syzkaller
syzkaller copied to clipboard
google
sys/linux: things to test
List of things we need descriptions for (dynamically updated). Note : some of these things might be very hard to test, while other are easy.
Before starting work on a subsystem, grep existing descriptions if the subsystem is already [partially] described. This list may be outdated or imply extending existing basic descriptions.
Besides this list, new things are constantly added to the kernel. kernelnewbies.org lists new things in each release. Also queries along the following lines can be used to check for features added in each release:
git diff -U0 v5.17 v5.18 include/uapi/*.h | grep "+++"
git diff -U0 v5.17 HEAD include/uapi/*.h | egrep "^\+.*\s_IO" | less
git diff -U0 v5.17 HEAD include/uapi/*.h | egrep -v "^(index|diff|---|@|-|\+$|\+/\*|\+ \*)" | less
For introduction to Linux kernel syscalls see these 0xax.gitbooks.io articles: part 1, part 4, part 5. Bootlin code search is very useful for browsing kernel sources.
Assorted devices:
- /dev/vfio
- stub video/media devices (
CONFIG_VIDEO_VIMC,CONFIG_VIDEO_VIM2M,CONFIG_VIDEO_VIVID,CONFIG_VIDEO_VICODEC)/dev/video*,/dev/media*,/dev/v4l*allow to test large generic parts of media stack; there are some descriptions in sys/linux/dev_video4linux.txt but they need to be double checked - CONFIG_VIDEO_MEM2MEM_DEINTERLACE
- CONFIG_VIRTIO_MEM (figure out how to enable it in qemu)
- drivers/mtd/ubi
- /dev/dma_heap/system
Assorted:
- CONFIG_BLK_DEV_UBLK
- quotactl_fd
- fsinfo and fchmodat4
- NOTIFY_MOUNT, watch_sb, KEYCTL_WATCH_KEY
- blkzoned (lots of descriptions are in place, but syzkaller does not seem to actually reach the code)
- SK_DIAG_BPF_STORAGE_REQ_MAP_FD
- perf trace filters (parse something insanely complex: kernel/trace/trace_events_filter.c)
- filesystem-specific ioctl's on files and dir (e.g. ext4 and btrfs have a few, also see #1020)
- binderfs (see also this discussion)
- loopfs (if it lands at least in linux-next)
- squashfs
- ubifs
- dmcrypt, dmverity, fs-verify
- more netlink descriptions (in particular, netlink/generic subsystems)
- set breakpoints/watchpoints on own process using ptrace/perf_event_open
- create interesting frames for rt_sigreturn to restore (in particular FP state)
Sound:
- /proc/asound/*
- sound/core/compress_offload.c (figure out how to enable it in qemu)
- SNDRV_CTL_ELEM_TYPE_*
Network:
- better conntrack coverage
- NS_GET_INIT_PID
- XFRM_ESPINTCP
- BRIDGE_MRP
- TCA_FLOWER_KEY_MPLS_OPTS
- packet scheduler (include/uapi/linux/pkt_sched.h)
- mac80211/ETH_P_PREAUTH
- VLANs (can be created with "ip add -type vlan" on top of veth)
- jumbo frames (not sure what's the current coverage, specifically inject huge packets?)
- gate control action (TCA_GATE_ENTRY_INDEX)
USB (docs):
- USB/IP client and server
- /sys/kernel/debug/usb/devices
- Legacy gadget drivers (
g_hid.ko, etc.) - ConfigFS gadget functions
External USB (sys/linux/vusb.txt):
- CONFIG_USB_STORAGE
- CONFIG_SND_USB
- CONFIG_USB_RTL8150
- CONFIG_USB_RTL8152
- CONFIG_USB_NET_AX88179_178A
- CONFIG_USB_NET_AX8817X
- Probably many others
External network (sys/linux/vnet.txt):
- SCTP
- Probably many others
Bluetooth (sys/linux/socket_bluetooth.txt):
- What is covered? What isn't yet?
GPIO: the following configs create some test devices in VMs (GPIOLIB, GPIO_AGGREGATOR, GPIO_VIRTIO, GPIO_MOCKUP, GPIO_SIM)
HDMI (#3725)
CONFIG_CACHESTAT_SYSCALL
fou is added in https://github.com/google/syzkaller/commit/7c62f718046a2204a35cfe8850f9006b686b1c22
IPVS is added in https://github.com/google/syzkaller/commit/0ca7878bc33e9f95369c609dd1eb56a6405479cc
@JiahengHu here are relevant commits just in case: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=278a5fbaed89dacd04e9d052f4594ffd0e0585de https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=349057e6f9c71264a54503e2ed6c0627e8369dab
