Syzlang Ioctl Basics

Syzkaller's description language (syzlang) describes syscalls for fuzzing. Description files are located at /opt/syzkaller/sys/linux/*.txt.

Syscall Syntax

Basic form:

syscall_name(arg1 type1, arg2 type2, ...) return_type

Specialized syscalls use $ suffix:

syscall$VARIANT(args...) return_type

Common Type Patterns

Pattern	Meaning
const[VALUE]	Fixed constant value
flags[flag_set, type]	Bitfield from flag set
ptr[direction, type]	Pointer (in, out, inout)
intptr[min:max]	Integer pointer with range
int8, int16, int32	Fixed-size integers
int16be, int32be	Big-endian integers
array[type]	Variable-length array
array[type, count]	Fixed-length array

Ioctl Patterns

For ioctls with output:

ioctl$CMD(fd fd_type, cmd const[CMD], arg ptr[out, int32])

For ioctls with input:

ioctl$CMD(fd fd_type, cmd const[CMD], arg ptr[in, struct_type])

For simple value ioctls:

ioctl$CMD(fd fd_type, cmd const[CMD], arg intptr[0:1])

For ioctls using ifreq structure (from socket.txt):

ioctl$CMD(fd fd_type, cmd const[CMD], arg ptr[in, ifreq_t[flags[flag_set, int16]]])