github.com/google/syzkaller@v0.0.0-20240517125934-c0f1611a36d6/sys/linux/socket_netlink_generic.txt (about)

     1  # Copyright 2017 syzkaller project authors. All rights reserved.
     2  # Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.
     3  
     4  # AF_NETLINK/NETLINK_GENERIC support.
     5  
     6  # TODO: describe APIs of specific genetlink families.
     7  
     8  include <linux/net.h>
     9  include <uapi/linux/netlink.h>
    10  include <uapi/linux/genetlink.h>
    11  
    12  resource sock_nl_generic[sock_netlink]
    13  
    14  socket$nl_generic(domain const[AF_NETLINK], type const[SOCK_RAW], proto const[NETLINK_GENERIC]) sock_nl_generic
    15  
    16  # This is NETLINK_GENERIC created in init_net namespace. Use with extreme care.
    17  # It's very dangerous to use as it allows the fuzzer to bring down network connectivity
    18  # and destroy the machine in other ways. But it's required for ieee802154 testing and
    19  # some other netlink protocols that can be used only in init_net (.netnsok = false).
    20  # It is specifically not derived from fd/sock, so that fuzzer does not try to use it other ways.
    21  # However, it's still easy to abuse it since fd number is low and can easily be used
    22  # as the result of race or something. If this proves to be problematic, we can either
    23  # create a pseudo syscall that creates socket, moves it to a high fd and then changes namespace,
    24  # and/or create a pseudo syscall that both creates the socket and send netlink message,
    25  # or improve kernel to properly support namespaces for ieee802154.
    26  resource sock_nl_generic_init[int32]: -1
    27  
    28  syz_init_net_socket$nl_generic(domain const[AF_NETLINK], type const[SOCK_RAW], proto const[NETLINK_GENERIC]) sock_nl_generic_init
    29  
    30  sendmsg$nl_generic(fd sock_nl_generic, msg ptr[in, msghdr_nl_generic], f flags[send_flags])
    31  
    32  type msghdr_nl_generic msghdr_netlink[netlink_msg_t[netlink_random_msg_type, genlmsghdr, nl_generic_attr]]
    33  
    34  genlmsghdr {
    35  	cmd		int8[0:32]
    36  	version		const[0, int8]
    37  	reserved	const[0, int16]
    38  } [align[4]]
    39  
    40  type genlmsghdr_t[CMD] {
    41  	cmd		const[CMD, int8]
    42  	version		const[0, int8]
    43  	reserved	const[0, int16]
    44  } [align[4]]