_t bDeviceClass; uint8_t bMaxPower; int config_length; struct usb_iface_index ifaces[USB_MAX_IFACE_NUM]; int ifaces_num; int iface_cur; }; struct usb_info { int fd; struct usb_device_index index; }; static struct usb_info usb_devices[USB_MAX_FDS]; static int usb_devices_num; static bool parse_usb_descriptor(const char* buffer, size_t length, struct usb_device_index* index) { if (length < sizeof(*index->dev) + sizeof(*index->config)) return false; memset(index, 0, sizeof(*index)); index->dev = (struct usb_device_descriptor*)buffer; index->config = (struct usb_config_descriptor*)(buffer + sizeof(*index->dev)); index->bDeviceClass = index->dev->bDeviceClass; index->bMaxPower = index->config->bMaxPower; index->config_length = length - sizeof(*index->dev); index->iface_cur = -1; size_t offset = 0; while (true) { if (offset + 1 >= length) break; uint8_t desc_length = buffer[offset]; uint8_t desc_type = buffer[offset + 1]; if (desc_length <= 2) break; if (offset + desc_length > length) break; if (desc_type == USB_DT_INTERFACE && index->ifaces_num < USB_MAX_IFACE_NUM) { struct usb_interface_descriptor* iface = (struct usb_interface_descriptor*)(buffer + offset); index->ifaces[index->ifaces_num].iface = iface; index->ifaces[index->ifaces_num].bInterfaceNumber = iface->bInterfaceNumber; index->ifaces[index->ifaces_num].bAlternateSetting = iface->bAlternateSetting; index->ifaces[index->ifaces_num].bInterfaceClass = iface->bInterfaceClass; index->ifaces_num++; } if (desc_type == USB_DT_ENDPOINT && index->ifaces_num > 0) { struct usb_iface_index* iface = &index->ifaces[index->ifaces_num - 1]; if (iface->eps_num < USB_MAX_EP_NUM) { memcpy(&iface->eps[iface->eps_num].desc, buffer + offset, sizeof(iface->eps[iface->eps_num].desc)); iface->eps_num++; } } offset += desc_length; } return true; } static struct usb_device_index* add_usb_index(int fd, const char* dev, size_t dev_len) { int i = __atomic_fetch_add(&usb_devices_num, 1, __ATOMIC_RELAXED); if (i >= USB_MAX_FDS) return NULL; int rv = 0; rv = parse_usb_descriptor(dev, dev_len, &usb_devices[i].index); if (!rv) return NULL; __atomic_store_n(&usb_devices[i].fd, fd, __ATOMIC_RELEASE); return &usb_devices[i].index; } static struct usb_device_index* lookup_usb_index(int fd) { int i; for (i = 0; i < USB_MAX_FDS; i++) { if (__atomic_load_n(&usb_devices[i].fd, __ATOMIC_ACQUIRE) == fd) { return &usb_devices[i].index; } } return NULL; } struct vusb_connect_string_descriptor { uint32_t len; char* str; } __attribute__((packed)); struct vusb_connect_descriptors { uint32_t qual_len; char* qual; uint32_t bos_len; char* bos; uint32_t strs_len; struct vusb_connect_string_descriptor strs[0]; } __attribute__((packed)); static const char default_string[] = { 8, USB_DT_STRING, 's', 0, 'y', 0, 'z', 0 }; static const char default_lang_id[] = { 4, USB_DT_STRING, 0x09, 0x04 }; static bool lookup_connect_response_in(int fd, const struct vusb_connect_descriptors* descs, const struct usb_ctrlrequest* ctrl, char** response_data, uint32_t* response_length) { struct usb_device_index* index = lookup_usb_index(fd); uint8_t str_idx; if (!index) return false; switch (ctrl->bRequestType & USB_TYPE_MASK) { case USB_TYPE_STANDARD: switch (ctrl->bRequest) { case USB_REQ_GET_DESCRIPTOR: switch (ctrl->wValue >> 8) { case USB_DT_DEVICE: *response_data = (char*)index->dev; *response_length = sizeof(*index->dev); return true; case USB_DT_CONFIG: *response_data = (char*)index->config; *response_length = index->config_length; return true; case USB_DT_STRING: str_idx = (uint8_t)ctrl->wValue; if (descs && str_idx < descs->strs_len) { *response_data = descs->strs[str_idx].str; *response_length = descs->strs[str_idx].len; return true; } if (str_idx == 0) { *response_data = (char*)&default_lang_id[0]; *response_length = default_lang_id[0]; return true; } *response_data = (char*)&default_string[0]; *response_length = default_string[0]; return true; case USB_DT_BOS: *response_data = descs->bos; *response_length = descs->bos_len; return true; case USB_DT_DEVICE_QUALIFIER: if (!descs->qual) { struct usb_qualifier_descriptor* qual = (struct usb_qualifier_descriptor*)response_data; qual->bLength = sizeof(*qual); qual->bDescriptorType = USB_DT_DEVICE_QUALIFIER; qual->bcdUSB = index->dev->bcdUSB; qual->bDeviceClass = index->dev->bDeviceClass; qual->bDeviceSubClass = index->dev->bDeviceSubClass; qual->bDeviceProtocol = index->dev->bDeviceProtocol; qual->bMaxPacketSize0 = index->dev->bMaxPacketSize0; qual->bNumConfigurations = index->dev->bNumConfigurations; qual->bRESERVED = 0; *response_length = sizeof(*qual); return true; } *response_data = descs->qual; *response_length = descs->qual_len; return true; default: break; } break; default: break; } break; default: break; } return false; } typedef bool (*lookup_connect_out_response_t)(int fd, const struct vusb_connect_descriptors* descs, const struct usb_ctrlrequest* ctrl, bool* done); static bool lookup_connect_response_out_generic(int fd, const struct vusb_connect_descriptors* descs, const struct usb_ctrlrequest* ctrl, bool* done) { switch (ctrl->bRequestType & USB_TYPE_MASK) { case USB_TYPE_STANDARD: switch (ctrl->bRequest) { case USB_REQ_SET_CONFIGURATION: *done = true; return true; default: break; } break; } return false; } /* -------------------------------------------------------------------------- */ static int vhci_open(void) { return open("/dev/vhci", O_RDWR); } static int vhci_setport(int fd, u_int port) { struct vhci_ioc_set_port args; args.port = port; return ioctl(fd, VHCI_IOC_SET_PORT, &args); } static int vhci_usb_attach(int fd) { return ioctl(fd, VHCI_IOC_USB_ATTACH, NULL); } static int vhci_usb_recv(int fd, void* buf, size_t size) { uint8_t_t* ptr = (uint8_t_t*)buf; ssize_t done; while (1) { done = read(fd, ptr, size); if (done < 0) return -1; if ((size_t)done == size) return 0; size -= done; ptr += done; } } static int vhci_usb_send(int fd, void* buf, size_t size) { uint8_t_t* ptr = (uint8_t_t*)buf; ssize_t done; while (1) { done = write(fd, ptr, size); if (done <= 0) return -1; if ((size_t)done == size) return 0; size -= done; ptr += done; } } /* -------------------------------------------------------------------------- */ static volatile long syz_usb_connect_impl(uint64_t speed, uint64_t dev_len, const char* dev, const struct vusb_connect_descriptors* descs, lookup_connect_out_response_t lookup_connect_response_out) { struct usb_device_index* index; int portnum, fd, rv; bool done; portnum = procid + 1; if (!dev) { return -1; } if (portnum != 1) { /* For now, we support only one proc. */ return -1; } fd = vhci_open(); if (fd < 0) { return -1; } index = add_usb_index(fd, dev, dev_len); if (!index) { goto err; } rv = vhci_setport(fd, portnum); if (rv != 0) { goto err; } rv = vhci_usb_attach(fd); if (rv != 0) { goto err; } done = false; while (!done) { vhci_request_t req; rv = vhci_usb_recv(fd, &req, sizeof(req)); if (rv != 0) { goto err; } if (req.type != VHCI_REQ_CTRL) { goto err; } char* response_data = NULL; uint32_t response_length = 0; char data[4096]; if (req.u.ctrl.bmRequestType & UE_DIR_IN) { bool response_found = false; response_found = lookup_connect_response_in(fd, descs, (const usb_ctrlrequest*)&req.u.ctrl, &response_data, &response_length); if (!response_found) { goto err; } } else { if (!lookup_connect_response_out(fd, descs, (const usb_ctrlrequest*)&req.u.ctrl, &done)) { goto err; } response_data = NULL; response_length = UGETW(req.u.ctrl.wLength); } if ((req.u.ctrl.bmRequestType & USB_TYPE_MASK) == USB_TYPE_STANDARD && req.u.ctrl.bRequest == USB_REQ_SET_CONFIGURATION) { /* TODO: possibly revisit */ } if (response_length > sizeof(data)) response_length = 0; if ((uint32_t_t)UGETW(req.u.ctrl.wLength) < response_length) response_length = UGETW(req.u.ctrl.wLength); if (response_data) memcpy(data, response_data, response_length); else memset(data, 0, response_length); if (req.u.ctrl.bmRequestType & UE_DIR_IN) { if (response_length > 0) { vhci_response_t res; res.size = response_length; rv = vhci_usb_send(fd, &res, sizeof(res)); if (rv == 0) rv = vhci_usb_send(fd, data, response_length); } } else { rv = vhci_usb_recv(fd, data, response_length); } if (rv < 0) { goto err; } } sleep_ms(200); return fd; err: close(fd); return -1; } static volatile long syz_usb_connect(volatile long a0, volatile long a1, volatile long a2, volatile long a3) { uint64_t speed = a0; uint64_t dev_len = a1; const char* dev = (const char*)a2; const struct vusb_connect_descriptors* descs = (const struct vusb_connect_descriptors*)a3; return syz_usb_connect_impl(speed, dev_len, dev, descs, &lookup_connect_response_out_generic); } static volatile long syz_usb_disconnect(volatile long a0) { int fd = a0; int rv = close(fd); sleep_ms(200); return rv; } static void setup_usb(void) { if (chmod("/dev/vhci", 0666)) exit(1); } static int tunfd = -1; #define MAX_TUN 64 #define TUN_IFACE "tap%d" #define TUN_DEVICE "/dev/tap%d" #define LOCAL_MAC "aa:aa:aa:aa:aa:aa" #define REMOTE_MAC "aa:aa:aa:aa:aa:bb" #define LOCAL_IPV4 "172.20.%d.170" #define REMOTE_IPV4 "172.20.%d.187" #define LOCAL_IPV6 "fe80::%02hxaa" #define REMOTE_IPV6 "fe80::%02hxbb" static void vsnprintf_check(char* str, size_t size, const char* format, va_list args) { int rv; rv = vsnprintf(str, size, format, args); if (rv < 0) exit(1); if ((size_t)rv >= size) exit(1); } static void snprintf_check(char* str, size_t size, const char* format, ...) { va_list args; va_start(args, format); vsnprintf_check(str, size, format, args); va_end(args); } #define COMMAND_MAX_LEN 128 #define PATH_PREFIX "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin " #define PATH_PREFIX_LEN (sizeof(PATH_PREFIX) - 1) static void execute_command(bool panic, const char* format, ...) { va_list args; char command[PATH_PREFIX_LEN + COMMAND_MAX_LEN]; int rv; va_start(args, format); memcpy(command, PATH_PREFIX, PATH_PREFIX_LEN); vsnprintf_check(command + PATH_PREFIX_LEN, COMMAND_MAX_LEN, format, args); va_end(args); rv = system(command); if (rv) { if (panic) exit(1); } } static void initialize_tun(int tun_id) { if (tun_id < 0 || tun_id >= MAX_TUN) { exit(1); } char tun_device[sizeof(TUN_DEVICE)]; snprintf_check(tun_device, sizeof(tun_device), TUN_DEVICE, tun_id); char tun_iface[sizeof(TUN_IFACE)]; snprintf_check(tun_iface, sizeof(tun_iface), TUN_IFACE, tun_id); execute_command(0, "ifconfig %s destroy", tun_iface); execute_command(0, "ifconfig %s create", tun_iface); tunfd = open(tun_device, O_RDWR | O_NONBLOCK); if (tunfd == -1) { printf("tun: can't open %s: errno=%d\n", tun_device, errno); return; } const int kTunFd = 240; if (dup2(tunfd, kTunFd) < 0) exit(1); close(tunfd); tunfd = kTunFd; char local_mac[sizeof(LOCAL_MAC)]; snprintf_check(local_mac, sizeof(local_mac), LOCAL_MAC); execute_command(1, "ifconfig %s link %s", tun_iface, local_mac); char local_ipv4[sizeof(LOCAL_IPV4)]; snprintf_check(local_ipv4, sizeof(local_ipv4), LOCAL_IPV4, tun_id); execute_command(1, "ifconfig %s inet %s netmask 255.255.255.0", tun_iface, local_ipv4); char remote_mac[sizeof(REMOTE_MAC)]; char remote_ipv4[sizeof(REMOTE_IPV4)]; snprintf_check(remote_mac, sizeof(remote_mac), REMOTE_MAC); snprintf_check(remote_ipv4, sizeof(remote_ipv4), REMOTE_IPV4, tun_id); execute_command(0, "arp -s %s %s", remote_ipv4, remote_mac); char local_ipv6[sizeof(LOCAL_IPV6)]; snprintf_check(local_ipv6, sizeof(local_ipv6), LOCAL_IPV6, tun_id); execute_command(1, "ifconfig %s inet6 %s", tun_iface, local_ipv6); char remote_ipv6[sizeof(REMOTE_IPV6)]; snprintf_check(remote_ipv6, sizeof(remote_ipv6), REMOTE_IPV6, tun_id); execute_command(0, "ndp -s %s%%%s %s", remote_ipv6, tun_iface, remote_mac); } static long syz_emit_ethernet(volatile long a0, volatile long a1) { if (tunfd < 0) return (uintptr_t)-1; size_t length = a0; const char* data = (char*)a1; return write(tunfd, data, length); } static int read_tun(char* data, int size) { if (tunfd < 0) return -1; int rv = read(tunfd, data, size); if (rv < 0) { if (errno == EAGAIN) return -1; exit(1); } return rv; } struct tcp_resources { uint32_t seq; uint32_t ack; }; static long syz_extract_tcp_res(volatile long a0, volatile long a1, volatile long a2) { if (tunfd < 0) return (uintptr_t)-1; char data[1000]; int rv = read_tun(&data[0], sizeof(data)); if (rv == -1) return (uintptr_t)-1; size_t length = rv; struct tcphdr* tcphdr; if (length < sizeof(struct ether_header)) return (uintptr_t)-1; struct ether_header* ethhdr = (struct ether_header*)&data[0]; if (ethhdr->ether_type == htons(ETHERTYPE_IP)) { if (length < sizeof(struct ether_header) + sizeof(struct ip)) return (uintptr_t)-1; struct ip* iphdr = (struct ip*)&data[sizeof(struct ether_header)]; if (iphdr->ip_p != IPPROTO_TCP) return (uintptr_t)-1; if (length < sizeof(struct ether_header) + iphdr->ip_hl * 4 + sizeof(struct tcphdr)) return (uintptr_t)-1; tcphdr = (struct tcphdr*)&data[sizeof(struct ether_header) + iphdr->ip_hl * 4]; } else { if (length < sizeof(struct ether_header) + sizeof(struct ip6_hdr)) return (uintptr_t)-1; struct ip6_hdr* ipv6hdr = (struct ip6_hdr*)&data[sizeof(struct ether_header)]; if (ipv6hdr->ip6_nxt != IPPROTO_TCP) return (uintptr_t)-1; if (length < sizeof(struct ether_header) + sizeof(struct ip6_hdr) + sizeof(struct tcphdr)) return (uintptr_t)-1; tcphdr = (struct tcphdr*)&data[sizeof(struct ether_header) + sizeof(struct ip6_hdr)]; } struct tcp_resources* res = (struct tcp_resources*)a0; res->seq = htonl((ntohl(tcphdr->th_seq) + (uint32_t)a1)); res->ack = htonl((ntohl(tcphdr->th_ack) + (uint32_t)a2)); return 0; } static void sandbox_common() { if (setsid() == -1) exit(1); struct rlimit rlim; rlim.rlim_cur = rlim.rlim_max = 8 << 20; setrlimit(RLIMIT_MEMLOCK, &rlim); rlim.rlim_cur = rlim.rlim_max = 1 << 20; setrlimit(RLIMIT_FSIZE, &rlim); rlim.rlim_cur = rlim.rlim_max = 1 << 20; setrlimit(RLIMIT_STACK, &rlim); rlim.rlim_cur = rlim.rlim_max = 0; setrlimit(RLIMIT_CORE, &rlim); rlim.rlim_cur = rlim.rlim_max = 256; setrlimit(RLIMIT_NOFILE, &rlim); } static void loop(); static int do_sandbox_none(void) { sandbox_common(); initialize_tun(procid); loop(); return 0; } static long syz_execute_func(volatile long text) { volatile long p[8] = {0}; (void)p; asm volatile("" ::"r"(0l), "r"(1l), "r"(2l), "r"(3l), "r"(4l), "r"(5l), "r"(6l), "r"(7l), "r"(8l), "r"(9l), "r"(10l), "r"(11l), "r"(12l), "r"(13l)); ((void (*)(void))(text))(); return 0; } struct thread_t { int created, call; event_t ready, done; }; static struct thread_t threads[16]; static void execute_call(int call); static int running; static void* thr(void* arg) { struct thread_t* th = (struct thread_t*)arg; for (;;) { event_wait(&th->ready); event_reset(&th->ready); execute_call(th->call); __atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED); event_set(&th->done); } return 0; } static void execute_one(void) { int i, call, thread; for (call = 0; call < 16; call++) { for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0])); thread++) { struct thread_t* th = &threads[thread]; if (!th->created) { th->created = 1; event_init(&th->ready); event_init(&th->done); event_set(&th->done); thread_start(thr, th); } if (!event_isset(&th->done)) continue; event_reset(&th->done); th->call = call; __atomic_fetch_add(&running, 1, __ATOMIC_RELAXED); event_set(&th->ready); event_timedwait(&th->done, 45 + (call == 13 ? 3000 : 0) + (call == 14 ? 3000 : 0) + (call == 15 ? 