syzkaller-ppdev-syzlang

Syzkaller Syzlang Descriptions for ppdev

This skill produces two files for the syzkaller kernel fuzzer:

1. A .txt syzlang description file for the ppdev driver
2. A .txt.const constants file with architecture-specific numeric values

File Structure

The .txt file follows this order:

1. Include directives
2. Resource declarations
3. Device open call
4. Ioctl descriptions
5. Struct definitions
6. Flag definitions

Include Directives

Start with the kernel headers that define ppdev and parport constants:

include <linux/ppdev.h>
include <linux/parport.h>

Resource Declaration

Declare a file descriptor resource for ppdev devices:

resource fd_ppdev[fd]

Device Opening

Use syz_open_dev with the parport device path template. The # is replaced by syzkaller with small integers during fuzzing:

syz_open_dev$ppdev(dev ptr[in, string["/dev/parport#"]], id intptr, flags flags[open_flags]) fd_ppdev

Ioctl Descriptions

Each ioctl specializes the generic ioctl syscall with a $NAME suffix.

No-data ioctls (use _IO encoding)

These take exactly two parameters - fd and command constant. No third argument:

ioctl$PPCLAIM(fd fd_ppdev, cmd const[PPCLAIM])
ioctl$PPRELEASE(fd fd_ppdev, cmd const[PPRELEASE])
ioctl$PPYIELD(fd fd_ppdev, cmd const[PPYIELD])
ioctl$PPEXCL(fd fd_ppdev, cmd const[PPEXCL])

Data-transferring ioctls

These add a third ptr[direction, type] argument.

Direction mapping (this is critical to get right):

• _IOW (user writes TO kernel) → ptr[in, ...]
• _IOR (kernel reads OUT to user) → ptr[out, ...]

Mode management (4-byte int):

ioctl$PPSETMODE(fd fd_ppdev, cmd const[PPSETMODE], arg ptr[in, flags[ieee1284_modes, int32]])
ioctl$PPGETMODE(fd fd_ppdev, cmd const[PPGETMODE], arg ptr[out, int32])
ioctl$PPGETMODES(fd fd_ppdev, cmd const[PPGETMODES], arg ptr[out, int32])
ioctl$PPNEGOT(fd fd_ppdev, cmd const[PPNEGOT], arg ptr[in, flags[ieee1284_modes, int32]])

Data transfer (1-byte):