github.com/google/syzkaller@v0.0.0-20240517125934-c0f1611a36d6/docs/linux/external_fuzzing_usbip.md (about)

     1  # USB/IP Fuzzing for Linux Kernel
     2  
     3  Syzkaller supports fuzzing the Linux kernel USB/IP subsystem externally. We can set up a virtual network and send USB/IP packets to the client kernel as they are being received from an external server.
     4  USB/IP fuzzing needs USB/IP configurations to be enabled. You can find the list in the configurations part.
     5  
     6  Currently syzkaller only includes support for fuzzing the client side of USB/IP, which consists of 2 main parts:
     7  
     8  1. USB/IP pseudo-syscalls.
     9  2. Syzkaller descriptions.
    10  
    11  ### Configurations
    12  
    13  Following configurations should be enabled for USB/IP.
    14  
    15  ```
    16  CONFIG_USBIP_CORE=y
    17  CONFIG_USBIP_VHCI_HCD=y
    18  CONFIG_USBIP_VHCI_HC_PORTS=8
    19  CONFIG_USBIP_VHCI_NR_HCS=8
    20  CONFIG_USBIP_HOST=y
    21  CONFIG_USBIP_VUDC=y
    22  CONFIG_USBIP_DEBUG=y
    23  ```
    24  
    25  ### Pseudo-syscalls
    26  
    27  Currently syzkaller defines one USB/IP pseudo-syscall and one USB/IP specific write syscall (see [this](/executor/common_linux.h) for the pseudo-syscall and [this](/sys/linux/usbip.txt) for its syzkaller descriptions):
    28  
    29  `syz_usbip_server_init` sets up USB/IP server. It creates a pair of connected socket and opens the `/sys/devices/platform/vhci_hcd.0/attach` file. Later, this pseudo-syscall writes the USB/IP client’s socket descriptor as well as port number used for USB/IP connection, USB device id and USB device speed into this file so that the USB/IP communication between client and server can start and client’s kernel can receive USB/IP packets from the server.
    30  
    31  `write$usbip_server` sends USB/IP packets to client by using server's socket descriptor. (Particularly, `USBIP_RET_SUBMIT` and `USBIP_RET_UNLINK` packets.) We assume that the server can send arbitrary USB/IP packets instead of emulating a real device. These packets end up in the client's kernel and get parsed there.
    32  
    33  ### **Further Improvements**
    34  
    35  1. Fuzzing the server side of USB/IP.
    36  2. Collect coverage from USB/IP kernel code.