300 : 0)); break; } } for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++) sleep_ms(1); } static void execute_one(void); #define WAIT_FLAGS 0 static void loop(void) { int iter; for (iter = 0;; iter++) { char cwdbuf[32]; sprintf(cwdbuf, "./%d", iter); if (mkdir(cwdbuf, 0777)) exit(1); int pid = fork(); if (pid < 0) exit(1); if (pid == 0) { if (chdir(cwdbuf)) exit(1); execute_one(); exit(0); } int status = 0; uint64_t start = current_time_ms(); for (;;) { if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) break; sleep_ms(1); if (current_time_ms() - start < 5 * 1000) continue; kill_and_wait(pid, &status); break; } remove_dir(cwdbuf); } } #ifndef SYS_dup2 #define SYS_dup2 90 #endif #ifndef SYS_getgid #define SYS_getgid 47 #endif #ifndef SYS_getgroups #define SYS_getgroups 79 #endif #ifndef SYS_getsockopt #define SYS_getsockopt 118 #endif #ifndef SYS_mmap #define SYS_mmap 197 #endif #ifndef SYS_semctl #define SYS_semctl 442 #endif #ifndef SYS_semget #define SYS_semget 221 #endif #ifndef SYS_seteuid #define SYS_seteuid 183 #endif #ifndef SYS_setregid #define SYS_setregid 127 #endif #ifndef SYS_stat #define SYS_stat 439 #endif #ifndef SYS_writev #define SYS_writev 121 #endif uint64_t r[7] = {0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}; void execute_call(int call) { intptr_t res = 0; switch (call) { case 0: res = syscall(SYS_dup2, -1, 0xffffff9c); if (res != -1) r[0] = res; break; case 1: *(uint64_t*)0x200002c0 = 0x20000000; memcpy((void*)0x20000000, "\x25\xc5\xf6\x76\x86\x92\xf1\x6a\x6b\x02\x33\x7b\xc5\xf2\x4e\x95\xc2\xe5\x74\xf7\xbd\x23\xda\x78\xff\x22\x41\x43\x9c\xac\xed\x12\x2e\x33\xab\x16\xd3\x77\x84\x34\x15\x78\x1f\xa5\x08\xcd\x63\x5f\x2f\xd0\x41\x13\x20\x4e\xd9\xbd\xa7\x39\x6e\x99\xa3\x8a\x2f\x10\xe9\xc7\x39\x8b\x5a\x64\xc4\x9d\x98\x66\x4b\xd1\x49\x75\xbe\x70\x76\xa8\x36\x38\xa7\xda\x30\x95\xf0\xe0\x27\xbd\x16\x1c\xcd\x5c\x99\x4f\x8b\x31\xd5\x35\xa3\xce\x4c\x57\x81\x2d\x96\x82\xf3\xeb\xb1\x0e\x05\xa7\x14\x22\x10\x51\x5b\x66\x8d\x13\x57\xd9\x1a\xaa\xbb\x6a\xd8\x8a\xed\x6b\x9f\x21\x43\xd0\x62\xe0\xb5", 141); *(uint64_t*)0x200002c8 = 0x8d; *(uint64_t*)0x200002d0 = 0x200000c0; memcpy((void*)0x200000c0, "\xe8\x98\x7e\x8f\x86\x4e\x9d\x38\xb5\x56\x15\xb6\x59\xd1\x4c\xae\x9e\x91\xa9\x53\x22\x13\xff\xb4\x65\xb6\x1b", 27); *(uint64_t*)0x200002d8 = 0x1b; *(uint64_t*)0x200002e0 = 0x20000100; memcpy((void*)0x20000100, "\x3f\x97\x99\x2c\x94\x0f\xba\x89\x36\xa6\xb4", 11); *(uint64_t*)0x200002e8 = 0xb; *(uint64_t*)0x200002f0 = 0x20000140; memcpy((void*)0x20000140, "\xc9\x9a\xb6\x04\xeb\x2e\x44\xeb\xf7\xbf\xb7\xb0\x4c\x08\x43\x21\xa3\x0f\x43\x51\xae\xb0\x67\x6b\xb2\x1a\xef\xc3\xbc\x23\x22\xd9\x9a\x5b\x03\x4f\x88\x0a\xa2\x5d\x61\xae\x40\x76\x39\x7c\x30\x35\x7b\x22\xcc\xb7\x79\xeb\xd3\x20\x6a\xc6\x48\xfa\xb9\x08\x36\xdd\x4d\x9e\x73\xdc\x3c\x07\x72\x70\xb5\x7d\xc3\x22\x22\x84\xdd\x3c\xae\x47\x37\x95\x7d\x94\x7d\x76\x5a\x5e\x0e\x91\x9c\xbd\x3e\xf2\xd3\xd9\x52\x2a\x82\x7f\x3f\xe6\x0d\xdc", 106); *(uint64_t*)0x200002f8 = 0x6a; *(uint64_t*)0x20000300 = 0x200001c0; memcpy((void*)0x200001c0, "\x2b\xc5\xa9\xfd\x6c\xc3\x45\x00\x82\x40\x5a\xb6\x07\xa0\xf5\x62\x7b\x40\x58\x9a\x69\x0a\xc5\x91\x58\xac\xf1\x0f\x2a\x1c\xc4\x61\x52\xfa\x5f\x49\x3a\x85\x99\xcc\x6e\xaa\xb5\xd9\x69\x68\xbe\xf1\xa2\x7f\x62\xda\xcf\x64\xd0\x6c\x80\xcf\xb5\xb3\x20\xb9\x77\xc9\x43\x2c\x44\x6f\xa6\xf6\x55\x14\x44\xee\x4c\x59\x98\x85\x32\x60\xd6\x5d\x2c\xb3\xc7\x78\xf4\x4f\xe2\x70\x36\x3b\x4e\xb3\x09\xe2\x4f\xc4\x77\x97\xb5\xbd\x45\x4b\xf4\xd3\xd4\x65\x6f\xa0\x78\xff\x56\xb3\x0f\x4f\x0e\x9d\x5e\x6e\x89\x43\x83\x0a\xd6\xd3\x42\x96\x8c\x22\x4f\x7c\x35\xaf\x01\xa6\x1d\x10\xe1\x55\xfe\xe7\xe0\x22\x7c\xd7\x9a\x79\x77\xb3\xf4\x03\x51\xca\x01\x83\x48\x40\xab\xba\x55\x7d\x36\xbc\x8a\x42\x08\xf9\x0d\xc5\xf5\x1e\x3f\x3d\x44\x5c\x5f\xee\xa7\x93\x68\x16\x4e\xde\xf0\x5d\x24\x74\x8c\xe9\xf0\xa5\x84\x51\xb4\x3d\x98\x91\x90\x2b\xc4\x5e\xc6\x7d\x00\xdf\x1d\xeb\x74\xe6\x5b\x29\xc0\xd0\x95\xdb\xdd\x5b\x9a\x7c", 220); *(uint64_t*)0x20000308 = 0xdc; syscall(SYS_writev, r[0], 0x200002c0ul, 5ul); break; case 2: *(uint32_t*)0x20000340 = 0; *(uint32_t*)0x20000344 = -1; *(uint32_t*)0x20000348 = 0; res = syscall(SYS_getgroups, 3ul, 0x20000340ul); if (res != -1) r[1] = *(uint32_t*)0x20000348; break; case 3: *(uint32_t*)0x200003c0 = 0xc; res = syscall(SYS_getsockopt, -1, 0xffff, 0x11, 0x20000380ul, 0x200003c0ul); if (res != -1) r[2] = *(uint32_t*)0x20000388; break; case 4: syscall(SYS_setregid, r[1], r[2]); break; case 5: res = syscall(SYS_semget, 0x798e2634ul, 0ul, 0xb2603d964b180ce8ul); if (res != -1) r[3] = res; break; case 6: memcpy((void*)0x20000400, "./file0\000", 8); res = syscall(SYS_stat, 0x20000400ul, 0x20000440ul); if (res != -1) r[4] = *(uint32_t*)0x2000045c; break; case 7: res = syscall(SYS_getgid); if (res != -1) r[5] = res; break; case 8: *(uint32_t*)0x20000500 = 0xfffff834; *(uint32_t*)0x20000504 = r[4]; *(uint32_t*)0x20000508 = r[5]; *(uint32_t*)0x2000050c = -1; *(uint32_t*)0x20000510 = 0; *(uint32_t*)0x20000514 = 3; *(uint16_t*)0x20000518 = 9; *(uint16_t*)0x2000051a = 0; *(uint64_t*)0x20000520 = 0; *(uint64_t*)0x20000528 = 0; *(uint64_t*)0x20000530 = 0xfffffffffffffffd; *(uint64_t*)0x20000538 = 0x4535; *(uint64_t*)0x20000540 = 2; *(uint64_t*)0x20000548 = 0; *(uint64_t*)0x20000550 = 0; syscall(SYS_semctl, r[3], 0ul, 1ul, 0x20000500ul); break; case 9: syscall(SYS_seteuid, 0); break; case 10: memcpy((void*)0x20000000, "\xbf\x5b\xc2\xc4\xdd\xcd\x9b\xaa\x7f\x7c\x66\xf9\x17\x26\xa8\xc4\x90\xf6\x91\x85\x14\x0b\x5b\x42\x51\xe8\x67\x01\xc6\xc5\xa6\x0d\x84\x80\x2d\x38\x2a\x0c\x38\xdf\x4a\x28\xfd\x84\x0d\x7e\x14\x06\xa5\xc2\xeb\x5d\x3b\x6b\xc3\x23\xbd\x49\x38\x6c\x4a\x92\x49\x50\x31\x4f\xe6\x17\xf8\xcd\x34\x37\xa4\xaa\x6d\x1c\x6d\x62\x64\x03\x09\xf9\xde\x23\x93\x99\x9b\x11\x47\x68\xd5\x10\xd7\x34\xfd\x72\xd1\x98\xb2\x61\xbd\x61\x81\x14\xbf\x3f\xa3\xe2\xfe\x84\xff\xe6\x5c\x80\xe4\x72\x12\xc4\x9e\x47\xbb\x3a\xaa\x86\x89\x46\x2f\x21\xd5\x18\x80\xd9\x7c\xb4\x45\xd3", 136); syz_emit_ethernet(0x88, 0x20000000); break; case 11: memcpy((void*)0x200000c0, "\xc4\xa1\x84\x58\x2c\xaa\x26\x44\x0f\xae\x04\xc4\x41\x0f\x74\xab\x00\x00\x01\x00\xc4\x23\xf5\x78\x4c\xe9\x9d\x40\x44\xdf\x34\x59\x26\x41\x0f\xae\x41\x01\x64\x64\x66\x44\x0f\xe5\xb9\x4e\x9a\xb0\xc4\xc4\x22\x7d\x47\x0f\x41\x0f\x45\x7f\x56\x66\x0f\xdd\xe8", 63); syz_execute_func(0x200000c0); break; case 12: syz_extract_tcp_res(0x20000100, 6, 1); break; case 13: memcpy((void*)0x20000140, "\x64\xd3\x2f\x16\xeb\xd8\x17\xd0\x04\xdc\xb8\x01\x71\x82\x05\xbc\xa1\xd8\x6d\xad\x3c\xb1\x32\xa2\x86\x60\x92\x14\xb7\x39\x5a\x97\xa0\xe8\xfe\xda\x5f\xad\x02\xcc\xe9\xde\xea\x94\xd5\x5a\x75\x0c\x17\xb2\x34\x07\x50\x02\xb9\xdf\x62\x9f\xa6\x8e\x3f\x7d\xa9\x7e\x9c\x2a\x2e\x0a\x95\xd1\x5d\x35\x95\x61\xb1\x47\x74\x40\x34\x2c\xd7\x9c\x7c\xeb\xd6\xbf\x00\x8a\xcd\x1c\x7f\xf1\x46\xa6\xfe\x22\x01\x36\x61\xd8\xc8\xce\x8e\xb1\x7f\x5c\xf3\x89\x2a\xe0\x8b\xba\x46\x54\x5b\x2b\x69\x0a\xb7\xe0\x36\x8a\xec\x4d\x32\xb7\x6d\x7f\xc1\x5d\xd7\xc2\xab\xa1\x84\xd4\x1a\x5e\x5a\xbb\x8d\x71\x6f\x5e\x64\x5e\x17\x67\x13\x8e\xd7\x38\xf3\x15\x79\x5a\xc9\x9e\x22\xfd\x44\xdb\x06\x09\x63\x13\xf4\x72\x9c\xe0\xd3\xbd\x93\x8f\x5b\x65\x20\xef\x93\x76\xfa\x90\x9d\xf6\xb2\x05\xc2\xd3\xf5\x2e\xe4\x3e\x3f\x59\xea\x44\x1b\x7c\x4e\x4d\x5c", 201); memcpy((void*)0x20000240, "\xc1\xb0\x1d\x40\x73\x99\x35\xb1\x21\x7d\x0e\x39\x3c\xdd\x4f\xa4\xef\x8b\xbd\x99\x57\xee\x99\x68\x77\xe4\xca\x15\x5c\x19\x5d\xc1\x66\xf9\x48\x6a\xc4\xdb\x17\xf7\x54\xc4\x89\x38\xa4\x34\x19\xf0\x82\xa8\xc3\x0e\xff\xbe\xf0\x64\xf6\xc8\xb8\x7b\xc9\x30\xe4\x39\xc7\x19\xec\x0a\x11\x99\x04\x0b\x86\x28\x6d\x27\x1f\x25\xaf\x26\xeb\xed\x3f\x55\xc3\x2e\x68\xac\x70\x33\x0d\xf7\x69\x31\xbf\x55\xfa\xe8\x80\x25\x6b\x74\xa9\x23\xf8\xa3\x02\x2c\x31\x0f\x94\xcc\x0c\x62\x33\x02\xa5\xd1\x4b\x3f\x8e\x18\xf4\x15\x99\x88\x28\x66\xea\x02\x42\x86\x4b\x37\xd5\xae\x87\xfb\xcb\x74\x5c\x3e\x26\x42\x3d\x05\xc5\x48\x38\x33\xdf\xcd\xd4\x3d\xc0\xc6\x50\x73\x29\x03\x72\x73\xde\x28\x2e\x3a\x16\xac\x00\xc5\x53\x9c\x30\x94\x63\x98\x4b\x15\x3e\xc6\x25\x0a\x78\x19\x75\xa2\x77\x01\x72\x80\xdb\x1e\x9c\x18\xce\x66\x4d\xf5\x94\x7c\x6c\x18\xbe\xf2\x36\x7e\x61\x63\xb4\x6b\x95\x03\xf7\x00\x70\x5f\xd0\xe8\x9e\xae\x6d\xf0\x88\x4b\xf2\x7c\x00\xe0\x5f\xc5\xef\xc6\x49\x07", 234); syz_usb_connect(0, 0xc9, 0x20000140, 0x20000240); break; case 14: memcpy((void*)0x20000340, "\x36\x4f\xb1\xa4\x17\x26\x3d\xe2\x27\x97\xec\x76\x08\x61\xf3\x85\x2c\xf2\x4f\x79\xe2\xb7\xa5\xc6\x2a\xfa\xd7\xd6\xd4\xd0\x9d\x86\x2f\x8e\xcc\xd0\x2e\x1b\xb9\x89\xe0\xf8\xa8\xad\x91\x54\x42\x01\x64\x04\xc9\x82\x6a\x5c\x0a\x28\x4f\xc7\xa8\x40\x30\x47\x59\xb6\x84\xf3\x57\xb2\xe6\xfe\xcf\xb3\xcc\x81\x57\xc0\x08\xff\x0d\xcf\xf2\x10\x89\x84\x54\x8a\x2a\xd6\x95\xfa\xd9\x51\x2f\x06\xfd\x12\xd6\x6b\xc4\x43\x04\x75\x12\xab\x4e\xf3\x05\x8a\xe6\xc0\xc6\xec\x3f\xd6\x27\xe3\x70\xa1\x51\xae\x71\x9b\x8e\x3a\x77\xd6\x82\xdc\x06\xa9\x3b\xe9\xc2\xaa\x80\x18\xb5\x8a\x94\x92\xcb\x39\x03\x1b\xb5\xab\xf3\x12\x4e\xaa\xb8\x53\x30\xf1\x81\xfc\xcc\xa7\x59\x7b\x4e\xc0\x87\x9f\xcb\xcf\x51\x14\x3f\x98\xc4\x43\xc1\x67\x20\xa6\xe0\x1b\x7e\x07\xdf\x47\x27\xe2\x88\xe1\x3d\xcc\x0b\x7e\x11", 191); memcpy((void*)0x20000400, "\x59\x03\x92\x3c\x7a\x1b\x28\x38\xf3\xc1\x21\x56\x78\x5a\x11\xc8\x1b\x2e\x82\xd9\xa1\x19\x0e\x1b\x9c\x45\x97\x6a\x91\x7c\x00\x29\x4d\xc9\x4d\x53\x54\xe8\xc5\xd6\xa4\xe8\x98\x6d\xa0\x74\xeb\x46\x1e\xd0\x73\x6b\xcb\xed\xe2\xce\xf1\xf1\x9e\x02\x16\xc0\x9e\xb7\x94\xd8\xb9\x75\x4f\xea\x26\xf1\x10\xc8\x32\x48\xc2\x86\xea\xa0\x5a\x69\x84\x4e\xb1\x29\x2f\x59\x4f\x59\xf6\xc9\xbe\xca\x47\xd8\x94\xd4\x4d\xfd\x15\xff\x81\xb7\x6b\x46\x35\x39\x2e\xb5\xed\x43\x1c\xa3\x09\x22\x30", 117); res = syz_usb_connect(4, 0xbf, 0x20000340, 0x20000400); if (res != -1) r[6] = res; break; case 15: syz_usb_disconnect(r[6]); break; } } int main(void) { syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 3ul, 0x1012ul, -1, 0ul, 0ul); use_temporary_dir(); do_sandbox_none(); return 0; } :198:2: error: unknown type name 'uint8_t_t' :199:2: error: unknown type name 'uint8_t_t' :200:2: error: unknown type name 'uint8_t_t' :201:2: error: unknown type name 'uint8_t_t' :202:2: error: unknown type name 'uint16_t_t' :203:2: error: unknown type name 'uint8_t_t' :204:2: error: unknown type name 'uint8_t_t' :205:2: error: unknown type name 'uint8_t_t' :209:2: error: unknown type name 'uint8_t_t' :210:2: error: unknown type name 'uint8_t_t' :211:2: error: unknown type name 'uint16_t_t' :212:2: error: unknown type name 'uint8_t_t' :213:2: error: unknown type name 'uint8_t_t' :214:2: error: unknown type name 'uint8_t_t' :215:2: error: unknown type name 'uint8_t_t' :216:2: error: unknown type name 'uint16_t_t' :217:2: error: unknown type name 'uint16_t_t' :218:2: error: unknown type name 'uint16_t_t' :219:2: error: unknown type name 'uint8_t_t' :220:2: error: unknown type name 'uint8_t_t' :221:2: error: unknown type name 'uint8_t_t' :222:2: error: unknown type name 'uint8_t_t' :226:2: error: unknown type name 'uint8_t_t' :227:2: error: unknown type name 'uint8_t_t' :228:2: error: unknown type name 'uint16_t_t' :229:2: error: unknown type name 'uint8_t_t' :230:2: error: unknown type name 'uint8_t_t' :231:2: error: unknown type name 'uint8_t_t' :232:2: error: unknown type name 'uint8_t_t' :233:2: error: unknown type name 'uint8_t_t' :237:2: error: unknown type name 'uint8_t_t' :238:2: error: unknown type name 'uint8_t_t' :239:2: error: unknown type name 'uint8_t_t' :240:2: error: unknown type name 'uint8_t_t' :241:2: error: unknown type name 'uint8_t_t' :242:2: error: unknown type name 'uint8_t_t' :243:2: error: unknown type name 'uint8_t_t' :244:2: error: unknown type name 'uint8_t_t' :245:2: error: unknown type name 'uint8_t_t' :249:2: error: unknown type name 'uint8_t_t' :250:2: error: unknown type name 'uint8_t_t' :251:2: error: unknown type name 'uint16_t_t' :252:2: error: unknown type name 'uint16_t_t' :253:2: error: unknown type name 'uint16_t_t' :257:2: error: unknown type name 'uint8_t_t' :258:2: error: unknown type name 'uint8_t_t' :259:2: error: unknown type name 'uint16_t_t' :260:2: error: unknown type name 'uint8_t_t' :261:2: error: unknown type name 'uint8_t_t' :262:2: error: unknown type name 'uint8_t_t' :263:2: error: unknown type name 'uint8_t_t' :264:2: error: unknown type name 'uint8_t_t' :265:2: error: unknown type name 'uint8_t_t' : In function 'vhci_usb_recv': :572:2: error: unknown type name 'uint8_t_t'; did you mean 'uint8_t'? :572:20: error: 'uint8_t_t' undeclared (first use in this function); did you mean 'uint8_t'? :572:20: note: each undeclared identifier is reported only once for each function it appears in :572:30: error: expected expression before ')' token : In function 'vhci_usb_send': :587:2: error: unknown type name 'uint8_t_t'; did you mean 'uint8_t'? :587:20: error: 'uint8_t_t' undeclared (first use in this function); did you mean 'uint8_t'? :587:30: error: expected expression before ')' token : In function 'syz_usb_connect_impl': :648:63: error: unknown type name 'usb_ctrlrequest' :653:55: error: unknown type name 'usb_ctrlrequest' :665:8: error: 'uint32_t_t' undeclared (first use in this function); did you mean 'uint32_t'? At top level: :713:13: error: 'setup_usb' defined but not used [-Werror=unused-function] cc1: all warnings being treated as errors compiler invocation: /syzkaller/netbsd/src/../tools/bin/x86_64--netbsd-g++ [-o /tmp/syz-executor147115301 -DGOOS_netbsd=1 -DGOARCH_amd64=1 -DHOSTGOOS_linux=1 -x c - -m64 --sysroot /syzkaller/netbsd/src/../dest/ -O2 -pthread -Wall -Werror -Wparentheses -Wframe-larger-than=16384] --- FAIL: TestGenerate/netbsd/amd64/1 (0.44s) csource_test.go:123: opts: {Threaded:true Collide:false Repeat:true RepeatTimes:0 Procs:0 Sandbox:none Fault:false FaultCall:0 FaultNth:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false USB:false UseTmpDir:true HandleSegv:false Repro:false Trace:false} program: r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c) writev(r0, &(0x7f00000002c0)=[{&(0x7f0000000000)="25c5f6768692f16a6b02337bc5f24e95c2e574f7bd23da78ff2241439caced122e33ab16d377843415781fa508cd635f2fd04113204ed9bda7396e99a38a2f10e9c7398b5a64c49d98664bd14975be7076a83638a7da3095f0e027bd161ccd5c994f8b31d535a3ce4c57812d9682f3ebb10e05a7142210515b668d1357d91aaabb6ad88aed6b9f2143d062e0b5", 0x8d}, {&(0x7f00000000c0)="e8987e8f864e9d38b55615b659d14cae9e91a9532213ffb465b61b", 0x1b}, {&(0x7f0000000100)="3f97992c940fba8936a6b4", 0xb}, {&(0x7f0000000140)="c99ab604eb2e44ebf7bfb7b04c084321a30f4351aeb0676bb21aefc3bc2322d99a5b034f880aa25d61ae4076397c30357b22ccb779ebd3206ac648fab90836dd4d9e73dc3c077270b57dc3222284dd3cae4737957d947d765a5e0e919cbd3ef2d3d9522a827f3fe60ddc", 0x6a}, {&(0x7f00000001c0)="2bc5a9fd6cc3450082405ab607a0f5627b40589a690ac59158acf10f2a1cc46152fa5f493a8599cc6eaab5d96968bef1a27f62dacf64d06c80cfb5b320b977c9432c446fa6f6551444ee4c5998853260d65d2cb3c778f44fe270363b4eb309e24fc47797b5bd454bf4d3d4656fa078ff56b30f4f0e9d5e6e8943830ad6d342968c224f7c35af01a61d10e155fee7e0227cd79a7977b3f40351ca01834840abba557d36bc8a4208f90dc5f51e3f3d445c5feea79368164edef05d24748ce9f0a58451b43d9891902bc45ec67d00df1deb74e65b29c0d095dbdd5b9a7c", 0xdc}], 0x5) getgroups(0x3, &(0x7f0000000340)=[0x0, 0xffffffffffffffff, 0x0]) getsockopt$sock_cred(0xffffffffffffffff, 0xffff, 0x11, &(0x7f0000000380)={0x0, 0x0, 0x0}, &(0x7f00000003c0)=0xc) setregid(r1, r2) r3 = semget(0x1, 0x0, 0xb2603d964b180ce8) stat(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0}) r5 = getgid() semctl$IPC_SET(r3, 0x0, 0x1, &(0x7f0000000500)={{0xfffff834, r4, r5, 0xffffffffffffffff, 0x0, 0x3, 0x9}, 0xfffffffffffffffd, 0x4535, 0x2}) seteuid(0x0) syz_emit_ethernet(0x88, &(0x7f0000000000)="bf5bc2c4ddcd9baa7f7c66f91726a8c490f69185140b5b4251e86701c6c5a60d84802d382a0c38df4a28fd840d7e1406a5c2eb5d3b6bc323bd49386c4a924950314fe617f8cd3437a4aa6d1c6d62640309f9de2393999b114768d510d734fd72d198b261bd618114bf3fa3e2fe84ffe65c80e47212c49e47bb3aaa8689462f21d51880d97cb445d3") syz_execute_func(&(0x7f00000000c0)="c4a184582caa26440fae04c4410f74ab00000100c423f5784ce99d4044df345926410fae4101646466440fe5b94e9ab0c4c4227d470f410f457f56660fdde8") syz_extract_tcp_res(&(0x7f0000000100), 0x6, 0x1) syz_usb_connect(0x0, 0xc9, &(0x7f0000000140)="64d32f16ebd817d004dcb801718205bca1d86dad3cb132a286609214b7395a97a0e8feda5fad02cce9deea94d55a750c17b234075002b9df629fa68e3f7da97e9c2a2e0a95d15d359561b1477440342cd79c7cebd6bf008acd1c7ff146a6fe22013661d8c8ce8eb17f5cf3892ae08bba46545b2b690ab7e0368aec4d32b76d7fc15dd7c2aba184d41a5e5abb8d716f5e645e1767138ed738f315795ac99e22fd44db06096313f4729ce0d3bd938f5b6520ef9376fa909df6b205c2d3f52ee43e3f59ea441b7c4e4d5c", &(0x7f0000000240)="c1b01d40739935b1217d0e393cdd4fa4ef8bbd9957ee996877e4ca155c195dc166f9486ac4db17f754c48938a43419f082a8c30effbef064f6c8b87bc930e439c719ec0a1199040b86286d271f25af26ebed3f55c32e68ac70330df76931bf55fae880256b74a923f8a3022c310f94cc0c623302a5d14b3f8e18f41599882866ea0242864b37d5ae87fbcb745c3e26423d05c5483833dfcdd43dc0c6507329037273de282e3a16ac00c5539c309463984b153ec6250a781975a277017280db1e9c18ce664df5947c6c18bef2367e6163b46b9503f700705fd0e89eae6df0884bf27c00e05fc5efc64907") r6 = syz_usb_connect(0x4, 0xbf, &(0x7f0000000340)="364fb1a417263de22797ec760861f3852cf24f79e2b7a5c62afad7d6d4d09d862f8eccd02e1bb989e0f8a8ad915442016404c9826a5c0a284fc7a840304759b684f357b2e6fecfb3cc8157c008ff0dcff2108984548a2ad695fad9512f06fd12d66bc443047512ab4ef3058ae6c0c6ec3fd627e370a151ae719b8e3a77d682dc06a93be9c2aa8018b58a9492cb39031bb5abf3124eaab85330f181fccca7597b4ec0879fcbcf51143f98c443c16720a6e01b7e07df4727e288e13dcc0b7e11", &(0x7f0000000400)="5903923c7a1b2838f3c12156785a11c81b2e82d9a1190e1b9c45976a917c00294dc94d5354e8c5d6a4e8986da074eb461ed0736bcbede2cef1f19e0216c09eb794d8b9754fea26f110c83248c286eaa05a69844eb1292f594f59f6c9beca47d894d44dfd15ff81b76b4635392eb5ed431ca3092230") syz_usb_disconnect(r6) csource_test.go:124: failed to build program: // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include static unsigned long long procid; static void kill_and_wait(int pid, int* status) { kill(pid, SIGKILL); while (waitpid(-1, status, 0) != pid) { } } static void sleep_ms(uint64_t ms) { usleep(ms * 1000); } static uint64_t current_time_ms(void) { struct timespec ts; if (clock_gettime(CLOCK_MONOTONIC, &ts)) exit(1); return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; } static void use_temporary_dir(void) { char tmpdir_template[] = "./syzkaller.XXXXXX"; char* tmpdir = mkdtemp(tmpdir_template); if (!tmpdir) exit(1); if (chmod(tmpdir, 0777)) exit(1); if (chdir(tmpdir)) exit(1); } static void remove_dir(const char* dir) { DIR* dp; struct dirent* ep; dp = opendir(dir); if (dp == NULL) exit(1); while ((ep = readdir(dp))) { if (strcmp(ep->d_name, ".") == 0 || strcmp(ep->d_name, "..") == 0) continue; char filename[FILENAME_MAX]; snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name); struct stat st; if (lstat(filename, &st)) exit(1); if (S_ISDIR(st.st_mode)) { remove_dir(filename); continue; } if (unlink(filename)) exit(1); } closedir(dp); if (rmdir(dir)) exit(1); } static void thread_start(void* (*fn)(void*), void* arg) { pthread_t th; pthread_attr_t attr; pthread_attr_init(&attr); pthread_attr_setstacksize(&attr, 128 << 10); int i; for (i = 0; i < 100; i++) { if (pthread_create(&th, &attr, fn, arg) == 0) { pthread_attr_destroy(&attr); return; } if (errno == EAGAIN) { usleep(50); continue; } break; } exit(1); } typedef struct { pthread_mutex_t mu; pthread_cond_t cv; int state; } event_t; static void event_init(event_t* ev) { if (pthread_mutex_init(&ev->mu, 0)) exit(1); if (pthread_cond_init(&ev->cv, 0)) exit(1); ev->state = 0; } static void event_reset(event_t* ev) { ev->state = 0; } static void event_set(event_t* ev) { pthread_mutex_lock(&ev->mu); if (ev->state) exit(1); ev->state = 1; pthread_mutex_unlock(&ev->mu); pthread_cond_broadcast(&ev->cv); } static void event_wait(event_t* ev) { pthread_mutex_lock(&ev->mu); while (!ev->state) pthread_cond_wait(&ev->cv, &ev->mu); pthread_mutex_unlock(&ev->mu); } static int event_isset(event_t* ev) { pthread_mutex_lock(&ev->mu); int res = ev->state; pthread_mutex_unlock(&ev->mu); return res; } static int event_timedwait(event_t* ev, uint64_t timeout) { uint64_t