syscalls/ioctl.c

   1 /*
   2  * SYSCALL_DEFINE3(ioctl, unsigned int, fd, unsigned int, cmd, unsigned long, arg)
   3  */
   4 #include <stdlib.h>
   5 #include <linux/ioctl.h>
   6 #include <linux/major.h>
   7 #include "random.h"
   8 #include "sanitise.h"
   9 #include "maps.h"
  10 #include "shm.h"
  11 #include "ioctls.h"
  12
  13 static void ioctl_mangle_cmd(int childno)
  14 {
  15         unsigned int i;
  16
  17         /* mangle the cmd by ORing up to 4 random bits */
  18         for (i=0; i < (unsigned int)(rand() % 4); i++)
  19                 shm->a2[childno] |= 1L << (rand() % 32);
  20
  21         /* mangle the cmd by ANDing up to 4 random bits */
  22         for (i=0; i < (unsigned int)(rand() % 4); i++)
  23                 shm->a2[childno] &= 1L << (rand() % 32);
  24 }
  25
  26 static void ioctl_mangle_arg(int childno)
  27 {
  28         /* the argument could mean anything, because ioctl sucks like that. */
  29         if (rand_bool())
  30                 shm->a3[childno] = rand32();
  31         else
  32                 shm->a3[childno] = (unsigned long) get_non_null_address();
  33 }
  34
  35 static void generic_sanitise_ioctl(int childno)
  36 {
  37         if ((rand() % 50)==0)
  38                 ioctl_mangle_cmd(childno);
  39
  40         ioctl_mangle_arg(childno);
  41 }
  42
  43 static void sanitise_ioctl(int childno)
  44 {
  45         const struct ioctl_group *grp;
  46
  47         if (rand() % 100 == 0)
  48                 grp = get_random_ioctl_group();
  49         else
  50                 grp = find_ioctl_group(shm->a1[childno]);
  51
  52         if (grp) {
  53                 ioctl_mangle_arg(childno);
  54
  55                 grp->sanitise(grp, childno);
  56
  57                 if (rand() % 100 == 0)
  58                         ioctl_mangle_cmd(childno);
  59         } else
  60                 generic_sanitise_ioctl(childno);
  61 }
  62
  63 struct syscallentry syscall_ioctl = {
  64         .name = "ioctl",
  65         .num_args = 3,
  66         .arg1name = "fd",
  67         .arg1type = ARG_FD,
  68         .arg2name = "cmd",
  69         .arg3name = "arg",
  70         .arg3type = ARG_RANDPAGE,
  71         .sanitise = sanitise_ioctl,
  72         .flags = NEED_ALARM,
  73 };