start = current_time_ms(); uint64_t now = start; pthread_mutex_lock(&ev->mu); for (;;) { if (ev->state) break; uint64_t remain = timeout - (now - start); struct timespec ts; ts.tv_sec = remain / 1000; ts.tv_nsec = (remain % 1000) * 1000 * 1000; pthread_cond_timedwait(&ev->cv, &ev->mu, &ts); now = current_time_ms(); if (now - start > timeout) break; } int res = ev->state; pthread_mutex_unlock(&ev->mu); return res; } /* -------------------------------------------------------------------------- */ /* * Redefinitions to match the linux types used in common_usb.h. */ struct usb_endpoint_descriptor { uint8_t_t bLength; uint8_t_t bDescriptorType; uint8_t_t bEndpointAddress; uint8_t_t bmAttributes; uint16_t_t wMaxPacketSize; uint8_t_t bInterval; uint8_t_t bRefresh; uint8_t_t bSynchAddress; } __attribute__((packed)); struct usb_device_descriptor { uint8_t_t bLength; uint8_t_t bDescriptorType; uint16_t_t bcdUSB; uint8_t_t bDeviceClass; uint8_t_t bDeviceSubClass; uint8_t_t bDeviceProtocol; uint8_t_t bMaxPacketSize0; uint16_t_t idVendor; uint16_t_t idProduct; uint16_t_t bcdDevice; uint8_t_t iManufacturer; uint8_t_t iProduct; uint8_t_t iSerialNumber; uint8_t_t bNumConfigurations; } __attribute__((packed)); struct usb_config_descriptor { uint8_t_t bLength; uint8_t_t bDescriptorType; uint16_t_t wTotalLength; uint8_t_t bNumInterfaces; uint8_t_t bConfigurationValue; uint8_t_t iConfiguration; uint8_t_t bmAttributes; uint8_t_t bMaxPower; } __attribute__((packed)); struct usb_interface_descriptor { uint8_t_t bLength; uint8_t_t bDescriptorType; uint8_t_t bInterfaceNumber; uint8_t_t bAlternateSetting; uint8_t_t bNumEndpoints; uint8_t_t bInterfaceClass; uint8_t_t bInterfaceSubClass; uint8_t_t bInterfaceProtocol; uint8_t_t iInterface; } __attribute__((packed)); struct usb_ctrlrequest { uint8_t_t bRequestType; uint8_t_t bRequest; uint16_t_t wValue; uint16_t_t wIndex; uint16_t_t wLength; } __attribute__((packed)); struct usb_qualifier_descriptor { uint8_t_t bLength; uint8_t_t bDescriptorType; uint16_t_t bcdUSB; uint8_t_t bDeviceClass; uint8_t_t bDeviceSubClass; uint8_t_t bDeviceProtocol; uint8_t_t bMaxPacketSize0; uint8_t_t bNumConfigurations; uint8_t_t bRESERVED; } __attribute__((packed)); #define USB_TYPE_MASK (0x03 << 5) #define USB_TYPE_STANDARD (0x00 << 5) #define USB_TYPE_CLASS (0x01 << 5) #define USB_TYPE_VENDOR (0x02 << 5) #define USB_TYPE_RESERVED (0x03 << 5) #define USB_DT_DEVICE 0x01 #define USB_DT_CONFIG 0x02 #define USB_DT_STRING 0x03 #define USB_DT_INTERFACE 0x04 #define USB_DT_ENDPOINT 0x05 #define USB_DT_DEVICE_QUALIFIER 0x06 #define USB_DT_OTHER_SPEED_CONFIG 0x07 #define USB_DT_INTERFACE_POWER 0x08 #define USB_DT_OTG 0x09 #define USB_DT_DEBUG 0x0a #define USB_DT_INTERFACE_ASSOCIATION 0x0b #define USB_DT_SECURITY 0x0c #define USB_DT_KEY 0x0d #define USB_DT_ENCRYPTION_TYPE 0x0e #define USB_DT_BOS 0x0f #define USB_DT_DEVICE_CAPABILITY 0x10 #define USB_DT_WIRELESS_ENDPOINT_COMP 0x11 #define USB_DT_WIRE_ADAPTER 0x21 #define USB_DT_RPIPE 0x22 #define USB_DT_CS_RADIO_CONTROL 0x23 #define USB_DT_PIPE_USAGE 0x24 #define USB_DT_SS_ENDPOINT_COMP 0x30 #define USB_DT_SSP_ISOC_ENDPOINT_COMP 0x31 #define USB_REQ_GET_STATUS 0x00 #define USB_REQ_CLEAR_FEATURE 0x01 #define USB_REQ_SET_FEATURE 0x03 #define USB_REQ_SET_ADDRESS 0x05 #define USB_REQ_GET_DESCRIPTOR 0x06 #define USB_REQ_SET_DESCRIPTOR 0x07 #define USB_REQ_GET_CONFIGURATION 0x08 #define USB_REQ_SET_CONFIGURATION 0x09 #define USB_REQ_GET_INTERFACE 0x0A #define USB_REQ_SET_INTERFACE 0x0B #define USB_REQ_SYNCH_FRAME 0x0C #define USB_REQ_SET_SEL 0x30 #define USB_REQ_SET_ISOCH_DELAY 0x31 #define USB_REQ_SET_ENCRYPTION 0x0D #define USB_REQ_GET_ENCRYPTION 0x0E #define USB_REQ_RPIPE_ABORT 0x0E #define USB_REQ_SET_HANDSHAKE 0x0F #define USB_REQ_RPIPE_RESET 0x0F #define USB_REQ_GET_HANDSHAKE 0x10 #define USB_REQ_SET_CONNECTION 0x11 #define USB_REQ_SET_SECURITY_DATA 0x12 #define USB_REQ_GET_SECURITY_DATA 0x13 #define USB_REQ_SET_WUSB_DATA 0x14 #define USB_REQ_LOOPBACK_DATA_WRITE 0x15 #define USB_REQ_LOOPBACK_DATA_READ 0x16 #define USB_REQ_SET_INTERFACE_DS 0x17 #define USB_REQ_GET_PARTNER_PDO 20 #define USB_REQ_GET_BATTERY_STATUS 21 #define USB_REQ_SET_PDO 22 #define USB_REQ_GET_VDM 23 #define USB_REQ_SEND_VDM 24 #define USB_MAX_IFACE_NUM 4 #define USB_MAX_EP_NUM 32 #define USB_MAX_FDS 6 struct usb_endpoint_index { struct usb_endpoint_descriptor desc; int handle; }; struct usb_iface_index { struct usb_interface_descriptor* iface; uint8_t bInterfaceNumber; uint8_t bAlternateSetting; uint8_t bInterfaceClass; struct usb_endpoint_index eps[USB_MAX_EP_NUM]; int eps_num; }; struct usb_device_index { struct usb_device_descriptor* dev; struct usb_config_descriptor* config; uint8_t bDeviceClass; uint8_t bMaxPower; int config_length; struct usb_iface_index ifaces[USB_MAX_IFACE_NUM]; int ifaces_num; int iface_cur; }; struct usb_info { int fd; struct usb_device_index index; }; static struct usb_info usb_devices[USB_MAX_FDS]; static int usb_devices_num; static bool parse_usb_descriptor(const char* buffer, size_t length, struct usb_device_index* index) { if (length < sizeof(*index->dev) + sizeof(*index->config)) return false; memset(index, 0, sizeof(*index)); index->dev = (struct usb_device_descriptor*)buffer; index->config = (struct usb_config_descriptor*)(buffer + sizeof(*index->dev)); index->bDeviceClass = index->dev->bDeviceClass; index->bMaxPower = index->config->bMaxPower; index->config_length = length - sizeof(*index->dev); index->iface_cur = -1; size_t offset = 0; while (true) { if (offset + 1 >= length) break; uint8_t desc_length = buffer[offset]; uint8_t desc_type = buffer[offset + 1]; if (desc_length <= 2) break; if (offset + desc_length > length) break; if (desc_type == USB_DT_INTERFACE && index->ifaces_num < USB_MAX_IFACE_NUM) { struct usb_interface_descriptor* iface = (struct usb_interface_descriptor*)(buffer + offset); index->ifaces[index->ifaces_num].iface = iface; index->ifaces[index->ifaces_num].bInterfaceNumber = iface->bInterfaceNumber; index->ifaces[index->ifaces_num].bAlternateSetting = iface->bAlternateSetting; index->ifaces[index->ifaces_num].bInterfaceClass = iface->bInterfaceClass; index->ifaces_num++; } if (desc_type == USB_DT_ENDPOINT && index->ifaces_num > 0) { struct usb_iface_index* iface = &index->ifaces[index->ifaces_num - 1]; if (iface->eps_num < USB_MAX_EP_NUM) { memcpy(&iface->eps[iface->eps_num].desc, buffer + offset, sizeof(iface->eps[iface->eps_num].desc)); iface->eps_num++; } } offset += desc_length; } return true; } static struct usb_device_index* add_usb_index(int fd, const char* dev, size_t dev_len) { int i = __atomic_fetch_add(&usb_devices_num, 1, __ATOMIC_RELAXED); if (i >= USB_MAX_FDS) return NULL; int rv = 0; rv = parse_usb_descriptor(dev, dev_len, &usb_devices[i].index); if (!rv) return NULL; __atomic_store_n(&usb_devices[i].fd, fd, __ATOMIC_RELEASE); return &usb_devices[i].index; } static struct usb_device_index* lookup_usb_index(int fd) { int i; for (i = 0; i < USB_MAX_FDS; i++) { if (__atomic_load_n(&usb_devices[i].fd, __ATOMIC_ACQUIRE) == fd) { return &usb_devices[i].index; } } return NULL; } struct vusb_connect_string_descriptor { uint32_t len; char* str; } __attribute__((packed)); struct vusb_connect_descriptors { uint32_t qual_len; char* qual; uint32_t bos_len; char* bos; uint32_t strs_len; struct vusb_connect_string_descriptor strs[0]; } __attribute__((packed)); static const char default_string[] = { 8, USB_DT_STRING, 's', 0, 'y', 0, 'z', 0 }; static const char default_lang_id[] = { 4, USB_DT_STRING, 0x09, 0x04 }; static bool lookup_connect_response_in(int fd, const struct vusb_connect_descriptors* descs, const struct usb_ctrlrequest* ctrl, char** response_data, uint32_t* response_length) { struct usb_device_index* index = lookup_usb_index(fd); uint8_t str_idx; if (!index) return false; switch (ctrl->bRequestType & USB_TYPE_MASK) { case USB_TYPE_STANDARD: switch (ctrl->bRequest) { case USB_REQ_GET_DESCRIPTOR: switch (ctrl->wValue >> 8) { case USB_DT_DEVICE: *response_data = (char*)index->dev; *response_length = sizeof(*index->dev); return true; case USB_DT_CONFIG: *response_data = (char*)index->config; *response_length = index->config_length; return true; case USB_DT_STRING: str_idx = (uint8_t)ctrl->wValue; if (descs && str_idx < descs->strs_len) { *response_data = descs->strs[str_idx].str; *response_length = descs->strs[str_idx].len; return true; } if (str_idx == 0) { *response_data = (char*)&default_lang_id[0]; *response_length = default_lang_id[0]; return true; } *response_data = (char*)&default_string[0]; *response_length = default_string[0]; return true; case USB_DT_BOS: *response_data = descs->bos; *response_length = descs->bos_len; return true; case USB_DT_DEVICE_QUALIFIER: if (!descs->qual) { struct usb_qualifier_descriptor* qual = (struct usb_qualifier_descriptor*)response_data; qual->bLength = sizeof(*qual); qual->bDescriptorType = USB_DT_DEVICE_QUALIFIER; qual->bcdUSB = index->dev->bcdUSB; qual->bDeviceClass = index->dev->bDeviceClass; qual->bDeviceSubClass = index->dev->bDeviceSubClass; qual->bDeviceProtocol = index->dev->bDeviceProtocol; qual->bMaxPacketSize0 = index->dev->bMaxPacketSize0; qual->bNumConfigurations = index->dev->bNumConfigurations; qual->bRESERVED = 0; *response_length = sizeof(*qual); return true; } *response_data = descs->qual; *response_length = descs->qual_len; return true; default: break; } break; default: break; } break; default: break; } return false; } typedef bool (*lookup_connect_out_response_t)(int fd, const struct vusb_connect_descriptors* descs, const struct usb_ctrlrequest* ctrl, bool* done); static bool lookup_connect_response_out_generic(int fd, const struct vusb_connect_descriptors* descs, const struct usb_ctrlrequest* ctrl, bool* done) { switch (ctrl->bRequestType & USB_TYPE_MASK) { case USB_TYPE_STANDARD: switch (ctrl->bRequest) { case USB_REQ_SET_CONFIGURATION: *done = true; return true; default: break; } break; } return false; } /* -------------------------------------------------------------------------- */ static int vhci_open(void) { return open("/dev/vhci", O_RDWR); } static int vhci_setport(int fd, u_int port) { struct vhci_ioc_set_port args; args.port = port; return ioctl(fd, VHCI_IOC_SET_PORT, &args); } static int vhci_usb_attach(int fd) { return ioctl(fd, VHCI_IOC_USB_ATTACH, NULL); } static int vhci_usb_recv(int fd, void* buf, size_t size) { uint8_t_t* ptr = (uint8_t_t*)buf; ssize_t done; while (1) { done = read(fd, ptr, size); if (done < 0) return -1; if ((size_t)done == size) return 0; size -= done; ptr += done; } } static int vhci_usb_send(int fd, void* buf, size_t size) { uint8_t_t* ptr = (uint8_t_t*)buf; ssize_t done; while (1) { done = write(fd, ptr, size); if (done <= 0) return -1; if ((size_t)done == size) return 0; size -= done; ptr += done; } } /* -------------------------------------------------------------------------- */ static volatile long syz_usb_connect_impl(uint64_t speed, uint64_t dev_len, const char* dev, const struct vusb_connect_descriptors* descs, lookup_connect_out_response_t lookup_connect_response_out) { struct usb_device_index* index; int portnum, fd, rv; bool done; portnum = procid + 1; if (!dev) { return -1; } if (portnum != 1) { /* For now, we support only one proc. */ return -1; } fd = vhci_open(); if (fd < 0) { return -1; } index = add_usb_index(fd, dev, dev_len); if (!index) { goto err; } rv = vhci_setport(fd, portnum); if (rv != 0) { goto err; } rv = vhci_usb_attach(fd); if (rv != 0) { goto err; } done = false; while (!done) { vhci_request_t req; rv = vhci_usb_recv(fd, &req, sizeof(req)); if (rv != 0) { goto err; } if (req.type != VHCI_REQ_CTRL) { goto err; } char* response_data = NULL; uint32_t response_length = 0; char data[4096]; if (req.u.ctrl.bmRequestType & UE_DIR_IN) { bool response_found = false; response_found = lookup_connect_response_in(fd, descs, (const usb_ctrlrequest*)&req.u.ctrl, &response_data, &response_length); if (!response_found) { goto err; } } else { if (!lookup_connect_response_out(fd, descs, (const usb_ctrlrequest*)&req.u.ctrl, &done)) { goto err; } response_data = NULL; response_length = UGETW(req.u.ctrl.wLength); } if ((req.u.ctrl.bmRequestType & USB_TYPE_MASK) == USB_TYPE_STANDARD && req.u.ctrl.bRequest == USB_REQ_SET_CONFIGURATION) { /* TODO: possibly revisit */ } if (response_length > sizeof(data)) response_length = 0; if ((uint32_t_t)UGETW(req.u.ctrl.wLength) < response_length) response_length = UGETW(req.u.ctrl.wLength); if (response_data) memcpy(data, response_data, response_length); else memset(data, 0, response_length); if (req.u.ctrl.bmRequestType & UE_DIR_IN) { if (response_length > 0) { vhci_response_t res; res.size = response_length; rv = vhci_usb_send(fd, &res, sizeof(res)); if (rv == 0) rv = vhci_usb_send(fd, data, response_length); } } else { rv = vhci_usb_recv(fd, data, response_length); } if (rv < 0) { goto err; } } sleep_ms(200); return fd; err: close(fd); return -1; } static volatile long syz_usb_connect(volatile long a0, volatile long a1, volatile long a2, volatile long a3) { uint64_t speed = a0; uint64_t dev_len = a1; const char* dev = (const char*)a2; const struct vusb_connect_descriptors* descs = (const struct vusb_connect_descriptors*)a3; return syz_usb_connect_impl(speed, dev_len, dev, descs, &lookup_connect_response_out_generic); } static volatile long syz_usb_disconnect(volatile long a0) { int fd = a0; int rv = close(fd); sleep_ms(200); return rv; } static void setup_usb(void) { if (chmod("/dev/vhci", 0666)) exit(1); } static void sandbox_common() { if (setsid() == -1) exit(1); struct rlimit rlim; rlim.rlim_cur = rlim.rlim_max = 8 << 20; setrlimit(RLIMIT_MEMLOCK, &rlim); rlim.rlim_cur = rlim.rlim_max = 1 << 20; setrlimit(RLIMIT_FSIZE, &rlim); rlim.rlim_cur = rlim.rlim_max = 1 << 20; setrlimit(RLIMIT_STACK, &rlim); rlim.rlim_cur = rlim.rlim_max = 0; setrlimit(RLIMIT_CORE, &rlim); rlim.rlim_cur = rlim.rlim_max = 256; setrlimit(RLIMIT_NOFILE, &rlim); } static void loop(); static int do_sandbox_none(void) { sandbox_common(); loop(); return 0; } static long syz_execute_func(volatile long text) { volatile long p[8] = {0}; (void)p; asm volatile("" ::"r"(0l), "r"(1l), "r"(2l), "r"(3l), "r"(4l), "r"(5l), "r"(6l), "r"(7l), "r"(8l), "r"(9l), "r"(10l), "r"(11l), "r"(12l), "r"(13l)); ((void (*)(void))(text))(); return 0; } struct thread_t { int created, call; event_t ready, done; }; static struct thread_t threads[16]; static void execute_call(int call); static int running; static void* thr(void* arg) { struct thread_t* th = (struct thread_t*)arg; for (;;) { event_wait(&th->ready); event_reset(&th->ready); execute_call(th->call); __atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED); event_set(&th->done); } return 0; } static void execute_one(void) { int i, call, thread; for (call = 0; call < 16; call++) { for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0])); thread++) { struct thread_t* th = &threads[thread]; if (!th->created) { th->created = 1; event_init(&th->ready); event_init(&th->done); event_set(&th->done); thread_start(thr, th); } if (!event_isset(&th->done)) continue; event_reset(&th->done); th->call = call; __atomic_fetch_add(&running, 1, __ATOMIC_RELAXED); event_set(&th->ready); event_timedwait(&th->done, 45 + (call == 13 ? 3000 : 0) + (call == 14 ? 3000 : 0) + (call == 15 ? 300 : 0)); break; } } for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++) sleep_ms(1); } static void execute_one(void); #define WAIT_FLAGS 0 static void loop(void) { int iter; for (iter = 0;; iter++) { char cwdbuf[32]; sprintf(cwdbuf, "./%d", iter); if (mkdir(cwdbuf, 0777)) exit(1); int pid = fork(); if (pid < 0) exit(1); if (pid == 0) { if (chdir(cwdbuf)) exit(1); execute_one(); exit(0); } int status = 0; uint64_t start = current_time_ms(); for (;;) { if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) break; sleep_ms(1); if (current_time_ms() - start < 5 * 1000) continue; kill_and_wait(pid, &status); break; } remove_dir(cwdbuf); } } #ifndef SYS_dup2 #define SYS_dup2 90 #endif #ifndef SYS_getgid #define SYS_getgid 47 #endif #ifndef SYS_getgroups #define SYS_getgroups 79 #endif #ifndef SYS_getsockopt #define SYS_getsockopt 118 #endif #ifndef SYS_mmap #define SYS_mmap 197 #endif #ifndef SYS_semctl #define SYS_semctl 442 #endif #ifndef SYS_semget #define SYS_semget 221 #endif #ifndef SYS_seteuid #define SYS_seteuid 183 #endif #ifndef SYS_setregid #define SYS_setregid 127 #endif #ifndef SYS_stat #define SYS_stat 439 #endif #ifndef SYS_writev #define SYS_writev 121 #endif uint64_t r[7] = {0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}; void execute_call(int call) { intptr_t res = 0; switch (call) { case 0: res = syscall(SYS_dup2, -1, 0xffffff9c); if (res != -1) r[0] = res; break; case 1: *(uint64_t*)0x200002c0 = 0x20000000; memcpy((void*)0x20000000, "\x25\xc5\xf6\x76\x86\x92\xf1\x6a\x6b\x02\x33\x7b\xc5\xf2\x4e\x95\xc2\xe5\x74\xf7\xbd\x23\xda\x78\xff\x22\x41\x43\x9c\xac\xed\x12\x2e\x33\xab\x16\xd3\x77\x84\x34\x15\x78\x1f\xa5\x08\xcd\x63\x5f\x2f\xd0\x41\x13\x20\x4e\xd9\xbd\xa7\x39\x6e\x99\xa3\x8a\x2f\x10\xe9\xc7\x39\x8b\x5a\x64\xc4\x9d\x98\x66\x4b\xd1\x49\x75\xbe\x70\x76\xa8\x36\x38\xa7\xda\x30\x95\xf0\xe0\x27\xbd\x16\x1c\xcd\x5c\x99\x4f\x8b\x31\xd5\x35\xa3\xce\x4c\x57\x81\x2d\x96\x82\xf3\xeb\xb1\x0e\x05\xa7\x14\x22\x10\x51\x5b\x66\x8d\x13\x57\xd9\x1a\xaa\xbb\x6a\xd8\x8a\xed\x6b\x9f\x21\x43\xd0\x62\xe0\xb5", 141); *(uint64_t*)0x200002c8 = 0x8d; *(uint64_t*)0x200002d0 = 0x200000c0; memcpy((void*)0x200000c0, "\xe8\x98\x7e\x8f\x86\x4e\x9d\x38\xb5\x56\x15\xb6\x59\xd1\x4c\xae\x9e\x91\xa9\x53\x22\x13\xff\xb4\x65\xb6\x1b", 27); *(uint64_t*)0x200002d8 = 0x1b; *(uint64_t*)0x200002e0 = 0x20000100; memcpy((void*)0x20000100, "\x3f\x97\x99\x2c\x94\x0f\xba\x89\x36\xa6\xb4", 11); *(uint64_t*)0x200002e8 = 0xb; *(uint64_t*)0x200002f0 = 0x20000140; memcpy((void*)0x20000140, "\xc9\x9a\xb6\x04\xeb\x2e\x44\xeb\xf7\xbf\xb7\xb0\x4c\x08\x43\x21\xa3\x0f\x43\x51\xae\xb0\x67\x6b\xb2\x1a\xef\xc3\xbc\x23\x22\xd9\x9a\x5b\x03\x4f\x88\x0a\xa2\x5d\x61\xae\x40\x76\x39\x7c\x30\x35\x7b\x22\xcc\xb7\x79\xeb\xd3\x20\x6a\xc6\x48\xfa\xb9\x08\x36\xdd\x4d\x9e\x73\xdc\x3c\x07\x72\x70\xb5\x7d\xc3\x22\x22\x84\xdd\x3c\xae\x47\x37\x95\x7d\x94\x7d\x76\x5a\x5e\x0e\x91\x9c\xbd\x3e\xf2\xd3\xd9\x52\x2a\x82\x7f\x3f\xe6\x0d\xdc", 106); *(uint64_t*)0x200002f8 = 0x6a; *(uint64_t*)0x20000300 = 0x200001c0; memcpy((void*)0x200001c0, "\x2b\xc5\xa9\xfd\x6c\xc3\x45\x00\x82\x40\x5a\xb6\x07\xa0\xf5\x62\x7b\x40\x58\x9a\x69\x0a\xc5\x91\x58\xac\xf1\x0f\x2a\x1c\xc4\x61\x52\xfa\x5f\x49\x3a\x85\x99\xcc\x6e\xaa\xb5\xd9\x69\x68\xbe\xf1\xa2\x7f\x62\xda\xcf\x64\xd0\x6c\x80\xcf\xb5\xb3\x20\xb9\x77\xc9\x43\x2c\x44\x6f\xa6\xf6\x55\x14\x44\xee\x4c\x59\x98\x85\x32\x60\xd6\x5d\x2c\xb3\xc7\x78\xf4\x4f\xe2\x70\x36\x3b\x4e\xb3\x09\xe2\x4f\xc4\x77\x97\xb5\xbd\x45\x4b\xf4\xd3\xd4\x65\x6f\xa0\x78\xff\x56\xb3\x0f\x4f\x0e\x9d\x5e\x6e\x89\x43\x83\x0a\xd6\xd3\x42\x96\x8c\x22\x4f\x7c\x35\xaf\x01\xa6\x1d\x10\xe1\x55\xfe\xe7\xe0\x22\x7c\xd7\x9a\x79\x77\xb3\xf4\x03\x51\xca\x01\x83\x48\x40\xab\xba\x55\x7d\x36\xbc\x8a\x42\x08\xf9\x0d\xc5\xf5\x1e\x3f\x3d\x44\x5c\x5f\xee\xa7\x93\x68\x16\x4e\xde\xf0\x5d\x24\x74\x8c\xe9\xf0\xa5\x84\x51\xb4\x3d\x98\x91\x90\x2b\xc4\x5e\xc6\x7d\x00\xdf\x1d\xeb\x74\xe6\x5b\x29\xc0\xd0\x95\xdb\xdd\x5b\x9a\x7c", 220); *(uint64_t*)0x20000308 = 0xdc; syscall(SYS_writev, r[0], 0x200002c0ul, 5ul); break; case 2: *(uint32_t*)0x20000340 = 0; *(uint32_t*)0x20000344 = -1; *(uint32_t*)0x20000348 = 0; res = syscall(SYS_getgroups, 3ul, 0x20000340ul); if (res != -1) r[1] = *(uint32_t*)0x20000348; break; case 3: *(uint32_t*)0x200003c0 = 0xc; res = syscall(SYS_getsockopt, -1, 0xffff, 0x11, 0x20000380ul, 0x200003c0ul); if (res != -1) r[2] = *(uint32_t*)0x20000388; break; case 4: syscall(SYS_setregid, r[1], r[2]); break; case 5: res = syscall(SYS_semget, 0x798e2634ul, 0ul, 0xb2603d964b180ce8ul); if (res != -1) r[3] = res; break; case 6: memcpy((void*)0x20000400, "./file0\000", 8); res = syscall(SYS_stat, 0x20000400ul, 0x20000440ul); if (res != -1) r[4] = *(uint32_t*)0x2000045c; break; case 7: res = syscall(SYS_getgid); if (res != -1) r[5] = res; break; case 8: *(uint32_t*)0x20000500 = 0xfffff834; *(uint32_t*)0x20000504 = r[4]; *(uint32_t*)0x20000508 = r[5]; *(uint32_t*)0x2000050c = -1; *(uint32_t*)0x20000510 = 0; *(uint32_t*)0x20000514 = 3; *(uint16_t*)0x20000518 = 9; *(uint16_t*)0x2000051a = 0; *(uint64_t*)0x20000520 = 0; *(uint64_t*)0x20000528 = 0; *(uint64_t*)0x20000530 = 0xfffffffffffffffd; *(uint64_t*)0x20000538 = 0x4535; *(uint64_t*)0x20000540 = 2; *(uint64_t*)0x20000548 = 0; *(uint64_t*)0x20000550 = 0; syscall(SYS_semctl, r[3], 0ul, 1ul, 0x20000500ul); break; case 9: syscall(SYS_seteuid, 0); break; case 10: memcpy((void*)0x20000000, "\xbf\x5b\xc2\xc4\xdd\xcd\x9b\xaa\x7f\x7c\x66\xf9\x17\x26\xa8\xc4\x90\xf6\x91\x85\x14\x0b\x5b\x42\x51\xe8\x67\x01\xc6\xc5\xa6\x0d\x84\x80\x2d\x38\x2a\x0c\x38\xdf\x4a\x28\xfd\x84\x0d\x7e\x14\x06\xa5\xc2\xeb\x5d\x3b\x6b\xc3\x23\xbd\x49\x38\x6c\x4a\x92\x49\x50\x31\x4f\xe6\x17\xf8\xcd\x34\x37\xa4\xaa\x6d\x1c\x6d\x62\x64\x03\x09\xf9\xde\x23\x93\x99\x9b\x11\x47\x68\xd5\x10\xd7\x34\xfd\x72\xd1\x98\xb2\x61\xbd\x61\x81\x14\xbf\x3f\xa3\xe2\xfe\x84\xff\xe6\x5c\x80\xe4\x72\x12\xc4\x9e\x47\xbb\x3a\xaa\x86\x89\x46\x2f\x21\xd5\x18\x80\xd9\x7c\xb4\x45\xd3", 136); break; case 11: memcpy((void*)0x200000c0, "\xc4\xa1\x84\x58\x2c\xaa\x26\x44\x0f\xae\x04\xc4\x41\x0f\x74\xab\x00\x00\x01\x00\xc4\x23\xf5\x78\x4c\xe9\x9d\x40\x44\xdf\x34\x59\x26\x41\x0f\xae\x41\x01\x64\x64\x66\x44\x0f\xe5\xb9\x4e\x9a\xb0\xc4\xc4\x22\x7d\x47\x0f\x41\x0f\x45\x7f\x56\x66\x0f\xdd\xe8", 63); syz_execute_func(0x200000c0); break; case 12: break; case 13: memcpy((void*)0x20000140, "\x64\xd3\x2f\x16\xeb\xd8\x17\xd0\x04\xdc\xb8\x01\x71\x82\x05\xbc\xa1\xd8\x6d\xad\x3c\xb1\x32\xa2\x86\x60\x92\x14\xb7\x39\x5a\x97\xa0\xe8\xfe\xda\x5f\xad\x02\xcc\xe9\xde\xea\x94\xd5\x5a\x75\x0c\x17\xb2\x34\x07\x50\x02\xb9\xdf\x62\x9f\xa6\x8e\x3f\x7d\xa9\x7e\x9c\x2a\x2e\x0a\x95\xd1\x5d\x35\x95\x61\xb1\x47\x74\x40\x34\x2c\xd7\x9c\x7c\xeb\xd6\xbf\x00\x8a\xcd\x1c\x7f\xf1\x46\xa6\xfe\x22\x01\x36\x61\xd8\xc8\xce\x8e\xb1\x7f\x5c\xf3\x89\x2a\xe0\x8b\xba\x46\x54\x5b\x2b\x69\x0a\xb7\xe0\x36\x8a\xec\x4d\x32\xb7\x6d\x7f\xc1\x5d\xd7\xc2\xab\xa1\x84\xd4\x1a\x5e\x5a\xbb\x8d\x71\x6f\x5e\x64\x5e\x17\x67\x13\x8e\xd7\x38\xf3\x15\x79\x5a\xc9\x9e\x22\xfd\x44\xdb\x06\x09\x63\x13\xf4\x72\x9c\xe0\xd3\xbd\x93\x8f\x5b\x65\x20\xef\x93\x76\xfa\x90\x9d\xf6\xb2\x05\xc2\xd3\xf5\x2e\xe4\x3e\x3f\x59\xea\x44\x1b\x7c\x4e\x4d\x5c", 201); memcpy((void*)0x20000240, "\xc1\xb0\x1d\x40\x73\x99\x35\xb1\x21\x7d\x0e\x39\x3c\xdd\x4f\xa4\xef\x8b\xbd\x99\x57\xee\x99\x68\x77\xe4\xca\x15\x5c\x19\x5d\xc1\x66\xf9\x48\x6a\xc4\xdb\x17\xf7\x54\xc4\x89\x38\xa4\x34\x19\xf0\x82\xa8\xc3\x0e\xff\xbe\xf0\x64\xf6\xc8\xb8\x7b\xc9\x30\xe4\x39\xc7\x19\xec\x0a\x11\x99\x04\x0b\x86\x28\x6d\x27\x1f\x25\xaf\x26\xeb\xed\x3f\x55\xc3\x2e\x68\xac\x70\x33\x0d\xf7\x69\x31\xbf\x55\xfa\xe8\x80\x25\x6b\x74\xa9\x23\xf8\xa3\x02\x2c\x31\x0f\x94\xcc\x0c\x62\x33\x02\xa5\xd1\x4b\x3f\x8e\x18\xf4\x15\x99\x88\x28\x66\xea\x02\x42\x86\x4b\x37\xd5\xae\x87\xfb\xcb\x74\x5c\x3e\x26\x42\x3d\x05\xc5\x48\x38\x33\xdf\xcd\xd4\x3d\xc0\xc6\x50\x73\x29\x03\x72\x73\xde\x28\x2e\x3a\x16\xac\x00\xc5\x53\x9c\x30\x94\x63\x98\x4b\x15\x3e\xc6\x25\x0a\x78\x19\x75\xa2\x77\x01\x72\x80\xdb\x1e\x9c\x18\xce\x66\x4d\xf5\x94\x7c\x6c\x18\xbe\xf2\x36\x7e\x61\x63\xb4\x6b\x95\x03\xf7\x00\x70\x5f\xd0\xe8\x9e\xae\x6d\xf0\x88\x4b\xf2\x7c\x00\xe0\x5f\xc5\xef\xc6\x49\x07", 234); syz_usb_connect(0, 0xc9, 0x20000140, 0x20000240); break; case 14: memcpy((void*)0x20000340, "\x36\x4f\xb1\xa4\x17\x26\x3d\xe2\x27\x97\xec\x76\x08\x61\xf3\x85\x2c\xf2\x4f\x79\xe2\xb7\xa5\xc6\x2a\xfa\xd7\xd6\xd4\xd0\x9d\x86\x2f\x8e\xcc\xd0\x2e\x1b\xb9\x89\xe0\xf8\xa8\xad\x91\x54\x42\x01\x64\x04\xc9\x82\x6a\x5c\x0a\x28\x4f\xc7\xa8\x40\x30\x47\x59\xb6\x84\xf3\x57\xb2\xe6\xfe\xcf\xb3\xcc\x81\x57\xc0\x08\xff\x0d\xcf\xf2\x10\x89\x84\x54\x8a\x2a\xd6\x95\xfa\xd9\x51\x2f\x06\xfd\x12\xd6\x6b\xc4\x43\x04\x75\x12\xab\x4e\xf3\x05\x8a\xe6\xc0\xc6\xec\x3f\xd6\x27\xe3\x70\xa1\x51\xae\x71\x9b\x8e\x3a\x77\xd6\x82\xdc\x06\xa9\x3b\xe9\xc2\xaa\x80\x18\xb5\x8a\x94\x92\xcb\x39\x03\x1b\xb5\xab\xf3\x12\x4e\xaa\xb8\x53\x30\xf1\x81\xfc\xcc\xa7\x59\x7b\x4e\xc0\x87\x9f\xcb\xcf\x51\x14\x3f\x98\xc4\x43\xc1\x67\x20\xa6\xe0\x1b\x7e\x07\xdf\x47\x27\xe2\x88\xe1\x3d\xcc\x0b\x7e\x11", 191); memcpy((void*)0x20000400, "\x59\x03\x92\x3c\x7a\x1b\x28\x38\xf3\xc1\x21\x56\x78\x5a\x11\xc8\x1b\x2e\x82\xd9\xa1\x19\x0e\x1b\x9c\x45\x97\x6a\x91\x7c\x00\x29\x4d\xc9\x4d\x53\x54\xe8\xc5\xd6\xa4\xe8\x98\x6d\xa0\x74\xeb\x46\x1e\xd0\x73\x6b\xcb\xed\xe2\xce\xf1\xf1\x9e\x02\x16\xc0\x9e\xb7\x94\xd8\xb9\x75\x4f\xea\x26\xf1\x10\xc8\x32\x48\xc2\x86\xea\xa0\x5a\x69\x84\x4e\xb1\x29\x2f\x59\x4f\x59\xf6\xc9\xbe\xca\x47\xd8\x94\xd4\x4d\xfd\x15\xff\x81\xb7\x6b\x46\x35\x39\x2e\xb5\xed\x43\x1c\xa3\x09\x22\x30", 117); res = syz_usb_connect(4, 0xbf, 0x20000340, 0x20000400); if (res != -1) r[6] = res; break; case 15: syz_usb_disconnect(r[6]); break; } } int main(void) { syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 3ul, 0x1012ul, -1, 0ul, 0ul); use_temporary_dir(); do_sandbox_none(); return 0; } :187:2: error: unknown type name 'uint8_t_t' :188:2: error: unknown type name 'uint8_t_t' :189:2: error: unknown type name 'uint8_t_t' :190:2: error: unknown type name 'uint8_t_t' :191:2: error: unknown type name 'uint16_t_t' :192:2: error: unknown type name 'uint8_t_t' :193:2: error: unknown type name 'uint8_t_t' :194:2: error: unknown type name 'uint8_t_t' :198:2: error: unknown type name 'uint8_t_t' :199:2: error: unknown type name 'uint8_t_t' :200:2: error: unknown type name 'uint16_t_t' :201:2: error: unknown type name 'uint8_t_t' :202:2: error: unknown type name 'uint8_t_t' :203:2: error: unknown type name 'uint8_t_t' :204:2: error: unknown type name 'uint8_t_t' :205:2: error: unknown type name 'uint16_t_t' :206:2: error: unknown type name 'uint16_t_t' :207:2: error: unknown type name 'uint16_t_t' :208:2: error: unknown type name 'uint8_t_t' :209:2: error: unknown type name 'uint8_t_t' :210:2: error: unknown type name 'uint8_t_t' :211:2: error: unknown type name 'uint8_t_t' :215:2: error: unknown type name 'uint8_t_t' :216:2: error: unknown type name 'uint8_t_t' :217:2: error: unknown type name 'uint16_t_t' :218:2: error: unknown type name 'uint8_t_t' :219:2: error: unknown type name 'uint8_t_t' :220:2: error: unknown type name 'uint8_t_t' :221:2: error: unknown type name 'uint8_t_t' :222:2: error: unknown type name 'uint8_t_t' :226:2: error: unknown type name 'uint8_t_t' :227:2: error: unknown type name 'uint8_t_t' :228:2: error: unknown type name 'uint8_t_t' :229:2: error: unknown type name 'uint8_t_t' :230:2: error: unknown type name 'uint8_t_t' :231:2: error: unknown type name 'uint8_t_t' :232:2: error: unknown type name 'uint8_t_t' :233:2: error: unknown type name 'uint8_t_t' :234:2: error: unknown type name 'uint8_t_t' :238:2: error: unknown type name 'uint8_t_t' :239:2: error: unknown type name 'uint8_t_t' :240:2: error: unknown type name 'uint16_t_t' :241:2: error: unknown type name 'uint16_t_t' :242:2: error: unknown type name 'uint16_t_t' :246:2: error: unknown type name 'uint8_t_t' :247:2: error: unknown type name 'uint8_t_t' :248:2: error: unknown type name 'uint16_t_t' :249:2: error: unknown type name 'uint8_t_t' :250:2: error: unknown type name 'uint8_t_t' :251:2: error: unknown type name 'uint8_t_t' :252:2: error: unknown type name 'uint8_t_t' :253:2: error: unknown type name 'uint8_t_t' :254:2: error: unknown type name 'uint8_t_t' : In function 'vhci_usb_recv': :561:2: error: unknown type name 'uint8_t_t'; did you mean 'uint8_t'? :561:20: error: 'uint8_t_t' undeclared (first use in this function); did you mean 'uint8_t'? :561:20: note: each undeclared identifier is reported only once for each function it appears in :561:30: error: expected expression before ')' token : In function 'vhci_usb_send': :576:2: error: unknown type name 'uint8_t_t'; did you mean 'uint8_t'? :576:20: error: 'uint8_t_t' undeclared (first use in this function); did you mean 'uint8_t'? :576:30: error: expected expression before ')' token : In function 'syz_usb_connect_impl': :637:63: error: unknown type name 'usb_ctrlrequest' :642:55: error: unknown type name 'usb_ctrlrequest' :654:8: error: 'uint32_t_t' undeclared (first use in this function); did you mean 'uint32_t'? At top level: :702:13: error: 'setup_usb' defined but not used [-Werror=unused-function] cc1: all warnings being treated as errors compiler invocation: /syzkaller/netbsd/src/../tools/bin/x86_64--netbsd-g++ [-o /tmp/syz-executor766295902 -DGOOS_netbsd=1 -DGOARCH_amd64=1 -DHOSTGOOS_linux=1 -x c - -m64 --sysroot /syzkaller/netbsd/src/../dest/ -O2 -pthread -Wall -Werror -Wparentheses -Wframe-larger-than=16384] --- FAIL: TestGenerate/netbsd/amd64/11 (0.49s) csource_test.go:123: opts: {Threaded:true Collide:false Repeat:true RepeatTimes:0 Procs:0 Sandbox:none Fault:false FaultCall:0 FaultNth:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false USB:false UseTmpDir:true HandleSegv:true Repro:false Trace:false} program: r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c) writev(r0, &(0x7f00000002c0)=[{&(0x7f0000000000)="25c5f6768692f16a6b02337bc5f24e95c2e574f7bd23da78ff2241439caced122e33ab16d377843415781fa508cd635f2fd04113204ed9bda7396e99a38a2f10e9c7398b5a64c49d98664bd14975be7076a83638a7da3095f0e027bd161ccd5c994f8b31d535a3ce4c57812d9682f3ebb10e05a7142210515b668d1357d91aaabb6ad88aed6b9f2143d062e0b5", 0x8d}, {&(0x7f00000000c0)="e8987e8f864e9d38b55615b659d14cae9e91a9532213ffb465b61b", 0x1b}, {&(0x7f0000000100)="3f97992c940fba8936a6b4", 0xb}, {&(0x7f0000000140)="c99ab604eb2e44ebf7bfb7b04c084321a30f4351aeb0676bb21aefc3bc2322d99a5b034f880aa25d61ae4076397c30357b22ccb779ebd3206ac648fab90836dd4d9e73dc3c077270b57dc3222284dd3cae4737957d947d765a5e0e919cbd3ef2d3d9522a827f3fe60ddc", 0x6a}, {&(0x7f00000001c0)="2bc5a9fd6cc3450082405ab607a0f5627b40589a690ac59158acf10f2a1cc46152fa5f493a8599cc6eaab5d96968bef1a27f62dacf64d06c80cfb5b320b977c9432c446fa6f6551444ee4c5998853260d65d2cb3c778f44fe270363b4eb309e24fc47797b5bd454bf4d3d4656fa078ff56b30f4f0e9d5e6e8943830ad6d342968c224f7c35af01a61d10e155fee7e0227cd79a7977b3f40351ca01834840abba557d36bc8a4208f90dc5f51e3f3d445c5feea79368164edef05d24748ce9f0a58451b43d9891902bc45ec67d00df1deb74e65b29c0d095dbdd5b9a7c", 0xdc}], 0x5) getgroups(0x3, &(0x7f0000000340)=[0x0, 0xffffffffffffffff, 0x0]) getsockopt$sock_cred(0xffffffffffffffff, 0xffff, 0x11, &(0x7f0000000380)={0x0, 0x0, 0x0}, &(0x7f00000003c0)=0xc) setregid(r1, r2) r3 = semget(0x1, 0x0, 0xb2603d964b180ce8) stat(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0}) r5 = getgid() semctl$IPC_SET(r3, 0x0, 0x1, &(0x7f0000000500)={{0xfffff834, r4, r5, 0xffffffffffffffff, 0x0, 0x3, 0x9}, 0xfffffffffffffffd, 0x4535, 0x2}) seteuid(0x0) syz_emit_ethernet(0x88, &(0x7f0000000000)="bf5bc2c4ddcd9baa7f7c66f91726a8c490f69185140b5b4251e86701c6c5a60d84802d382a0c38df4a28fd840d7e1406a5c2eb5d3b6bc323bd49386c4a924950314fe617f8cd3437a4aa6d1c6d62640309f9de2393999b114768d510d734fd72d198b261bd618114bf3fa3e2fe84ffe65c80e47212c49e47bb3aaa8689462f21d51880d97cb445d3") syz_execute_func(&(0x7f00000000c0)="c4a184582caa26440fae04c4410f74ab00000100c423f5784ce99d4044df345926410fae4101646466440fe5b94e9ab0c4c4227d470f410f457f56660fdde8") syz_extract_tcp_res(&(0x7f0000000100), 0x6, 0x1) syz_usb_connect(0x0, 0xc9, &(0x7f0000000140)="64d32f16ebd817d004dcb801718205bca1d86dad3cb132a286609214b7395a97a0e8feda5fad02cce9deea94d55a750c17b234075002b9df629fa68e3f7da97e9c2a2e0a95d15d359561b1477440342cd79c7cebd6bf008acd1c7ff146a6fe22013661d8c8ce8eb17f5cf3892ae08bba46545b2b690ab7e0368aec4d32b76d7fc15dd7c2aba184d41a5e5abb8d716f5e645e1767138ed738f315795ac99e22fd44db06096313f4729ce0d3bd938f5b6520ef9376fa909df6b205c2d3f52ee43e3f59ea441b7c4e4d5c", &(0x7f0000000240)="c1b01d40739935b1217d0e393cdd4fa4ef8bbd9957ee996877e4ca155c195dc166f9486ac4db17f754c48938a43419f082a8c30effbef064f6c8b87bc930e439c719ec0a1199040b86286d271f25af26ebed3f55c32e68ac70330df76931bf55fae880256b74a923f8a3022c310f94cc0c623302a5d14b3f8e18f41599882866ea0242864b37d5ae87fbcb745c3e26423d05c5483833dfcdd43dc0c6507329037273de282e3a16ac00c5539c309463984b153ec6250a781975a277017280db1e9c18ce664df5947c6c18bef2367e6163b46b9503f700705fd0e89eae6df0884bf27c00e05fc5efc64907") r6 = syz_usb_connect(0x4, 0xbf, &(0x7f0000000340)="364fb1a417263de22797ec760861f3852cf24f79e2b7a5c62afad7d6d4d09d862f8eccd02e1bb989e0f8a8ad915442016404c9826a5c0a284fc7a840304759b684f357b2e6fecfb3cc8157c008ff0dcff2108984548a2ad695fad9512f06fd12d66bc443047512ab4ef3058ae6c0c6ec3fd627e370a151ae719b8e3a77d682dc06a93be9c2aa8018b58a9492cb39031bb5abf3124eaab85330f181fccca7597b4ec0879fcbcf51143f98c443c16720a6e01b7e07df4727e288e13dcc0b7e11", &(0x7f0000000400)="5903923c7a1b2838f3c12156785a11c81b2e82d9a1190e1b9c45976a917c00294dc94d5354e8c5d6a4e8986da074eb461ed0736bcbede2cef1f19e0216c09eb794d8b9754fea26f110c83248c286eaa05a69844eb1292f594f59f6c9beca47d894d44dfd15ff81b76b4635392eb5ed431ca3092230") syz_usb_disconnect(r6) csource_test.go:124: failed to build program: // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include static unsigned long long procid; static __thread int skip_segv; static __thread jmp_buf segv_env; static void segv_handler(int sig, siginfo_t* info, void* ctx) { uintptr_t addr = (uintptr_t)info->si_addr; const uintptr_t prog_start = 1 << 20; const uintptr_t prog_end = 100 << 20; if (__atomic_load_n(&skip_segv, __ATOMIC_RELAXED) && (addr < prog_start || addr > prog_end)) { _longjmp(segv_env, 1); } exit(sig); } static void install_segv_handler(void) { struct sigaction sa; memset(&sa, 0, sizeof(sa)); sa.sa_sigaction = segv_handler; sa.sa_flags = SA_NODEFER | SA_SIGINFO; sigaction(SIGSEGV, &sa, NULL); sigaction(SIGBUS, &sa, NULL); } #define NONFAILING(...) { __atomic_fetch_add(&skip_segv, 1, __ATOMIC_SEQ_CST); if (_setjmp(segv_env) == 0) { __VA_ARGS__; } __atomic_fetch_sub(&skip_segv, 1, __ATOMIC_SEQ_CST); } static void kill_and_wait(int pid, int* status) { kill(pid, SIGKILL); while (waitpid(-1, status, 0) != pid) { } } static void sleep_ms(uint64_t ms) { usleep(ms * 1000); } static uint64_t current_time_ms(void) { struct timespec ts; if (clock_gettime(CLOCK_MONOTONIC, &ts)) exit(1); return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; } static void use_temporary_dir(void) { char tmpdir_template[] = "./syzkaller.XXXXXX"; char* tmpdir = mkdtemp(tmpdir_template); if (!tmpdir) exit(1); if (chmod(tmpdir, 0777)) exit(1); if (chdir(tmpdir)) exit(1); } static void remove_dir(const char* dir) { DIR* dp; struct dirent* ep; dp = opendir(dir); if (dp == NULL) exit(1); while ((ep = readdir(dp))) { if (strcmp(ep->d_name, ".") == 0 || strcmp(ep->d_name, "..") == 0) continue; char filename[FILENAME_MAX]; snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name); struct stat st; if (lstat(filename, &st)) exit(1); if (S_ISDIR(st.st_mode)) { remove_dir(filename); continue; } if (unlink(filename)) exit(1); } closedir(dp); if (rmdir(dir)) exit(1); } static void thread_start(void* (*fn)(void*), void* arg) { pthread_t th; pthread_attr_t attr; pthread_attr_init(&attr); pthread_attr_setstacksize(&attr, 128 << 10); int i; for (i = 0; i < 100; i++) { if (pthread_create(&th, &attr, fn, arg) == 0) { pthread_attr_destroy(&attr); return; } if (errno == EAGAIN) { usleep(50); continue; } break; } exit(1); } typedef struct { pthread_mutex_t mu; pthread_cond_t cv; int state; } event_t; static void event_init(event_t* ev) { if (pthread_mutex_init(&ev->mu, 0)) exit(1); if (pthread_cond_init(&ev->cv, 0)) exit(1); ev->state = 0; } static void event_reset(event_t* ev) { ev->state = 0; } static void event_set(event_t* ev) { pthread_mutex_lock(&ev->mu); if (ev->state) exit(1); ev->state = 1; pthread_mutex_unlock(&ev->mu); pthread_cond_broadcast(&ev->cv); } static void event_wait(event_t* ev) { pthread_mutex_lock(&ev->mu); while (!ev->state) pthread_cond_wait(&ev->cv, &ev->mu); pthread_mutex_unlock(&ev->mu); } static int event_isset(event_t* ev) { pthread_mutex_lock(&ev->mu); int res = ev->state; pthread_mutex_unlock(&ev->mu); return res; } static int event_timedwait(event_t* ev, uint64_t timeout) { uint64_t start = current_time_ms(); uint64_t now = start; pthread_mutex_lock(&ev->mu); for (;;) { if (ev->state) break; uint64_t remain = timeout - (now - start); struct timespec ts; ts.tv_sec = remain / 1000; ts.tv_nsec = (remain % 1000) * 1000 * 1000; pthread_cond_timedwait(&ev->cv, &ev->mu, &ts); now = current_time_ms(); if (now - start > timeout) break; } int res = ev->state; pthread_mutex_unlock(&ev->mu); return res; } /* -------------------------------------------------------------------------- */ /* * Redefinitions to match the linux types used in common_usb.h. */ struct usb_endpoint_descriptor { uint8_t_t bLength; uint8_t_t bDescriptorType; uint8_t_t bEndpointAddress; uint8_t_t bmAttributes; uint16_t_t wMaxPacketSize; uint8_t_t bInterval; uint8_t_t bRefresh; uint8_t_t bSynchAddress; } __attribute__((packed)); struct usb_device_descriptor { uint8_t_t bLength; uint8_t_t bDescriptorType; uint16_t_t bcdUSB; uint8_t_t bDeviceClass; uint8_t_t bDeviceSubClass; uint8_t_t bDeviceProtocol; uint8_t_t bMaxPacketSize0; uint16_t_t idVendor; uint16_t_t idProduct; uint16_t_t bcdDevice; uint8_t_t iManufacturer; uint8_t_t iProduct; uint8_t_t iSerialNumber; uint8_t_t bNumConfigurations; } __attribute__((packed)); struct usb_config_descriptor { uint8_t_t bLength; uint8_t_t bDescriptorType; uint16_t_t wTotalLength; uint8_t_t bNumInterfaces; uint8_t_t bConfigurationValue; uint8_t_t iConfiguration; uint8_t_t bmAttributes; uint8_t_t bMaxPower; } __attribute__((packed)); struct usb_interface_descriptor { uint8_t_t bLength; uint8_t_t bDescriptorType; uint8_t_t bInterfaceNumber; uint8_t_t bAlternateSetting; uint8_t_t bNumEndpoints; uint8_t_t bInterfaceClass; uint8_t_t bInterfaceSubClass; uint8_t_t bInterfaceProtocol; uint8_t_t iInterface; } __attribute__((packed)); struct usb_ctrlrequest { uint8_t_t bRequestType; uint8_t_t bRequest; uint16_t_t wValue; uint16_t_t wIndex; uint16_t_t wLength; } __attribute__((packed)); struct usb_qualifier_descriptor { uint8_t_t bLength; uint8_t_t bDescriptorType; uint16_t_t bcdUSB; uint8_t_t bDeviceClass; uint8_t_t bDeviceSubClass; uint8_t_t bDeviceProtocol; uint8_t_t bMaxPacketSize0; uint8_t_t bNumConfigurations; uint8_t_t bRESERVED; } __attribute__((packed)); #define USB_TYPE_MASK (0x03 << 5) #define USB_TYPE_STANDARD (0x00 << 5) #define USB_TYPE_CLASS (0x01 << 5) #define USB_TYPE_VENDOR (0x02 << 5) #define USB_TYPE_RESERVED (0x03 << 5) #define USB_DT_DEVICE 0x01 #define USB_DT_CONFIG 0x02 #define USB_DT_STRING 0x03 #define USB_DT_INTERFACE 0x04 #define USB_DT_ENDPOINT 0x05 #define USB_DT_DEVICE_QUALIFIER 0x06 #define USB_DT_OTHER_SPEED_CONFIG 0x07 #define USB_DT_INTERFACE_POWER 0x08 #define USB_DT_OTG 0x09 #define USB_DT_DEBUG 0x0a #define USB_DT_INTERFACE_ASSOCIATION 0x0b #define USB_DT_SECURITY 0x0c #define USB_DT_KEY 0x0d #define USB_DT_ENCRYPTION_TYPE 0x0e #define USB_DT_BOS 0x0f #define USB_DT_DEVICE_CAPABILITY 0x10 #define USB_DT_WIRELESS_ENDPOINT_COMP 0x11 #define USB_DT_WIRE_ADAPTER 0x21 #define USB_DT_RPIPE 0x22 #define USB_DT_CS_RADIO_CONTROL 0x23 #define USB_DT_PIPE_USAGE 0x24 #define USB_DT_SS_ENDPOINT_COMP 0x30 #define USB_DT_SSP_ISOC_ENDPOINT_COMP 0x31 #define USB_REQ_GET_STATUS 0x00 #define USB_REQ_CLEAR_FEATURE 0x01 #define USB_REQ_SET_FEATURE 0x03 #define USB_REQ_SET_ADDRESS 0x05 #define USB_REQ_GET_DESCRIPTOR 0x06 #define USB_REQ_SET_DESCRIPTOR 0x07 #define USB_REQ_GET_CONFIGURATION 0x08 #define USB_REQ_SET_CONFIGURATION 0x09 #define USB_REQ_GET_INTERFACE 0x0A #define USB_REQ_SET_INTERFACE 0x0B #define USB_REQ_SYNCH_FRAME 0x0C #define USB_REQ_SET_SEL 0x30 #define USB_REQ_SET_ISOCH_DELAY 0x31 #define USB_REQ_SET_ENCRYPTION 0x0D #define USB_REQ_GET_ENCRYPTION 0x0E #define USB_REQ_RPIPE_ABORT 0x0E #define USB_REQ_SET_HANDSHAKE 0x0F #define USB_REQ_RPIPE_RESET 0x0F #define USB_REQ_GET_HANDSHAKE 0x10 #define USB_REQ_SET_CONNECTION 0x11 #define USB_REQ_SET_SECURITY_DATA 0x12 #define USB_REQ_GET_SECURITY_DATA 0x13 #define USB_REQ_SET_WUSB_DATA 0x14 #define USB_REQ_LOOPBACK_DATA_WRITE 0x15 #define USB_REQ_LOOPBACK_DATA_READ 0x16 #define USB_REQ_SET_INTERFACE_DS 0x17 #define USB_REQ_GET_PARTNER_PDO 20 #define USB_REQ_GET_BATTERY_STATUS 21 #define USB_REQ_SET_PDO 22 #define USB_REQ_GET_VDM 23 #define USB_REQ_SEND_VDM 24 #define USB_MAX_IFACE_NUM 4 #define USB_MAX_EP_NUM 32 #define USB_MAX_FDS 6 struct usb_endpoint_index { struct usb_endpoint_descriptor desc; int handle; }; struct usb_iface_index { struct usb_interface_descriptor* iface; uint8_t bInterfaceNumber; uint8_t bAlternateSetting; uint8_t bInterfaceClass; struct usb_endpoint_index eps[USB_MAX_EP_NUM]; int eps_num; }; struct usb_device_index { struct usb_device_descriptor* dev; struct usb_config_descriptor* config; uint8_t bDeviceClass; uint8_t bMaxPower; int config_length; struct usb_iface_index ifaces[USB_MAX_IFACE_NUM]; int ifaces_num; int iface_cur; }; struct usb_info { int fd; struct usb_device_index index; }; static struct usb_info usb_devices[USB_MAX_FDS]; static int usb_devices_num; static bool parse_usb_descriptor(const char* buffer, size_t length, struct usb_device_index* index) { if (length < sizeof(*index->dev) + sizeof(*index->config)) return false; memset(index, 0, sizeof(*index)); index->dev = (struct usb_device_descriptor*)buffer; index->config = (struct usb_config_descriptor*)(buffer + sizeof(*index->dev)); index->bDeviceClass = index->dev->bDeviceClass; index->bMaxPower = index->config->bMaxPower; index->config_length = length - sizeof(*index->dev); index->iface_cur = -1; size_t offset = 0; while (true) { if (offset + 1 >= length) break; uint8_t desc_length = buffer[offset]; uint8_t desc_type = buffer[offset + 1]; if (desc_length <= 2) break; if (offset + desc_length > length) break; if (desc_type == USB_DT_INTERFACE && index->ifaces_num < USB_MAX_IFACE_NUM) { struct usb_interface_descriptor* iface = (struct usb_interface_descriptor*)(buffer + offset); index->ifaces[index->ifaces_num].iface = iface; index->ifaces[index->ifaces_num].bInterfaceNumber = iface->bInterfaceNumber; index->ifaces[index->ifaces_num].bAlternateSetting = iface->bAlternateSetting; index->ifaces[index->ifaces_num].bInterfaceClass = iface->bInterfaceClass; index->ifaces_num++; } if (desc_type == USB_DT_ENDPOINT && index->ifaces_num > 0) { struct usb_iface_index* iface = &index->ifaces[index->ifaces_num - 1]; if (iface->eps_num < USB_MAX_EP_NUM) { memcpy(&iface->eps[iface->eps_num].desc, buffer + offset, sizeof(iface->eps[iface->eps_num].desc)); iface->eps_num++; } } offset += desc_length; } return true; } static struct usb_device_index* add_usb_index(int fd, const char* dev, size_t dev_len) { int i = __atomic_fetch_add(&usb_devices_num, 1, __ATOMIC_RELAXED); if (i >= USB_MAX_FDS) return NULL; int rv = 0; NONFAILING(rv = parse_usb_descriptor(dev, dev_len, &usb_devices[i].index)); if (!rv) return NULL; __atomic_store_n(&usb_devices[i].fd, fd, __ATOMIC_RELEASE); return &usb_devices[i].index; } static struct usb_device_index* lookup_usb_index(int fd) { int i; for (i = 0; i < USB_MAX_FDS; i++) { if (__atomic_load_n(&usb_devices[i].fd, __ATOMIC_ACQUIRE) == fd) { return &usb_devices[i].index; } } return NULL; } struct vusb_connect_string_descriptor { uint32_t len; char* str; } __attribute__((packed)); struct vusb_connect_descriptors { uint32_t qual_len; char* qual; uint32_t bos_len; char* bos; uint32_t strs_len; struct vusb_connect_string_descriptor strs[0]; } __attribute__((packed)); static const char default_string[] = { 8, USB_DT_STRING, 's', 0, 'y', 0, 'z', 0 }; static const char default_lang_id[] = { 4, USB_DT_STRING, 0x09, 0x04 }; static bool lookup_connect_response_in(int fd, const struct vusb_connect_descriptors* descs, const struct usb_ctrlrequest* ctrl, char** response_data, uint32_t* response_length) { struct usb_device_index* index = lookup_usb_index(fd); uint8_t str_idx; if (!index) return false; switch (ctrl->bRequestType & USB_TYPE_MASK) { case USB_TYPE_STANDARD: switch (ctrl->bRequest) { case USB_REQ_GET_DESCRIPTOR: switch (ctrl->wValue >> 8) { case USB_DT_DEVICE: *response_data = (char*)index->dev; *response_length = sizeof(*index->dev); return true; case USB_DT_CONFIG: *response_data = (char*)index->config; *response_length = index->config_length; return true; case USB_DT_STRING: str_idx = (uint8_t)ctrl->wValue; if (descs && str_idx < descs->strs_len) { *response_data = descs->strs[str_idx].str; *response_length = descs->strs[str_idx].len; return true; } if (str_idx == 0) { *response_data = (char*)&default_lang_id[0]; *response_length = default_lang_id[0]; return true; } *response_data = (char*)&default_string[0]; *response_length = default_string[0]; return true; case USB_DT_BOS: *response_data = descs->bos; *response_length = descs->bos_len; return true; case USB_DT_DEVICE_QUALIFIER: if (!descs->qual) { struct usb_qualifier_descriptor* qual = (struct usb_qualifier_descriptor*)response_data; qual->bLength = sizeof(*qual); qual->bDescriptorType = USB_DT_DEVICE_QUALIFIER; qual->bcdUSB = index->dev->bcdUSB; qual->bDeviceClass = index->dev->bDeviceClass; qual->bDeviceSubClass = index->dev->bDeviceSubClass; qual->bDeviceProtocol = index->dev->bDeviceProtocol; qual->bMaxPacketSize0 = index->dev->bMaxPacketSize0; qual->bNumConfigurations = index->dev->bNumConfigurations; qual->bRESERVED = 0; *response_length = sizeof(*qual); return true; } *response_data = descs->qual; *response_length = descs->qual_len; return true; default: break; } break; default: break; } break; default: break; } return false; } typedef bool (*lookup_connect_out_response_t)(int fd, const struct vusb_connect_descriptors* descs, const struct usb_ctrlrequest* ctrl, bool* done); static bool lookup_connect_response_out_generic(int fd, const struct vusb_connect_descriptors* descs, const struct usb_ctrlrequest* ctrl, bool* done) { switch (ctrl->bRequestType & USB_TYPE_MASK) { case USB_TYPE_STANDARD: switch (ctrl->bRequest) { case USB_REQ_SET_CONFIGURATION: *done = true; return true; default: break; } break; } return false; } /* -------------------------------------------------------------------------- */ static int vhci_open(void) { return open("/dev/vhci", O_RDWR); } static int vhci_setport(int fd, u_int port) { struct vhci_ioc_set_port args; args.port = port; return ioctl(fd, VHCI_IOC_SET_PORT, &args); } static int vhci_usb_attach(int fd) { return ioctl(fd, VHCI_IOC_USB_ATTACH, NULL); } static int vhci_usb_recv(int fd, void* buf, size_t size) { uint8_t_t* ptr = (uint8_t_t*)buf; ssize_t done; while (1) { done = read(fd, ptr, size); if (done < 0) return -1; if ((size_t)done == size) return 0; size -= done; ptr += done; } } static int vhci_usb_send(int fd, void* buf, size_t size) { uint8_t_t* ptr = (uint8_t_t*)buf; ssize_t done; while (1) { done = write(fd, ptr, size); if (done <= 0) return -1; if ((size_t)done == size) return 0; size -= done; ptr += done; } } /* -------------------------------------------------------------------------- */ static volatile long syz_usb_connect_impl(uint64_t speed, uint64_t dev_len, const char* dev, const struct vusb_connect_descriptors* descs, lookup_connect_out_response_t lookup_connect_response_out) { struct usb_device_index* index; int portnum, fd, rv; bool done; portnum = procid + 1; if (!dev) { return -1; } if (portnum != 1) { /* For now, we support only one proc. */ return -1; } fd = vhci_open(); if (fd < 0) { return -1; } index = add_usb_index(fd, dev, dev_len); if (!index) { goto err; } rv = vhci_setport(fd, portnum); if (rv != 0) { goto err; } rv = vhci_usb_attach(fd); if (rv != 0) { goto err; } done = false; while (!done) { vhci_request_t req; rv = vhci_usb_recv(fd, &req, sizeof(req)); if (rv != 0) { goto err; } if (req.type != VHCI_REQ_CTRL) { goto err; } char* response_data = NULL; uint32_t response_length = 0; char data[4096]; if (req.u.ctrl.bmRequestType & UE_DIR_IN) { bool response_found = false; NONFAILING(response_found = lookup_connect_response_in(fd, descs, (const usb_ctrlrequest*)&req.u.ctrl, &response_data, &response_length)); if (!response_found) { goto err; } } else { if (!lookup_connect_response_out(fd, descs, (const usb_ctrlrequest*)&req.u.ctrl, &done)) { goto err; } response_data = NULL; response_length = UGETW(req.u.ctrl.wLength); } if ((req.u.ctrl.bmRequestType & USB_TYPE_MASK) == USB_TYPE_STANDARD && req.u.ctrl.bRequest == USB_REQ_SET_CONFIGURATION) { /* TODO: possibly revisit */ } if (response_length > sizeof(data)) response_length = 0; if ((uint32_t_t)UGETW(req.u.ctrl.wLength) < response_length) response_length = UGETW(req.u.ctrl.wLength); if (response_data) memcpy(data, response_data, response_length); else memset(data, 0, response_length); if (req.u.ctrl.bmRequestType & UE_DIR_IN) { if (response_length > 0) { vhci_response_t res; res.size = response_length; rv = vhci_usb_send(fd, &res, sizeof(res)); if (rv == 0) rv = vhci_usb_send(fd, data, response_length); } } else { rv = vhci_usb_recv(fd, data, response_length); } if (rv < 0) { goto err; } } sleep_ms(200); return fd; err: close(fd); return -1; } static volatile long syz_usb_connect(volatile long a0, volatile long a1, volatile long a2, volatile long a3) { uint64_t speed = a0; uint64_t dev_len = a1; const char* dev = (const char*)a2; const struct vusb_connect_descriptors* descs = (const struct vusb_connect_descriptors*)a3; return syz_usb_connect_impl(speed, dev_len, dev, descs, &lookup_connect_response_out_generic); } static volatile long syz_usb_disconnect(volatile long a0) { int fd = a0; int rv = close(fd); sleep_ms(200); return rv; } static void setup_usb(void) { if (chmod("/dev/vhci", 0666)) exit(1); } static void sandbox_common() { if (setsid() == -1) exit(1); struct rlimit rlim; rlim.rlim_cur = rlim.rlim_max = 8 << 20; setrlimit(RLIMIT_MEMLOCK, &rlim); rlim.rlim_cur = rlim.rlim_max = 1 << 20; setrlimit(RLIMIT_FSIZE, &rlim); rlim.rlim_cur = rlim.rlim_max = 1 << 20; setrlimit(RLIMIT_STACK, &rlim); rlim.rlim_cur = rlim.rlim_max = 0; setrlimit(RLIMIT_CORE, &rlim); rlim.rlim_cur = rlim.rlim_max = 256; setrlimit(RLIMIT_NOFILE, &rlim); } static void loop(); static int do_sandbox_none(void) { sandbox_common(); loop(); return 0; } static long syz_execute_func(volatile long text) { volatile long p[8] = {0}; (void)p; asm volatile("" ::"r"(0l), "r"(1l), "r"(2l), "r"(3l), "r"(4l), "r"(5l), "r"(6l), "r"(7l), "r"(8l), "r"(9l), "r"(10l), "r"(11l), "r"(12l), "r"(13l)); NONFAILING(((void (*)(void))(text))()); return 0; } struct thread_t { int created, call; event_t ready, done; }; static struct thread_t threads[16]; static void execute_call(int call); static int running; static void* thr(void* arg) { struct thread_t* th = (struct thread_t*)arg; for (;;) { event_wait(&th->ready); event_reset(&th->ready); execute_call(th->call); __atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED); event_set(&th->done); } return 0; } static void execute_one(void) { int i, call, thread; for (call = 0; call < 16; call++) { for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0])); thread++) { struct thread_t* th = &threads[thread]; if (!th->created) { th->created = 1; event_init(&th->ready); event_init(&th->done); event_set(&th->done); thread_start(thr, th); } if (!event_isset(&th->done)) continue; event_reset(&th->done); th->call = call; __atomic_fetch_add(&running, 1, __ATOMIC_RELAXED); event_set(&th->ready); event_timedwait(&th->done, 45 + (call == 13 ? 3000 : 0) + (call == 14 ? 3000 : 0) + (call == 15 ? 300 : 0)); break; } } for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++) sleep_ms(1); } static void execute_one(void); #define WAIT_FLAGS 0 static void loop(void) { int iter; for (iter = 0;; iter++) { char cwdbuf[32]; sprintf(cwdbuf, "./%d", iter); if (mkdir(cwdbuf, 0777)) exit(1); int pid = fork(); if (pid < 0) exit(1); if (pid == 0) { if (chdir(cwdbuf)) exit(1); execute_one(); exit(0); } int status = 0; uint64_t start = current_time_ms(); for (;;) { if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) break; sleep_ms(1); if (current_time_ms() - start < 5 * 1000) continue; kill_and_wait(pid, &status); break; } remove_dir(cwdbuf); } } #ifndef SYS_dup2 #define SYS_dup2 90 #endif #ifndef SYS_getgid #define SYS_getgid 47 #endif #ifndef SYS_getgroups #define SYS_getgroups 79 #endif #ifndef SYS_getsockopt #define SYS_getsockopt 118 #endif #ifndef SYS_mmap #define SYS_mmap 197 #endif #ifndef SYS_semctl #define SYS_semctl 442 #endif #ifndef SYS_semget #define SYS_semget 221 #endif #ifndef SYS_seteuid #define SYS_seteuid 183 #endif #ifndef SYS_setregid #define SYS_setregid 127 #endif #ifndef SYS_stat #define SYS_stat 439 #endif #ifndef SYS_writev #define SYS_writev 121 #endif uint64_t r[7] = {0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}; void execute_call(int call) { intptr_t res = 0; switch (call) { case 0: res = syscall(SYS_dup2, -1, 0xffffff9c); if (res != -1) r[0] = res; break; case 1: NONFAILING(*(uint64_t*)0x200002c0 = 0x20000000); NONFAILING(memcpy((void*)0x20000000, "\x25\xc5\xf6\x76\x86\x92\xf1\x6a\x6b\x02\x33\x7b\xc5\xf2\x4e\x95\xc2\xe5\x74\xf7\xbd\x23\xda\x78\xff\x22\x41\x43\x9c\xac\xed\x12\x2e\x33\xab\x16\xd3\x77\x84\x34\x15\x78\x1f\xa5\x08\xcd\x63\x5f\x2f\xd0\x41\x13\x20\x4e\xd9\xbd\xa7\x39\x6e\x99\xa3\x8a\x2f\x10\xe9\xc7\x39\x8b\x5a\x64\xc4\x9d\x98\x66\x4b\xd1\x49\x75\xbe\x70\x76\xa8\x36\x38\xa7\xda\x30\x95\xf0\xe0\x27\xbd\x16\x1c\xcd\x5c\x99\x4f\x8b\x31\xd5\x35\xa3\xce\x4c\x57\x81\x2d\x96\x82\xf3\xeb\xb1\x0e\x05\xa7\x14\x22\x10\x51\x5b\x66\x8d\x13\x57\xd9\x1a\xaa\xbb\x6a\xd8\x8a\xed\x6b\x9f\x21\x43\xd0\x62\xe0\xb5", 141)); NONFAILING(*(uint64_t*)0x200002c8 = 0x8d); NONFAILING(*(uint64_t*)0x200002d0 = 0x200000c0); NONFAILING(memcpy((void*)0x200000c0, "\xe8\x98\x7e\x8f\x86\x4e\x9d\x38\xb5\x56\x15\xb6\x59\xd1\x4c\xae\x9e\x91\xa9\x53\x22\x13\xff\xb4\x65\xb6\x1b", 27)); NONFAILING(*(uint64_t*)0x200002d8 = 0x1b); NONFAILING(*(uint64_t*)0x200002e0 = 0x20000100); NONFAILING(memcpy((void*)0x20000100, "\x3f\x97\x99\x2c\x94\x0f\xba\x89\x36\xa6\xb4", 11)); NONFAILING(*(uint64_t*)0x200002e8 = 0xb); NONFAILING(*(uint64_t*)0x200002f0 = 0x20000140); NONFAILING(memcpy((void*)0x20000140, "\xc9\x9a\xb6\x04\xeb\x2e\x44\xeb\xf7\xbf\xb7\xb0\x4c\x08\x43\x21\xa3\x0f\x43\x51\xae\xb0\x67\x6b\xb2\x1a\xef\xc3\xbc\x23\x22\xd9\x9a\x5b\x03\x4f\x88\x0a\xa2\x5d\x61\xae\x40\x76\x39\x7c\x30\x35\x7b\x22\xcc\xb7\x79\xeb\xd3\x20\x6a\xc6\x48\xfa\xb9\x08\x36\xdd\x4d\x9e\x73\xdc\x3c\x07\x72\x70\xb5\x7d\xc3\x22\x22\x84\xdd\x3c\xae\x47\x37\x95\x7d\x94\x7d\x76\x5a\x5e\x0e\x91\x9c\xbd\x3e\xf2\xd3\xd9\x52\x2a\x82\x7f\x3f\xe6\x0d\xdc", 106)); NONFAILING(*(uint64_t*)0x200002f8 = 0x6a); NONFAILING(*(uint64_t*)0x20000300 = 0x200001c0); NONFAILING(memcpy((void*)0x200001c0, "\x2b\xc5\xa9\xfd\x6c\xc3\x45\x00\x82\x40\x5a\xb6\x07\xa0\xf5\x62\x7b\x40\x58\x9a\x69\x0a\xc5\x91\x58\xac\xf1\x0f\x2a\x1c\xc4\x61\x52\xfa\x5f\x49\x3a\x85\x99\xcc\x6e\xaa\xb5\xd9\x69\x68\xbe\xf1\xa2\x7f\x62\xda\xcf\x64\xd0\x6c\x80\xcf\xb5\xb3\x20\xb9\x77\xc9\x43\x2c\x44\x6f\xa6\xf6\x55\x14\x44\xee\x4c\x59\x98\x85\x32\x60\xd6\x5d\x2c\xb3\xc7\x78\xf4\x4f\xe2\x70\x36\x3b\x4e\xb3\x09\xe2\x4f\xc4\x77\x97\xb5\xbd\x45\x4b\xf4\xd3\xd4\x65\x6f\xa0\x78\xff\x56\xb3\x0f\x4f\x0e\x9d\x5e\x6e\x89\x43\x83\x0a\xd6\xd3\x42\x96\x8c\x22\x4f\x7c\x35\xaf\x01\xa6\x1d\x10\xe1\x55\xfe\xe7\xe0\x22\x7c\xd7\x9a\x79\x77\xb3\xf4\x03\x51\xca\x01\x83\x48\x40\xab\xba\x55\x7d\x36\xbc\x8a\x42\x08\xf9\x0d\xc5\xf5\x1e\x3f\x3d\x44\x5c\x5f\xee\xa7\x93\x68\x16\x4e\xde\xf0\x5d\x24\x74\x8c\xe9\xf0\xa5\x84\x51\xb4\x3d\x98\x91\x90\x2b\xc4\x5e\xc6\x7d\x00\xdf\x1d\xeb\x74\xe6\x5b\x29\xc0\xd0\x95\xdb\xdd\x5b\x9a\x7c", 220)); NONFAILING(*(uint64_t*)0x20000308 = 0xdc); syscall(SYS_writev, r[0], 0x200002c0ul, 5ul); break; case 2: NONFAILING(*(uint32_t*)0x20000340 = 0); NONFAILING(*(uint32_t*)0x20000344 = -1); NONFAILING(*(uint32_t*)0x20000348 = 0); res = syscall(SYS_getgroups, 3ul, 0x20000340ul); if (res != -1) NONFAILING(r[1] = *(uint32_t*)0x20000348); break; case 3: NONFAILING(*(uint32_t*)0x200003c0 = 0xc); res = syscall(SYS_getsockopt, -1, 0xffff, 0x11, 0x20000380ul, 0x200003c0ul); if (res != -1) NONFAILING(r[2] = *(uint32_t*)0x20000388); break; case 4: syscall(SYS_setregid, r[1], r[2]); break; case 5: res = syscall(SYS_semget, 0x798e2634ul, 0ul, 0xb2603d964b180ce8ul); if (res != -1) r[3] = res; break; case 6: NONFAILING(memcpy((void*)0x20000400, "./file0\000", 8)); res = syscall(SYS_stat, 0x20000400ul, 0x20000440ul); if (res != -1) NONFAILING(r[4] = *(uint32_t*)0x2000045c); break; case 7: res = syscall(SYS_getgid); if (res != -1) r[5] = res; break; case 8: NONFAILING(*(uint32_t*)0x20000500 = 0xfffff834); NONFAILING(*(uint32_t*)0x20000504 = r[4]); NONFAILING(*(uint32_t*)0x20000508 = r[5]); NONFAILING(*(uint32_t*)0x2000050c = -1); NONFAILING(*(uint32_t*)0x20000510 = 0); NONFAILING(*(uint32_t*)0x20000514 = 3); NONFAILING(*(uint16_t*)0x20000518 = 9); NONFAILING(*(uint16_t*)0x2000051a = 0); NONFAILING(*(uint64_t*)0x20000520 = 0); NONFAILING(*(uint64_t*)0x20000528 = 0); NONFAILING(*(uint64_t*)0x20000530 = 0xfffffffffffffffd); NONFAILING(*(uint64_t*)0x20000538 = 0x4535); NONFAILING(*(uint64_t*)0x20000540 = 2); NONFAILING(*(uint64_t*)0x20000548 = 0); NONFAILING(*(uint64_t*)0x20000550 = 0); syscall(SYS_semctl, r[3], 0ul, 1ul, 0x20000500ul); break; case 9: syscall(SYS_seteuid, 0); break; case 10: NONFAILING(memcpy((void*)0x20000000, "\xbf\x5b\xc2\xc4\xdd\xcd\x9b\xaa\x7f\x7c\x66\xf9\x17\x26\xa8\xc4\x90\xf6\x91\x85\x14\x0b\x5b\x42\x51\xe8\x67\x01\xc6\xc5\xa6\x0d\x84\x80\x2d\x38\x2a\x0c\x38\xdf\x4a\x28\xfd\x84\x0d\x7e\x14\x06\xa5\xc2\xeb\x5d\x3b\x6b\xc3\x23\xbd\x49\x38\x6c\x4a\x92\x49\x50\x31\x4f\xe6\x17\xf8\xcd\x34\x37\xa4\xaa\x6d\x1c\x6d\x62\x64\x03\x09\xf9\xde\x23\x93\x99\x9b\x11\x47\x68\xd5\x10\xd7\x34\xfd\x72\xd1\x98\xb2\x61\xbd\x61\x81\x14\xbf\x3f\xa3\xe2\xfe\x84\xff\xe6\x5c\x80\xe4\x72\x12\xc4\x9e\x47\xbb\x3a\xaa\x86\x89\x46\x2f\x21\xd5\x18\x80\xd9\x7c\xb4\x45\xd3", 136)); break; case 11: NONFAILING(memcpy((void*)0x200000c0, "\xc4\xa1\x84\x58\x2c\xaa\x26\x44\x0f\xae\x04\xc4\x41\x0f\x74\xab\x00\x00\x01\x00\xc4\x23\xf5\x78\x4c\xe9\x9d\x40\x44\xdf\x34\x59\x26\x41\x0f\xae\x41\x01\x64\x64\x66\x44\x0f\xe5\xb9\x4e\x9a\xb0\xc4\xc4\x22\x7d\x47\x0f\x41\x0f\x45\x7f\x56\x66\x0f\xdd\xe8", 63)); syz_execute_func(0x200000c0); break; case 12: break; case 13: NONFAILING(memcpy((void*)0x20000140, "\x64\xd3\x2f\x16\xeb\xd8\x17\xd0\x04\xdc\xb8\x01\x71\x82\x05\xbc\xa1\xd8\x6d\xad\x3c\xb1\x32\xa2\x86\x60\x92\x14\xb7\x39\x5a\x97\xa0\xe8\xfe\xda\x5f\xad\x02\xcc\xe9\xde\xea\x94\xd5\x5a\x75\x0c\x17\xb2\x34\x07\x50\x02\xb9\xdf\x62\x9f\xa6\x8e\x3f\x7d\xa9\x7e\x9c\x2a\x2e\x0a\x95\xd1\x5d\x35\x95\x61\xb1\x47\x74\x40\x34\x2c\xd7\x9c\x7c\xeb\xd6\xbf\x00\x8a\xcd\x1c\x7f\xf1\x46\xa6\xfe\x22\x01\x36\x61\xd8\xc8\xce\x8e\xb1\x7f\x5c\xf3\x89\x2a\xe0\x8b\xba\x46\x54\x5b\x2b\x69\x0a\xb7\xe0\x36\x8a\xec\x4d\x32\xb7\x6d\x7f\xc1\x5d\xd7\xc2\xab\xa1\x84\xd4\x1a\x5e\x5a\xbb\x8d\x71\x6f\x5e\x64\x5e\x17\x67\x13\x8e\xd7\x38\xf3\x15\x79\x5a\xc9\x9e\x22\xfd\x44\xdb\x06\x09\x63\x13\xf4\x72\x9c\xe0\xd3\xbd\x93\x8f\x5b\x65\x20\xef\x93\x76\xfa\x90\x9d\xf6\xb2\x05\xc2\xd3\xf5\x2e\xe4\x3e\x3f\x59\xea\x44\x1b\x7c\x4e\x4d\x5c", 201)); NONFAILING(memcpy((void*)0x20000240, "\xc1\xb0\x1d\x40\x73\x99\x35\xb1\x21\x7d\x0e\x39\x3c\xdd\x4f\xa4\xef\x8b\xbd\x99\x57\xee\x99\x68\x77\xe4\xca\x15\x5c\x19\x5d\xc1\x66\xf9\x48\x6a\xc4\xdb\x17\xf7\x54\xc4\x89\x38\xa4\x34\x19\xf0\x82\xa8\xc3\x0e\xff\xbe\xf0\x64\xf6\xc8\xb8\x7b\xc9\x30\xe4\x39\xc7\x19\xec\x0a\x11\x99\x04\x0b\x86\x28\x6d\x27\x1f\x25\xaf\x26\xeb\xed\x3f\x55\xc3\x2e\x68\xac\x70\x33\x0d\xf7\x69\x31\xbf\x55\xfa\xe8\x80\x25\x6b\x74\xa9\x23\xf8\xa3\x02\x2c\x31\x0f\x94\xcc\x0c\x62\x33\x02\xa5\xd1\x4b\x3f\x8e\x18\xf4\x15\x99\x88\x28\x66\xea\x02\x42\x86\x4b\x37\xd5\xae\x87\xfb\xcb\x74\x5c\x3e\x26\x42\x3d\x05\xc5\x48\x38\x33\xdf\xcd\xd4\x3d\xc0\xc6\x50\x73\x29\x03\x72\x73\xde\x28\x2e\x3a\x16\xac\x00\xc5\x53\x9c\x30\x94\x63\x98\x4b\x15\x3e\xc6\x25\x0a\x78\x19\x75\xa2\x77\x01\x72\x80\xdb\x1e\x9c\x18\xce\x66\x4d\xf5\x94\x7c\x6c\x18\xbe\xf2\x36\x7e\x61\x63\xb4\x6b\x95\x03\xf7\x00\x70\x5f\xd0\xe8\x9e\xae\x6d\xf0\x88\x4b\xf2\x7c\x00\xe0\x5f\xc5\xef\xc6\x49\x07", 234)); syz_usb_connect(0, 0xc9, 0x20000140, 0x20000240); break; case 14: NONFAILING(memcpy((void*)0x20000340, "\x36\x4f\xb1\xa4\x17\x26\x3d\xe2\x27\x97\xec\x76\x08\x61\xf3\x85\x2c\xf2\x4f\x79\xe2\xb7\xa5\xc6\x2a\xfa\xd7\xd6\xd4\xd0\x9d\x86\x2f\x8e\xcc\xd0\x2e\x1b\xb9\x89\xe0\xf8\xa8\xad\x91\x54\x42\x01\x64\x04\xc9\x82\x6a\x5c\x0a\x28\x4f\xc7\xa8\x40\x30\x47\x59\xb6\x84\xf3\x57\xb2\xe6\xfe\xcf\xb3\xcc\x81\x57\xc0\x08\xff\x0d\xcf\xf2\x10\x89\x84\x54\x8a\x2a\xd6\x95\xfa\xd9\x51\x2f\x06\xfd\x12\xd6\x6b\xc4\x43\x04\x75\x12\xab\x4e\xf3\x05\x8a\xe6\xc0\xc6\xec\x3f\xd6\x27\xe3\x70\xa1\x51\xae\x71\x9b\x8e\x3a\x77\xd6\x82\xdc\x06\xa9\x3b\xe9\xc2\xaa\x80\x18\xb5\x8a\x94\x92\xcb\x39\x03\x1b\xb5\xab\xf3\x12\x4e\xaa\xb8\x53\x30\xf1\x81\xfc\xcc\xa7\x59\x7b\x4e\xc0\x87\x9f\xcb\xcf\x51\x14\x3f\x98\xc4\x43\xc1\x67\x20\xa6\xe0\x1b\x7e\x07\xdf\x47\x27\xe2\x88\xe1\x3d\xcc\x0b\x7e\x11", 191)); NONFAILING(memcpy((void*)0x20000400, "\x59\x03\x92\x3c\x7a\x1b\x28\x38\xf3\xc1\x21\x56\x78\x5a\x11\xc8\x1b\x2e\x82\xd9\xa1\x19\x0e\x1b\x9c\x45\x97\x6a\x91\x7c\x00\x29\x4d\xc9\x4d\x53\x54\xe8\xc5\xd6\xa4\xe8\x98\x6d\xa0\x74\xeb\x46\x1e\xd0\x73\x6b\xcb\xed\xe2\xce\xf1\xf1\x9e\x02\x16\xc0\x9e\xb7\x94\xd8\xb9\x75\x4f\xea\x26\xf1\x10\xc8\x32\x48\xc2\x86\xea\xa0\x5a\x69\x84\x4e\xb1\x29\x2f\x59\x4f\x59\xf6\xc9\xbe\xca\x47\xd8\x94\xd4\x4d\xfd\x15\xff\x81\xb7\x6b\x46\x35\x39\x2e\xb5\xed\x43\x1c\xa3\x09\x22\x30", 117)); res = syz_usb_connect(4, 0xbf, 0x20000340, 0x20000400); if (res != -1) r[6] = res; break; case 15: syz_usb_disconnect(r[6]); break; } } int main(void) { syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 3ul, 0x1012ul, -1, 0ul, 0ul); install_segv_handler(); use_temporary_dir(); do_sandbox_none(); return 0; } :214:2: error: unknown type name 'uint8_t_t' :215:2: error: unknown type name 'uint8_t_t' :216:2: error: unknown type name 'uint8_t_t' :217:2: error: unknown type name 'uint8_t_t' :218:2: error: unknown type name 'uint16_t_t' :219:2: error: unknown type name 'uint8_t_t' :220:2: error: unknown type name 'uint8_t_t' :221:2: error: unknown type name 'uint8_t_t' :225:2: error: unknown type name 'uint8_t_t' :226:2: error: unknown type name 'uint8_t_t' :227:2: error: unknown type name 'uint16_t_t' :228:2: error: unknown type name 'uint8_t_t' :229:2: error: unknown type name 'uint8_t_t' :230:2: error: unknown type name 'uint8_t_t' :231:2: error: unknown type name 'uint8_t_t' :232:2: error: unknown type name 'uint16_t_t' :233:2: error: unknown type name 'uint16_t_t' :234:2: error: unknown type name 'uint16_t_t' :235:2: error: unknown type name 'uint8_t_t' :236:2: error: unknown type name 'uint8_t_t' :237:2: error: unknown type name 'uint8_t_t' :238:2: error: unknown type name 'uint8_t_t' :242:2: error: unknown type name 'uint8_t_t' :243:2: error: unknown type name 'uint8_t_t' :244:2: error: unknown type name 'uint16_t_t' :245:2: error: unknown type name 'uint8_t_t' :246:2: error: unknown type name 'uint8_t_t' :247:2: error: unknown type name 'uint8_t_t' :248:2: error: unknown type name 'uint8_t_t' :249:2: error: unknown type name 'uint8_t_t' :253:2: error: unknown type name 'uint8_t_t' :254:2: error: unknown type name 'uint8_t_t' :255:2: error: unknown type name 'uint8_t_t' :256:2: error: unknown type name 'uint8_t_t' :257:2: error: unknown type name 'uint8_t_t' :258:2: error: unknown type name 'uint8_t_t' :259:2: error: unknown type name 'uint8_t_t' :260:2: error: unknown type name 'uint8_t_t' :261:2: error: unknown type name 'uint8_t_t' :265:2: error: unknown type name 'uint8_t_t' :266:2: error: unknown type name 'uint8_t_t' :267:2: error: unknown type name 'uint16_t_t' :268:2: error: unknown type name 'uint16_t_t' :269:2: error: unknown type name 'uint16_t_t' :273:2: error: unknown type name 'uint8_t_t' :274:2: error: unknown type name 'uint8_t_t' :275:2: error: unknown type name 'uint16_t_t' :276:2: error: unknown type name 'uint8_t_t' :277:2: error: unknown type name 'uint8_t_t' :278:2: error: unknown type name 'uint8_t_t' :279:2: error: unknown type name 'uint8_t_t' :280:2: error: unknown type name 'uint8_t_t' :281:2: error: unknown type name 'uint8_t_t' : In function 'vhci_usb_recv': :588:2: error: unknown type name 'uint8_t_t'; did you mean 'uint8_t'? :588:20: error: 'uint8_t_t' undeclared (first use in this function); did you mean 'uint8_t'? :588:20: note: each undeclared identifier is reported only once for each function it appears in :588:30: error: expected expression before ')' token : In function 'vhci_usb_send': :603:2: error: unknown type name 'uint8_t_t'; did you mean 'uint8_t'? :603:20: error: 'uint8_t_t' undeclared (first use in this function); did you mean 'uint8_t'? :603:30: error: expected expression before ')' token : In function 'syz_usb_connect_impl': :664:77: error: unknown type name 'usb_ctrlrequest' :57:110: note: in definition of macro 'NONFAILING' :669:55: error: unknown type name 'usb_ctrlrequest' :681:8: error: 'uint32_t_t' undeclared (first use in this function); did you mean 'uint32_t'? At top level: :729:13: error: 'setup_usb' defined but not used [-Werror=unused-function] cc1: all warnings being treated as errors compiler invocation: /syzkaller/netbsd/src/../tools/bin/x86_64--netbsd-g++ [-o /tmp/syz-executor480526986 -DGOOS_netbsd=1 -DGOARCH_amd64=1 -DHOSTGOOS_linux=1 -x c - -m64 --sysroot /syzkaller/netbsd/src/../dest/ -O2 -pthread -Wall -Werror -Wparentheses -Wframe-larger-than=16384] --- FAIL: TestGenerate/netbsd/amd64/6 (0.52s) csource_test.go:123: opts: {Threaded:true Collide:false Repeat:true RepeatTimes:0 Procs:4 Sandbox:none Fault:false FaultCall:0 FaultNth:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false USB:false UseTmpDir:true HandleSegv:false Repro:false Trace:false} program: r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c) writev(r0, &(0x7f00000002c0)=[{&(0x7f0000000000)="25c5f6768692f16a6b02337bc5f24e95c2e574f7bd23da78ff2241439caced122e33ab16d377843415781fa508cd635f2fd04113204ed9bda7396e99a38a2f10e9c7398b5a64c49d98664bd14975be7076a83638a7da3095f0e027bd161ccd5c994f8b31d535a3ce4c57812d9682f3ebb10e05a7142210515b668d1357d91aaabb6ad88aed6b9f2143d062e0b5", 0x8d}, {&(0x7f00000000c0)="e8987e8f864e9d38b55615b659d14cae9e91a9532213ffb465b61b", 0x1b}, {&(0x7f0000000100)="3f97992c940fba8936a6b4", 0xb}, {&(0x7f0000000140)="c99ab604eb2e44ebf7bfb7b04c084321a30f4351aeb0676bb21aefc3bc2322d99a5b034f880aa25d61ae4076397c30357b22ccb779ebd3206ac648fab90836dd4d9e73dc3c077270b57dc3222284dd3cae4737957d947d765a5e0e919cbd3ef2d3d9522a827f3fe60ddc", 0x6a}, {&(0x7f00000001c0)="2bc5a9fd6cc3450082405ab607a0f5627b40589a690ac59158acf10f2a1cc46152fa5f493a8599cc6eaab5d96968bef1a27f62dacf64d06c80cfb5b320b977c9432c446fa6f6551444ee4c5998853260d65d2cb3c778f44fe270363b4eb309e24fc47797b5bd454bf4d3d4656fa078ff56b30f4f0e9d5e6e8943830ad6d342968c224f7c35af01a61d10e155fee7e0227cd79a7977b3f40351ca01834840abba557d36bc8a4208f90dc5f51e3f3d445c5feea79368164edef05d24748ce9f0a58451b43d9891902bc45ec67d00df1deb74e65b29c0d095dbdd5b9a7c", 0xdc}], 0x5) getgroups(0x3, &(0x7f0000000340)=[0x0, 0xffffffffffffffff, 0x0]) getsockopt$sock_cred(0xffffffffffffffff, 0xffff, 0x11, &(0x7f0000000380)={0x0, 0x0, 0x0}, &(0x7f00000003c0)=0xc) setregid(r1, r2) r3 = semget(0x1, 0x0, 0xb2603d964b180ce8) stat(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0}) r5 = getgid() semctl$IPC_SET(r3, 0x0, 0x1, &(0x7f0000000500)={{0xfffff834, r4, r5, 0xffffffffffffffff, 0x0, 0x3, 0x9}, 0xfffffffffffffffd, 0x4535, 0x2}) seteuid(0x0) syz_emit_ethernet(0x88, &(0x7f0000000000)="bf5bc2c4ddcd9baa7f7c66f91726a8c490f69185140b5b4251e86701c6c5a60d84802d382a0c38df4a28fd840d7e1406a5c2eb5d3b6bc323bd49386c4a924950314fe617f8cd3437a4aa6d1c6d62640309f9de2393999b114768d510d734fd72d198b261bd618114bf3fa3e2fe84ffe65c80e47212c49e47bb3aaa8689462f21d51880d97cb445d3") syz_execute_func(&(0x7f00000000c0)="c4a184582caa26440fae04c4410f74ab00000100c423f5784ce99d4044df345926410fae4101646466440fe5b94e9ab0c4c4227d470f410f457f56660fdde8") syz_extract_tcp_res(&(0x7f0000000100), 0x6, 0x1) syz_usb_connect(0x0, 0xc9, &(0x7f0000000140)="64d32f16ebd817d004dcb801718205bca1d86dad3cb132a286609214b7395a97a0e8feda5fad02cce9deea94d55a750c17b234075002b9df629fa68e3f7da97e9c2a2e0a95d15d359561b1477440342cd79c7cebd6bf008acd1c7ff146a6fe22013661d8c8ce8eb17f5cf3892ae08bba46545b2b690ab7e0368aec4d32b76d7fc15dd7c2aba184d41a5e5abb8d716f5e645e1767138ed738f315795ac99e22fd44db06096313f4729ce0d3bd938f5b6520ef9376fa909df6b205c2d3f52ee43e3f59ea441b7c4e4d5c", &(0x7f0000000240)="c1b01d40739935b1217d0e393cdd4fa4ef8bbd9957ee996877e4ca155c195dc166f9486ac4db17f754c48938a43419f082a8c30effbef064f6c8b87bc930e439c719ec0a1199040b86286d271f25af26ebed3f55c32e68ac70330df76931bf55fae880256b74a923f8a3022c310f94cc0c623302a5d14b3f8e18f41599882866ea0242864b37d5ae87fbcb745c3e26423d05c5483833dfcdd43dc0c6507329037273de282e3a16ac00c5539c309463984b153ec6250a781975a277017280db1e9c18ce664df5947c6c18bef2367e6163b46b9503f700705fd0e89eae6df0884bf27c00e05fc5efc64907") r6 = syz_usb_connect(0x4, 0xbf, &(0x7f0000000340)="364fb1a417263de22797ec760861f3852cf24f79e2b7a5c62afad7d6d4d09d862f8eccd02e1bb989e0f8a8ad915442016404c9826a5c0a284fc7a840304759b684f357b2e6fecfb3cc8157c008ff0dcff2108984548a2ad695fad9512f06fd12d66bc443047512ab4ef3058ae6c0c6ec3fd627e370a151ae719b8e3a77d682dc06a93be9c2aa8018b58a9492cb39031bb5abf3124eaab85330f181fccca7597b4ec0879fcbcf51143f98c443c16720a6e01b7e07df4727e288e13dcc0b7e11", &(0x7f0000000400)="5903923c7a1b2838f3c12156785a11c81b2e82d9a1190e1b9c45976a917c00294dc94d5354e8c5d6a4e8986da074eb461ed0736bcbede2cef1f19e0216c09eb794d8b9754fea26f110c83248c286eaa05a69844eb1292f594f59f6c9beca47d894d44dfd15ff81b76b4635392eb5ed431ca3092230") syz_usb_disconnect(r6) csource_test.go:124: failed to build program: // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include static unsigned long long procid; static void kill_and_wait(int pid, int* status) { kill(pid, SIGKILL); while (waitpid(-1, status, 0) != pid) { } } static void sleep_ms(uint64_t ms) { usleep(ms * 1000); } static uint64_t current_time_ms(void) { struct timespec ts; if (clock_gettime(CLOCK_MONOTONIC, &ts)) exit(1); return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; } static void use_temporary_dir(void) { char tmpdir_template[] = "./syzkaller.XXXXXX"; char* tmpdir = mkdtemp(tmpdir_template); if (!tmpdir) exit(1); if (chmod(tmpdir, 0777)) exit(1); if (chdir(tmpdir)) exit(1); } static void remove_dir(const char* dir) { DIR* dp; struct dirent* ep; dp = opendir(dir); if (dp == NULL) exit(1); while ((ep = readdir(dp))) { if (strcmp(ep->d_name, ".") == 0 || strcmp(ep->d_name, "..") == 0) continue; char filename[FILENAME_MAX]; snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name); struct stat st; if (lstat(filename, &st)) exit(1); if (S_ISDIR(st.st_mode)) { remove_dir(filename); continue; } if (unlink(filename)) exit(1); } closedir(dp); if (rmdir(dir)) exit(1); } static void thread_start(void* (*fn)(void*), void* arg) { pthread_t th; pthread_attr_t attr; pthread_attr_init(&attr); pthread_attr_setstacksize(&attr, 128 << 10); int i; for (i = 0; i < 100; i++) { if (pthread_create(&th, &attr, fn, arg) == 0) { pthread_attr_destroy(&attr); return; } if (errno == EAGAIN) { usleep(50); continue; } break; } exit(1); } typedef struct { pthread_mutex_t mu; pthread_cond_t cv; int state; } event_t; static void event_init(event_t* ev) { if (pthread_mutex_init(&ev->mu, 0)) exit(1); if (pthread_cond_init(&ev->cv, 0)) exit(1); ev->state = 0; } static void event_reset(event_t* ev) { ev->state = 0; } static void event_set(event_t* ev) { pthread_mutex_lock(&ev->mu); if (ev->state) exit(1); ev->state = 1; pthread_mutex_unlock(&ev->mu); pthread_cond_broadcast(&ev->cv); } static void event_wait(event_t* ev) { pthread_mutex_lock(&ev->mu); while (!ev->state) pthread_cond_wait(&ev->cv, &ev->mu); pthread_mutex_unlock(&ev->mu); } static int event_isset(event_t* ev) { pthread_mutex_lock(&ev->mu); int res = ev->state; pthread_mutex_unlock(&ev->mu); return res; } static int event_timedwait(event_t* ev, uint64_t timeout) { uint64_t start = current_time_ms(); uint64_t now = start; pthread_mutex_lock(&ev->mu); for (;;) { if (ev->state) break; uint64_t remain = timeout - (now - start); struct timespec ts; ts.tv_sec = remain / 1000; ts.tv_nsec = (remain % 1000) * 1000 * 1000; pthread_cond_timedwait(&ev->cv, &ev->mu, &ts); now = current_time_ms(); if (now - start > timeout) break; } int res = ev->state; pthread_mutex_unlock(&ev->mu); return res; } /* -------------------------------------------------------------------------- */ /* * Redefinitions to match the linux types used in common_usb.h. */ struct usb_endpoint_descriptor { uint8_t_t bLength; uint8_t_t bDescriptorType; uint8_t_t bEndpointAddress; uint8_t_t bmAttributes; uint16_t_t wMaxPacketSize; uint8_t_t bInterval; uint8_t_t bRefresh; uint8_t_t bSynchAddress; } __attribute__((packed)); struct usb_device_descriptor { uint8_t_t bLength; uint8_t_t bDescriptorType; uint16_t_t bcdUSB; uint8_t_t bDeviceClass; uint8_t_t bDeviceSubClass; uint8_t_t bDeviceProtocol; uint8_t_t bMaxPacketSize0; uint16_t_t idVendor; uint16_t_t idProduct; uint16_t_t bcdDevice; uint8_t_t iManufacturer; uint8_t_t iProduct; uint8_t_t iSerialNumber; uint8_t_t bNumConfigurations; } __attribute__((packed)); struct usb_config_descriptor { uint8_t_t bLength; uint8_t_t bDescriptorType; uint16_t_t wTotalLength; uint8_t_t bNumInterfaces; uint8_t_t bConfigurationValue; uint8_t_t iConfiguration; uint8_t_t bmAttributes; uint8_t_t bMaxPower; } __attribute__((packed)); struct usb_interface_descriptor { uint8_t_t bLength; uint8_t_t bDescriptorType; uint8_t_t bInterfaceNumber; uint8_t_t bAlternateSetting; uint8_t_t bNumEndpoints; uint8_t_t bInterfaceClass; uint8_t_t bInterfaceSubClass; uint8_t_t bInterfaceProtocol; uint8_t_t iInterface; } __attribute__((packed)); struct usb_ctrlrequest { uint8_t_t bRequestType; uint8_t_t bRequest; uint16_t_t wValue; uint16_t_t wIndex; uint16_t_t wLength; } __attribute__((packed)); struct usb_qualifier_descriptor { uint8_t_t bLength; uint8_t_t bDescriptorType; uint16_t_t bcdUSB; uint8_t_t bDeviceClass; uint8_t_t bDeviceSubClass; uint8_t_t bDeviceProtocol; uint8_t_t bMaxPacketSize0; uint8_t_t bNumConfigurations; uint8_t_t bRESERVED; } __attribute__((packed)); #define USB_TYPE_MASK (0x03 << 5) #define USB_TYPE_STANDARD (0x00 << 5) #define USB_TYPE_CLASS (0x01 << 5) #define USB_TYPE_VENDOR (0x02 << 5) #define USB_TYPE_RESERVED (0x03 << 5) #define USB_DT_DEVICE 0x01 #define USB_DT_CONFIG 0x02 #define USB_DT_STRING 0x03 #define USB_DT_INTERFACE 0x04 #define USB_DT_ENDPOINT 0x05 #define USB_DT_DEVICE_QUALIFIER 0x06 #define USB_DT_OTHER_SPEED_CONFIG 0x07 #define USB_DT_INTERFACE_POWER 0x08 #define USB_DT_OTG 0x09 #define USB_DT_DEBUG 0x0a #define USB_DT_INTERFACE_ASSOCIATION 0x0b #define USB_DT_SECURITY 0x0c #define USB_DT_KEY 0x0d #define USB_DT_ENCRYPTION_TYPE 0x0e #define USB_DT_BOS 0x0f #define USB_DT_DEVICE_CAPABILITY 0x10 #define USB_DT_WIRELESS_ENDPOINT_COMP 0x11 #define USB_DT_WIRE_ADAPTER 0x21 #define USB_DT_RPIPE 0x22 #define USB_DT_CS_RADIO_CONTROL 0x23 #define USB_DT_PIPE_USAGE 0x24 #define USB_DT_SS_ENDPOINT_COMP 0x30 #define USB_DT_SSP_ISOC_ENDPOINT_COMP 0x31 #define USB_REQ_GET_STATUS 0x00 #define USB_REQ_CLEAR_FEATURE 0x01 #define USB_REQ_SET_FEATURE 0x03 #define USB_REQ_SET_ADDRESS 0x05 #define USB_REQ_GET_DESCRIPTOR 0x06 #define USB_REQ_SET_DESCRIPTOR 0x07 #define USB_REQ_GET_CONFIGURATION 0x08 #define USB_REQ_SET_CONFIGURATION 0x09 #define USB_REQ_GET_INTERFACE 0x0A #define USB_REQ_SET_INTERFACE 0x0B #define USB_REQ_SYNCH_FRAME 0x0C #define USB_REQ_SET_SEL 0x30 #define USB_REQ_SET_ISOCH_DELAY 0x31 #define USB_REQ_SET_ENCRYPTION 0x0D #define USB_REQ_GET_ENCRYPTION 0x0E #define USB_REQ_RPIPE_ABORT 0x0E #define USB_REQ_SET_HANDSHAKE 0x0F #define USB_REQ_RPIPE_RESET 0x0F #define USB_REQ_GET_HANDSHAKE 0x10 #define USB_REQ_SET_CONNECTION 0x11 #define USB_REQ_SET_SECURITY_DATA 0x12 #define USB_REQ_GET_SECURITY_DATA 0x13 #define USB_REQ_SET_WUSB_DATA 0x14 #define USB_REQ_LOOPBACK_DATA_WRITE 0x15 #define USB_REQ_LOOPBACK_DATA_READ 0x16 #define USB_REQ_SET_INTERFACE_DS 0x17 #define USB_REQ_GET_PARTNER_PDO 20 #define USB_REQ_GET_BATTERY_STATUS 21 #define USB_REQ_SET_PDO 22 #define USB_REQ_GET_VDM 23 #define USB_REQ_SEND_VDM 24 #define USB_MAX_IFACE_NUM 4 #define USB_MAX_EP_NUM 32 #define USB_MAX_FDS 6 struct usb_endpoint_index { struct usb_endpoint_descriptor desc; int handle; }; struct usb_iface_index { struct usb_interface_descriptor* iface; uint8_t bInterfaceNumber; uint8_t bAlternateSetting; uint8_t bInterfaceClass; struct usb_endpoint_index eps[USB_MAX_EP_NUM]; int eps_num; }; struct usb_device_index { struct usb_device_descriptor* dev; struct usb_config_descriptor* config; uint8_t bDeviceClass; uint8_t bMaxPower; int config_length; struct usb_iface_index ifaces[USB_MAX_IFACE_NUM]; int ifaces_num; int iface_cur; }; struct usb_info { int fd; struct usb_device_index index; }; static struct usb_info usb_devices[USB_MAX_FDS]; static int usb_devices_num; static bool parse_usb_descriptor(const char* buffer, size_t length, struct usb_device_index* index) { if (length < sizeof(*index->dev) + sizeof(*index->config)) return false; memset(index, 0, sizeof(*index)); index->dev = (struct usb_device_descriptor*)buffer; index->config = (struct usb_config_descriptor*)(buffer + sizeof(*index->dev)); index->bDeviceClass = index->dev->bDeviceClass; index->bMaxPower = index->config->bMaxPower; index->config_length = length - sizeof(*index->dev); index->iface_cur = -1; size_t offset = 0; while (true) { if (offset + 1 >= length) break; uint8_t desc_length = buffer[offset]; uint8_t desc_type = buffer[offset + 1]; if (desc_length <= 2) break; if (offset + desc_length > length) break; if (desc_type == USB_DT_INTERFACE && index->ifaces_num < USB_MAX_IFACE_NUM) { struct usb_interface_descriptor* iface = (struct usb_interface_descriptor*)(buffer + offset); index->ifaces[index->ifaces_num].iface = iface; index->ifaces[index->ifaces_num].bInterfaceNumber = iface->bInterfaceNumber; index->ifaces[index->ifaces_num].bAlternateSetting = iface->bAlternateSetting; index->ifaces[index->ifaces_num].bInterfaceClass = iface->bInterfaceClass; index->ifaces_num++; } if (desc_type == USB_DT_ENDPOINT && index->ifaces_num > 0) { struct usb_iface_index* iface = &index->ifaces[index->ifaces_num - 1]; if (iface->eps_num < USB_MAX_EP_NUM) { memcpy(&iface->eps[iface->eps_num].desc, buffer + offset, sizeof(iface->eps[iface->eps_num].desc)); iface->eps_num++; } } offset += desc_length; } return true; } static struct usb_device_index* add_usb_index(int fd, const char* dev, size_t dev_len) { int i = __atomic_fetch_add(&usb_devices_num, 1, __ATOMIC_RELAXED); if (i >= USB_MAX_FDS) return NULL; int rv = 0; rv = parse_usb_descriptor(dev, dev_len, &usb_devices[i].index); if (!rv) return NULL; __atomic_store_n(&usb_devices[i].fd, fd, __ATOMIC_RELEASE); return &usb_devices[i].index; } static struct usb_device_index* lookup_usb_index(int fd) { int i; for (i = 0; i < USB_MAX_FDS; i++) { if (__atomic_load_n(&usb_devices[i].fd, __ATOMIC_ACQUIRE) == fd) { return &usb_devices[i].index; } } return NULL; } struct vusb_connect_string_descriptor { uint32_t len; char* str; } __attribute__((packed)); struct vusb_connect_descriptors { uint32_t qual_len; char* qual; uint32_t bos_len; char* bos; uint32_t strs_len; struct vusb_connect_string_descriptor strs[0]; } __attribute__((packed)); static const char default_string[] = { 8, USB_DT_STRING, 's', 0, 'y', 0, 'z', 0 }; static const char default_lang_id[] = { 4, USB_DT_STRING, 0x09, 0x04 }; static bool lookup_connect_response_in(int fd, const struct vusb_connect_descriptors* descs, const struct usb_ctrlrequest* ctrl, char** response_data, uint32_t* response_length) { struct usb_device_index* index = lookup_usb_index(fd); uint8_t str_idx; if (!index) return false; switch (ctrl->bRequestType & USB_TYPE_MASK) { case USB_TYPE_STANDARD: switch (ctrl->bRequest) { case USB_REQ_GET_DESCRIPTOR: switch (ctrl->wValue >> 8) { case USB_DT_DEVICE: *response_data = (char*)index->dev; *response_length = sizeof(*index->dev); return true; case USB_DT_CONFIG: *response_data = (char*)index->config; *response_length = index->config_length; return true; case USB_DT_STRING: str_idx = (uint8_t)ctrl->wValue; if (descs && str_idx < descs->strs_len) { *response_data = descs->strs[str_idx].str; *response_length = descs->strs[str_idx].len; return true; } if (str_idx == 0) { *response_data = (char*)&default_lang_id[0]; *response_length = default_lang_id[0]; return true; } *response_data = (char*)&default_string[0]; *response_length = default_string[0]; return true; case USB_DT_BOS: *response_data = descs->bos; *response_length = descs->bos_len; return true; case USB_DT_DEVICE_QUALIFIER: if (!descs->qual) { struct usb_qualifier_descriptor* qual = (struct usb_qualifier_descriptor*)response_data; qual->bLength = sizeof(*qual); qual->bDescriptorType = USB_DT_DEVICE_QUALIFIER; qual->bcdUSB = index->dev->bcdUSB; qual->bDeviceClass = index->dev->bDeviceClass; qual->bDeviceSubClass = index->dev->bDeviceSubClass; qual->bDeviceProtocol = index->dev->bDeviceProtocol; qual->bMaxPacketSize0 = index->dev->bMaxPacketSize0; qual->bNumConfigurations = index->dev->bNumConfigurations; qual->bRESERVED = 0; *response_length = sizeof(*qual); return true; } *response_data = descs->qual; *response_length = descs->qual_len; return true; default: break; } break; default: break; } break; default: break; } return false; } typedef bool (*lookup_connect_out_response_t)(int fd, const struct vusb_connect_descriptors* descs, const struct usb_ctrlrequest* ctrl, bool* done); static bool lookup_connect_response_out_generic(int fd, const struct vusb_connect_descriptors* descs, const struct usb_ctrlrequest* ctrl, bool* done) { switch (ctrl->bRequestType & USB_TYPE_MASK) { case USB_TYPE_STANDARD: switch (ctrl->bRequest) { case USB_REQ_SET_CONFIGURATION: *done = true; return true; default: break; } break; } return false; } /* -------------------------------------------------------------------------- */ static int vhci_open(void) { return open("/dev/vhci", O_RDWR); } static int vhci_setport(int fd, u_int port) { struct vhci_ioc_set_port args; args.port = port; return ioctl(fd, VHCI_IOC_SET_PORT, &args); } static int vhci_usb_attach(int fd) { return ioctl(fd, VHCI_IOC_USB_ATTACH, NULL); } static int vhci_usb_recv(int fd, void* buf, size_t size) { uint8_t_t* ptr = (uint8_t_t*)buf; ssize_t done; while (1) { done = read(fd, ptr, size); if (done < 0) return -1; if ((size_t)done == size) return 0; size -= done; ptr += done; } } static int vhci_usb_send(int fd, void* buf, size_t size) { uint8_t_t* ptr = (uint8_t_t*)buf; ssize_t done; while (1) { done = write(fd, ptr, size); if (done <= 0) return -1; if ((size_t)done == size) return 0; size -= done; ptr += done; } } /* -------------------------------------------------------------------------- */ static volatile long syz_usb_connect_impl(uint64_t speed, uint64_t dev_len, const char* dev, const struct vusb_connect_descriptors* descs, lookup_connect_out_response_t lookup_connect_response_out) { struct usb_device_index* index; int portnum, fd, rv; bool done; portnum = procid + 1; if (!dev) { return -1; } if (portnum != 1) { /* For now, we support only one proc. */ return -1; } fd = vhci_open(); if (fd < 0) { return -1; } index = add_usb_index(fd, dev, dev_len); if (!index) { goto err; } rv = vhci_setport(fd, portnum); if (rv != 0) { goto err; } rv = vhci_usb_attach(fd); if (rv != 0) { goto err; } done = false; while (!done) { vhci_request_t req; rv = vhci_usb_recv(fd, &req, sizeof(req)); if (rv != 0) { goto err; } if (req.type != VHCI_REQ_CTRL) { goto err; } char* response_data = NULL; uint32_t response_length = 0; char data[4096]; if (req.u.ctrl.bmRequestType & UE_DIR_IN) { bool response_found = false; response_found = lookup_connect_response_in(fd, descs, (const usb_ctrlrequest*)&req.u.ctrl, &response_data, &response_length); if (!response_found) { goto err; } } else { if (!lookup_connect_response_out(fd, descs, (const usb_ctrlrequest*)&req.u.ctrl, &done)) { goto err; } response_data = NULL; response_length = UGETW(req.u.ctrl.wLength); } if ((req.u.ctrl.bmRequestType & USB_TYPE_MASK) == USB_TYPE_STANDARD && req.u.ctrl.bRequest == USB_REQ_SET_CONFIGURATION) { /* TODO: possibly revisit */ } if (response_length > sizeof(data)) response_length = 0; if ((uint32_t_t)UGETW(req.u.ctrl.wLength) < response_length) response_length = UGETW(req.u.ctrl.wLength); if (response_data) memcpy(data, response_data, response_length); else memset(data, 0, response_length); if (req.u.ctrl.bmRequestType & UE_DIR_IN) { if (response_length > 0) { vhci_response_t res; res.size = response_length; rv = vhci_usb_send(fd, &res, sizeof(res)); if (rv == 0) rv = vhci_usb_send(fd, data, response_length); } } else { rv = vhci_usb_recv(fd, data, response_length); } if (rv < 0) { goto err; } } sleep_ms(200); return fd; err: close(fd); return -1; } static volatile long syz_usb_connect(volatile long a0, volatile long a1, volatile long a2, volatile long a3) { uint64_t speed = a0; uint64_t dev_len = a1; const char* dev = (const char*)a2; const struct vusb_connect_descriptors* descs = (const struct vusb_connect_descriptors*)a3; return syz_usb_connect_impl(speed, dev_len, dev, descs, &lookup_connect_response_out_generic); } static volatile long syz_usb_disconnect(volatile long a0) { int fd = a0; int rv = close(fd); sleep_ms(200); return rv; } static void setup_usb(void) { if (chmod("/dev/vhci", 0666)) exit(1); } static void sandbox_common() { if (setsid() == -1) exit(1); struct rlimit rlim; rlim.rlim_cur = rlim.rlim_max = 8 << 20; setrlimit(RLIMIT_MEMLOCK, &rlim); rlim.rlim_cur = rlim.rlim_max = 1 << 20; setrlimit(RLIMIT_FSIZE, &rlim); rlim.rlim_cur = rlim.rlim_max = 1 << 20; setrlimit(RLIMIT_STACK, &rlim); rlim.rlim_cur = rlim.rlim_max = 0; setrlimit(RLIMIT_CORE, &rlim); rlim.rlim_cur = rlim.rlim_max = 256; setrlimit(RLIMIT_NOFILE, &rlim); } static void loop(); static int do_sandbox_none(void) { sandbox_common(); loop(); return 0; } static long syz_execute_func(volatile long text) { volatile long p[8] = {0}; (void)p; asm volatile("" ::"r"(0l), "r"(1l), "r"(2l), "r"(3l), "r"(4l), "r"(5l), "r"(6l), "r"(7l), "r"(8l), "r"(9l), "r"(10l), "r"(11l), "r"(12l), "r"(13l)); ((void (*)(void))(text))(); return 0; } struct thread_t { int created, call; event_t ready, done; }; static struct thread_t threads[16]; static void execute_call(int call); static int running; static void* thr(void* arg) { struct thread_t* th = (struct thread_t*)arg; for (;;) { event_wait(&th->ready); event_reset(&th->ready); execute_call(th->call); __atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED); event_set(&th->done); } return 0; } static void execute_one(void) { int i, call, thread; for (call = 0; call < 16; call++) { for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0])); thread++) { struct thread_t* th = &threads[thread]; if (!th->created) { th->created = 1; event_init(&th->ready); event_init(&th->done); event_set(&th->done); thread_start(thr, th); } if (!event_isset(&th->done)) continue; event_reset(&th->done); th->call = call; __atomic_fetch_add(&running, 1, __ATOMIC_RELAXED); event_set(&th->ready); event_timedwait(&th->done, 45 + (call == 13 ? 3000 : 0) + (call == 14 ? 3000 : 0) + (call == 15 ? 300 : 0)); break; } } for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++) sleep_ms(1); } static void execute_one(void); #define WAIT_FLAGS 0 static void loop(void) { int iter; for (iter = 0;; iter++) { char cwdbuf[32]; sprintf(cwdbuf, "./%d", iter); if (mkdir(cwdbuf, 0777)) exit(1); int pid = fork(); if (pid < 0) exit(1); if (pid == 0) { if (chdir(cwdbuf)) exit(1); execute_one(); exit(0); } int status = 0; uint64_t start = current_time_ms(); for (;;) { if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) break; sleep_ms(1); if (current_time_ms() - start < 5 * 1000) continue; kill_and_wait(pid, &status); break; } remove_dir(cwdbuf); } } #ifndef SYS_dup2 #define SYS_dup2 90 #endif #ifndef SYS_getgid #define SYS_getgid 47 #endif #ifndef SYS_getgroups #define SYS_getgroups 79 #endif #ifndef SYS_getsockopt #define SYS_getsockopt 118 #endif #ifndef SYS_mmap #define SYS_mmap 197 #endif #ifndef SYS_semctl #define SYS_semctl 442 #endif #ifndef SYS_semget #define SYS_semget 221 #endif #ifndef SYS_seteuid #define SYS_seteuid 183 #endif #ifndef SYS_setregid #define SYS_setregid 127 #endif #ifndef SYS_stat #define SYS_stat 439 #endif #ifndef SYS_writev #define SYS_writev 121 #endif uint64_t r[7] = {0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}; void execute_call(int call) { intptr_t res = 0; switch (call) { case 0: res = syscall(SYS_dup2, -1, 0xffffff9c); if (res != -1) r[0] = res; break; case 1: *(uint64_t*)0x200002c0 = 0x20000000; memcpy((void*)0x20000000, "\x25\xc5\xf6\x76\x86\x92\xf1\x6a\x6b\x02\x33\x7b\xc5\xf2\x4e\x95\xc2\xe5\x74\xf7\xbd\x23\xda\x78\xff\x22\x41\x43\x9c\xac\xed\x12\x2e\x33\xab\x16\xd3\x77\x84\x34\x15\x78\x1f\xa5\x08\xcd\x63\x5f\x2f\xd0\x41\x13\x20\x4e\xd9\xbd\xa7\x39\x6e\x99\xa3\x8a\x2f\x10\xe9\xc7\x39\x8b\x5a\x64\xc4\x9d\x98\x66\x4b\xd1\x49\x75\xbe\x70\x76\xa8\x36\x38\xa7\xda\x30\x95\xf0\xe0\x27\xbd\x16\x1c\xcd\x5c\x99\x4f\x8b\x31\xd5\x35\xa3\xce\x4c\x57\x81\x2d\x96\x82\xf3\xeb\xb1\x0e\x05\xa7\x14\x22\x10\x51\x5b\x66\x8d\x13\x57\xd9\x1a\xaa\xbb\x6a\xd8\x8a\xed\x6b\x9f\x21\x43\xd0\x62\xe0\xb5", 141); *(uint64_t*)0x200002c8 = 0x8d; *(uint64_t*)0x200002d0 = 0x200000c0; memcpy((void*)0x200000c0, "\xe8\x98\x7e\x8f\x86\x4e\x9d\x38\xb5\x56\x15\xb6\x59\xd1\x4c\xae\x9e\x91\xa9\x53\x22\x13\xff\xb4\x65\xb6\x1b", 27); *(uint64_t*)0x200002d8 = 0x1b; *(uint64_t*)0x200002e0 = 0x20000100; memcpy((void*)0x20000100, "\x3f\x97\x99\x2c\x94\x0f\xba\x89\x36\xa6\xb4", 11); *(uint64_t*)0x200002e8 = 0xb; *(uint64_t*)0x200002f0 = 0x20000140; memcpy((void*)0x20000140, "\xc9\x9a\xb6\x04\xeb\x2e\x44\xeb\xf7\xbf\xb7\xb0\x4c\x08\x43\x21\xa3\x0f\x43\x51\xae\xb0\x67\x6b\xb2\x1a\xef\xc3\xbc\x23\x22\xd9\x9a\x5b\x03\x4f\x88\x0a\xa2\x5d\x61\xae\x40\x76\x39\x7c\x30\x35\x7b\x22\xcc\xb7\x79\xeb\xd3\x20\x6a\xc6\x48\xfa\xb9\x08\x36\xdd\x4d\x9e\x73\xdc\x3c\x07\x72\x70\xb5\x7d\xc3\x22\x22\x84\xdd\x3c\xae\x47\x37\x95\x7d\x94\x7d\x76\x5a\x5e\x0e\x91\x9c\xbd\x3e\xf2\xd3\xd9\x52\x2a\x82\x7f\x3f\xe6\x0d\xdc", 106); *(uint64_t*)0x200002f8 = 0x6a; *(uint64_t*)0x20000300 = 0x200001c0; memcpy((void*)0x200001c0, "\x2b\xc5\xa9\xfd\x6c\xc3\x45\x00\x82\x40\x5a\xb6\x07\xa0\xf5\x62\x7b\x40\x58\x9a\x69\x0a\xc5\x91\x58\xac\xf1\x0f\x2a\x1c\xc4\x61\x52\xfa\x5f\x49\x3a\x85\x99\xcc\x6e\xaa\xb5\xd9\x69\x68\xbe\xf1\xa2\x7f\x62\xda\xcf\x64\xd0\x6c\x80\xcf\xb5\xb3\x20\xb9\x77\xc9\x43\x2c\x44\x6f\xa6\xf6\x55\x14\x44\xee\x4c\x59\x98\x85\x32\x60\xd6\x5d\x2c\xb3\xc7\x78\xf4\x4f\xe2\x70\x36\x3b\x4e\xb3\x09\xe2\x4f\xc4\x77\x97\xb5\xbd\x45\x4b\xf4\xd3\xd4\x65\x6f\xa0\x78\xff\x56\xb3\x0f\x4f\x0e\x9d\x5e\x6e\x89\x43\x83\x0a\xd6\xd3\x42\x96\x8c\x22\x4f\x7c\x35\xaf\x01\xa6\x1d\x10\xe1\x55\xfe\xe7\xe0\x22\x7c\xd7\x9a\x79\x77\xb3\xf4\x03\x51\xca\x01\x83\x48\x40\xab\xba\x55\x7d\x36\xbc\x8a\x42\x08\xf9\x0d\xc5\xf5\x1e\x3f\x3d\x44\x5c\x5f\xee\xa7\x93\x68\x16\x4e\xde\xf0\x5d\x24\x74\x8c\xe9\xf0\xa5\x84\x51\xb4\x3d\x98\x91\x90\x2b\xc4\x5e\xc6\x7d\x00\xdf\x1d\xeb\x74\xe6\x5b\x29\xc0\xd0\x95\xdb\xdd\x5b\x9a\x7c", 220); *(uint64_t*)0x20000308 = 0xdc; syscall(SYS_writev, r[0], 0x200002c0ul, 5ul); break; case 2: *(uint32_t*)0x20000340 = 0; *(uint32_t*)0x20000344 = -1; *(uint32_t*)0x20000348 = 0; res = syscall(SYS_getgroups, 3ul, 0x20000340ul); if (res != -1) r[1] = *(uint32_t*)0x20000348; break; case 3: *(uint32_t*)0x200003c0 = 0xc; res = syscall(SYS_getsockopt, -1, 0xffff, 0x11, 0x20000380ul, 0x200003c0ul); if (res != -1) r[2] = *(uint32_t*)0x20000388; break; case 4: syscall(SYS_setregid, r[1], r[2]); break; case 5: res = syscall(SYS_semget, 0x798e2634ul + procid*4, 0ul, 0xb2603d964b180ce8ul); if (res != -1) r[3] = res; break; case 6: memcpy((void*)0x20000400, "./file0\000", 8); res = syscall(SYS_stat, 0x20000400ul, 0x20000440ul); if (res != -1) r[4] = *(uint32_t*)0x2000045c; break; case 7: res = syscall(SYS_getgid); if (res != -1) r[5] = res; break; case 8: *(uint32_t*)0x20000500 = 0xfffff834; *(uint32_t*)0x20000504 = r[4]; *(uint32_t*)0x20000508 = r[5]; *(uint32_t*)0x2000050c = -1; *(uint32_t*)0x20000510 = 0; *(uint32_t*)0x20000514 = 3; *(uint16_t*)0x20000518 = 9; *(uint16_t*)0x2000051a = 0; *(uint64_t*)0x20000520 = 0; *(uint64_t*)0x20000528 = 0; *(uint64_t*)0x20000530 = 0xfffffffffffffffd; *(uint64_t*)0x20000538 = 0x4535; *(uint64_t*)0x20000540 = 2; *(uint64_t*)0x20000548 = 0; *(uint64_t*)0x20000550 = 0; syscall(SYS_semctl, r[3], 0ul, 1ul, 0x20000500ul); break; case 9: syscall(SYS_seteuid, 0); break; case 10: memcpy((void*)0x20000000, "\xbf\x5b\xc2\xc4\xdd\xcd\x9b\xaa\x7f\x7c\x66\xf9\x17\x26\xa8\xc4\x90\xf6\x91\x85\x14\x0b\x5b\x42\x51\xe8\x67\x01\xc6\xc5\xa6\x0d\x84\x80\x2d\x38\x2a\x0c\x38\xdf\x4a\x28\xfd\x84\x0d\x7e\x14\x06\xa5\xc2\xeb\x5d\x3b\x6b\xc3\x23\xbd\x49\x38\x6c\x4a\x92\x49\x50\x31\x4f\xe6\x17\xf8\xcd\x34\x37\xa4\xaa\x6d\x1c\x6d\x62\x64\x03\x09\xf9\xde\x23\x93\x99\x9b\x11\x47\x68\xd5\x10\xd7\x34\xfd\x72\xd1\x98\xb2\x61\xbd\x61\x81\x14\xbf\x3f\xa3\xe2\xfe\x84\xff\xe6\x5c\x80\xe4\x72\x12\xc4\x9e\x47\xbb\x3a\xaa\x86\x89\x46\x2f\x21\xd5\x18\x80\xd9\x7c\xb4\x45\xd3", 136); break; case 11: memcpy((void*)0x200000c0, "\xc4\xa1\x84\x58\x2c\xaa\x26\x44\x0f\xae\x04\xc4\x41\x0f\x74\xab\x00\x00\x01\x00\xc4\x23\xf5\x78\x4c\xe9\x9d\x40\x44\xdf\x34\x59\x26\x41\x0f\xae\x41\x01\x64\x64\x66\x44\x0f\xe5\xb9\x4e\x9a\xb0\xc4\xc4\x22\x7d\x47\x0f\x41\x0f\x45\x7f\x56\x66\x0f\xdd\xe8", 63); syz_execute_func(0x200000c0); break; case 12: break; case 13: memcpy((void*)0x20000140, "\x64\xd3\x2f\x16\xeb\xd8\x17\xd0\x04\xdc\xb8\x01\x71\x82\x05\xbc\xa1\xd8\x6d\xad\x3c\xb1\x32\xa2\x86\x60\x92\x14\xb7\x39\x5a\x97\xa0\xe8\xfe\xda\x5f\xad\x02\xcc\xe9\xde\xea\x94\xd5\x5a\x75\x0c\x17\xb2\x34\x07\x50\x02\xb9\xdf\x62\x9f\xa6\x8e\x3f\x7d\xa9\x7e\x9c\x2a\x2e\x0a\x95\xd1\x5d\x35\x95\x61\xb1\x47\x74\x40\x34\x2c\xd7\x9c\x7c\xeb\xd6\xbf\x00\x8a\xcd\x1c\x7f\xf1\x46\xa6\xfe\x22\x01\x36\x61\xd8\xc8\xce\x8e\xb1\x7f\x5c\xf3\x89\x2a\xe0\x8b\xba\x46\x54\x5b\x2b\x69\x0a\xb7\xe0\x36\x8a\xec\x4d\x32\xb7\x6d\x7f\xc1\x5d\xd7\xc2\xab\xa1\x84\xd4\x1a\x5e\x5a\xbb\x8d\x71\x6f\x5e\x64\x5e\x17\x67\x13\x8e\xd7\x38\xf3\x15\x79\x5a\xc9\x9e\x22\xfd\x44\xdb\x06\x09\x63\x13\xf4\x72\x9c\xe0\xd3\xbd\x93\x8f\x5b\x65\x20\xef\x93\x76\xfa\x90\x9d\xf6\xb2\x05\xc2\xd3\xf5\x2e\xe4\x3e\x3f\x59\xea\x44\x1b\x7c\x4e\x4d\x5c", 201); memcpy((void*)0x20000240, "\xc1\xb0\x1d\x40\x73\x99\x35\xb1\x21\x7d\x0e\x39\x3c\xdd\x4f\xa4\xef\x8b\xbd\x99\x57\xee\x99\x68\x77\xe4\xca\x15\x5c\x19\x5d\xc1\x66\xf9\x48\x6a\xc4\xdb\x17\xf7\x54\xc4\x89\x38\xa4\x34\x19\xf0\x82\xa8\xc3\x0e\xff\xbe\xf0\x64\xf6\xc8\xb8\x7b\xc9\x30\xe4\x39\xc7\x19\xec\x0a\x11\x99\x04\x0b\x86\x28\x6d\x27\x1f\x25\xaf\x26\xeb\xed\x3f\x55\xc3\x2e\x68\xac\x70\x33\x0d\xf7\x69\x31\xbf\x55\xfa\xe8\x80\x25\x6b\x74\xa9\x23\xf8\xa3\x02\x2c\x31\x0f\x94\xcc\x0c\x62\x33\x02\xa5\xd1\x4b\x3f\x8e\x18\xf4\x15\x99\x88\x28\x66\xea\x02\x42\x86\x4b\x37\xd5\xae\x87\xfb\xcb\x74\x5c\x3e\x26\x42\x3d\x05\xc5\x48\x38\x33\xdf\xcd\xd4\x3d\xc0\xc6\x50\x73\x29\x03\x72\x73\xde\x28\x2e\x3a\x16\xac\x00\xc5\x53\x9c\x30\x94\x63\x98\x4b\x15\x3e\xc6\x25\x0a\x78\x19\x75\xa2\x77\x01\x72\x80\xdb\x1e\x9c\x18\xce\x66\x4d\xf5\x94\x7c\x6c\x18\xbe\xf2\x36\x7e\x61\x63\xb4\x6b\x95\x03\xf7\x00\x70\x5f\xd0\xe8\x9e\xae\x6d\xf0\x88\x4b\xf2\x7c\x00\xe0\x5f\xc5\xef\xc6\x49\x07", 234); syz_usb_connect(0, 0xc9, 0x20000140, 0x20000240); break; case 14: memcpy((void*)0x20000340, "\x36\x4f\xb1\xa4\x17\x26\x3d\xe2\x27\x97\xec\x76\x08\x61\xf3\x85\x2c\xf2\x4f\x79\xe2\xb7\xa5\xc6\x2a\xfa\xd7\xd6\xd4\xd0\x9d\x86\x2f\x8e\xcc\xd0\x2e\x1b\xb9\x89\xe0\xf8\xa8\xad\x91\x54\x42\x01\x64\x04\xc9\x82\x6a\x5c\x0a\x28\x4f\xc7\xa8\x40\x30\x47\x59\xb6\x84\xf3\x57\xb2\xe6\xfe\xcf\xb3\xcc\x81\x57\xc0\x08\xff\x0d\xcf\xf2\x10\x89\x84\x54\x8a\x2a\xd6\x95\xfa\xd9\x51\x2f\x06\xfd\x12\xd6\x6b\xc4\x43\x04\x75\x12\xab\x4e\xf3\x05\x8a\xe6\xc0\xc6\xec\x3f\xd6\x27\xe3\x70\xa1\x51\xae\x71\x9b\x8e\x3a\x77\xd6\x82\xdc\x06\xa9\x3b\xe9\xc2\xaa\x80\x18\xb5\x8a\x94\x92\xcb\x39\x03\x1b\xb5\xab\xf3\x12\x4e\xaa\xb8\x53\x30\xf1\x81\xfc\xcc\xa7\x59\x7b\x4e\xc0\x87\x9f\xcb\xcf\x51\x14\x3f\x98\xc4\x43\xc1\x67\x20\xa6\xe0\x1b\x7e\x07\xdf\x47\x27\xe2\x88\xe1\x3d\xcc\x0b\x7e\x11", 191); memcpy((void*)0x20000400, "\x59\x03\x92\x3c\x7a\x1b\x28\x38\xf3\xc1\x21\x56\x78\x5a\x11\xc8\x1b\x2e\x82\xd9\xa1\x19\x0e\x1b\x9c\x45\x97\x6a\x91\x7c\x00\x29\x4d\xc9\x4d\x53\x54\xe8\xc5\xd6\xa4\xe8\x98\x6d\xa0\x74\xeb\x46\x1e\xd0\x73\x6b\xcb\xed\xe2\xce\xf1\xf1\x9e\x02\x16\xc0\x9e\xb7\x94\xd8\xb9\x75\x4f\xea\x26\xf1\x10\xc8\x32\x48\xc2\x86\xea\xa0\x5a\x69\x84\x4e\xb1\x29\x2f\x59\x4f\x59\xf6\xc9\xbe\xca\x47\xd8\x94\xd4\x4d\xfd\x15\xff\x81\xb7\x6b\x46\x35\x39\x2e\xb5\xed\x43\x1c\xa3\x09\x22\x30", 117); res = syz_usb_connect(4, 0xbf, 0x20000340, 0x20000400); if (res != -1) r[6] = res; break; case 15: syz_usb_disconnect(r[6]); break; } } int main(void) { syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 3ul, 0x1012ul, -1, 0ul, 0ul); for (procid = 0; procid < 4; procid++) { if (fork() == 0) { use_temporary_dir(); do_sandbox_none(); } } sleep(1000000); return 0; } :187:2: error: unknown type name 'uint8_t_t' :188:2: error: unknown type name 'uint8_t_t' :189:2: error: unknown type name 'uint8_t_t' :190:2: error: unknown type name 'uint8_t_t' :191:2: error: unknown type name 'uint16_t_t' :192:2: error: unknown type name 'uint8_t_t' :193:2: error: unknown type name 'uint8_t_t' :194:2: error: unknown type name 'uint8_t_t' :198:2: error: unknown type name 'uint8_t_t' :199:2: error: unknown type name 'uint8_t_t' :200:2: error: unknown type name 'uint16_t_t' :201:2: error: unknown type name 'uint8_t_t' :202:2: error: unknown type name 'uint8_t_t' :203:2: error: unknown type name 'uint8_t_t' :204:2: error: unknown type name 'uint8_t_t' :205:2: error: unknown type name 'uint16_t_t' :206:2: error: unknown type name 'uint16_t_t' :207:2: error: unknown type name 'uint16_t_t' :208:2: error: unknown type name 'uint8_t_t' :209:2: error: unknown type name 'uint8_t_t' :210:2: error: unknown type name 'uint8_t_t' :211:2: error: unknown type name 'uint8_t_t' :215:2: error: unknown type name 'uint8_t_t' :216:2: error: unknown type name 'uint8_t_t' :217:2: error: unknown type name 'uint16_t_t' :218:2: error: unknown type name 'uint8_t_t' :219:2: error: unknown type name 'uint8_t_t' :220:2: error: unknown type name 'uint8_t_t' :221:2: error: unknown type name 'uint8_t_t' :222:2: error: unknown type name 'uint8_t_t' :226:2: error: unknown type name 'uint8_t_t' :227:2: error: unknown type name 'uint8_t_t' :228:2: error: unknown type name 'uint8_t_t' :229:2: error: unknown type name 'uint8_t_t' :230:2: error: unknown type name 'uint8_t_t' :231:2: error: unknown type name 'uint8_t_t' :232:2: error: unknown type name 'uint8_t_t' :233:2: error: unknown type name 'uint8_t_t' :234:2: error: unknown type name 'uint8_t_t' :238:2: error: unknown type name 'uint8_t_t' :239:2: error: unknown type name 'uint8_t_t' :240:2: error: unknown type name 'uint16_t_t' :241:2: error: unknown type name 'uint16_t_t' :242:2: error: unknown type name 'uint16_t_t' :246:2: error: unknown type name 'uint8_t_t' :247:2: error: unknown type name 'uint8_t_t' :248:2: error: unknown type name 'uint16_t_t' :249:2: error: unknown type name 'uint8_t_t' :250:2: error: unknown type name 'uint8_t_t' :251:2: error: unknown type name 'uint8_t_t' :252:2: error: unknown type name 'uint8_t_t' :253:2: error: unknown type name 'uint8_t_t' :254:2: error: unknown type name 'uint8_t_t' : In function 'vhci_usb_recv': :561:2: error: unknown type name 'uint8_t_t'; did you mean 'uint8_t'? :561:20: error: 'uint8_t_t' undeclared (first use in this function); did you mean 'uint8_t'? :561:20: note: each undeclared identifier is reported only once for each function it appears in :561:30: error: expected expression before ')' token : In function 'vhci_usb_send': :576:2: error: unknown type name 'uint8_t_t'; did you mean 'uint8_t'? :576:20: error: 'uint8_t_t' undeclared (first use in this function); did you mean 'uint8_t'? :576:30: error: expected expression before ')' token : In function 'syz_usb_connect_impl': :637:63: error: unknown type name 'usb_ctrlrequest' :642:55: error: unknown type name 'usb_ctrlrequest' :654:8: error: 'uint32_t_t' undeclared (first use in this function); did you mean 'uint32_t'? At top level: :702:13: error: 'setup_usb' defined but not used [-Werror=unused-function] cc1: all warnings being treated as errors compiler invocation: /syzkaller/netbsd/src/../tools/bin/x86_64--netbsd-g++ [-o /tmp/syz-executor420238871 -DGOOS_netbsd=1 -DGOARCH_amd64=1 -DHOSTGOOS_linux=1 -x c - -m64 --sysroot /syzkaller/netbsd/src/../dest/ -O2 -pthread -Wall -Werror -Wparentheses -Wframe-larger-than=16384] FAIL FAIL github.com/google/syzkaller/pkg/csource 4.520s ok github.com/google/syzkaller/pkg/db (cached) ok github.com/google/syzkaller/pkg/email (cached) ? github.com/google/syzkaller/pkg/gce [no test files] ? github.com/google/syzkaller/pkg/gcs [no test files] ? github.com/google/syzkaller/pkg/hash [no test files] ok github.com/google/syzkaller/pkg/host 8.586s ? github.com/google/syzkaller/pkg/html [no test files] ok github.com/google/syzkaller/pkg/ifuzz (cached) ? github.com/google/syzkaller/pkg/ifuzz/gen [no test files] ? github.com/google/syzkaller/pkg/ifuzz/generated [no test files] ok github.com/google/syzkaller/pkg/instance 2.900s ok github.com/google/syzkaller/pkg/ipc 7.646s ? github.com/google/syzkaller/pkg/ipc/ipcconfig [no test files] ok github.com/google/syzkaller/pkg/kd (cached) ok github.com/google/syzkaller/pkg/log (cached) ok github.com/google/syzkaller/pkg/mgrconfig 2.142s ok github.com/google/syzkaller/pkg/osutil (cached) ok github.com/google/syzkaller/pkg/report 7.033s ok github.com/google/syzkaller/pkg/repro 3.691s ? github.com/google/syzkaller/pkg/rpctype [no test files] ok github.com/google/syzkaller/pkg/runtest 12.761s ok github.com/google/syzkaller/pkg/serializer (cached) ? github.com/google/syzkaller/pkg/signal [no test files] ok github.com/google/syzkaller/pkg/symbolizer 0.340s ok github.com/google/syzkaller/pkg/vcs 5.800s ok github.com/google/syzkaller/prog 10.261s ok github.com/google/syzkaller/prog/test (cached) ? github.com/google/syzkaller/sys [no test files] ? github.com/google/syzkaller/sys/akaros [no test files] ? github.com/google/syzkaller/sys/akaros/gen [no test files] ? github.com/google/syzkaller/sys/freebsd [no test files] ? github.com/google/syzkaller/sys/freebsd/gen [no test files] ? github.com/google/syzkaller/sys/fuchsia [no test files] ? github.com/google/syzkaller/sys/fuchsia/fidlgen [no test files] ? github.com/google/syzkaller/sys/fuchsia/gen [no test files] ? github.com/google/syzkaller/sys/fuchsia/layout [no test files] ok github.com/google/syzkaller/sys/linux 0.250s ? github.com/google/syzkaller/sys/linux/gen [no test files] ? github.com/google/syzkaller/sys/netbsd [no test files] ? github.com/google/syzkaller/sys/netbsd/gen [no test files] ok github.com/google/syzkaller/sys/openbsd (cached) ? github.com/google/syzkaller/sys/openbsd/gen [no test files] ? github.com/google/syzkaller/sys/syz-extract [no test files] ? github.com/google/syzkaller/sys/syz-sysgen [no test files] ? github.com/google/syzkaller/sys/targets [no test files] ? github.com/google/syzkaller/sys/test [no test files] ? github.com/google/syzkaller/sys/test/gen [no test files] ? github.com/google/syzkaller/sys/trusty [no test files] ? github.com/google/syzkaller/sys/trusty/gen [no test files] ? github.com/google/syzkaller/sys/windows [no test files] ? github.com/google/syzkaller/sys/windows/gen [no test files] ok github.com/google/syzkaller/syz-ci 4.137s ok github.com/google/syzkaller/syz-fuzzer 1.334s ok github.com/google/syzkaller/syz-hub 1.925s ok github.com/google/syzkaller/syz-hub/state (cached) ? github.com/google/syzkaller/syz-manager [no test files] ? github.com/google/syzkaller/tools/syz-benchcmp [no test files] ? github.com/google/syzkaller/tools/syz-bisect [no test files] ? github.com/google/syzkaller/tools/syz-check [no test files] ? github.com/google/syzkaller/tools/syz-cover [no test files] ? github.com/google/syzkaller/tools/syz-crush [no test files] ? github.com/google/syzkaller/tools/syz-db [no test files] ? github.com/google/syzkaller/tools/syz-execprog [no test files] ? github.com/google/syzkaller/tools/syz-expand [no test files] ? github.com/google/syzkaller/tools/syz-fmt [no test files] ? github.com/google/syzkaller/tools/syz-imagegen [no test files] ? github.com/google/syzkaller/tools/syz-make [no test files] ? github.com/google/syzkaller/tools/syz-mutate [no test files] ? github.com/google/syzkaller/tools/syz-prog2c [no test files] ? github.com/google/syzkaller/tools/syz-repro [no test files] ? github.com/google/syzkaller/tools/syz-reprolist [no test files] ? github.com/google/syzkaller/tools/syz-runtest [no test files] ? github.com/google/syzkaller/tools/syz-showprio [no test files] ? github.com/google/syzkaller/tools/syz-stress [no test files] ? github.com/google/syzkaller/tools/syz-symbolize [no test files] ? github.com/google/syzkaller/tools/syz-testbuild [no test files] ? github.com/google/syzkaller/tools/syz-trace2syz [no test files] ok github.com/google/syzkaller/tools/syz-trace2syz/parser 1.609s ok github.com/google/syzkaller/tools/syz-trace2syz/proggen 2.249s ? github.com/google/syzkaller/tools/syz-tty [no test files] ? github.com/google/syzkaller/tools/syz-upgrade [no test files] ? github.com/google/syzkaller/tools/syz-usbgen [no test files] ok github.com/google/syzkaller/vm 13.324s ? github.com/google/syzkaller/vm/adb [no test files] ? github.com/google/syzkaller/vm/bhyve [no test files] ? github.com/google/syzkaller/vm/gce [no test files] ? github.com/google/syzkaller/vm/gvisor [no test files] ok github.com/google/syzkaller/vm/isolated (cached) ? github.com/google/syzkaller/vm/kvm [no test files] ? github.com/google/syzkaller/vm/odroid [no test files] ? github.com/google/syzkaller/vm/qemu [no test files] ok github.com/google/syzkaller/vm/vmimpl (cached) ? github.com/google/syzkaller/vm/vmm [no test files]