syzkaller-repros/linux/345aff423c4ad1a7fc904c911aa13d2040d78718.c - pub/scm/linux/kernel/git/shuah/linux-arts - Git at Google

 // KASAN: slab-out-of-bounds Read in mceusb_dev_recv
 // https://syzkaller.appspot.com/bug?id=345aff423c4ad1a7fc904c911aa13d2040d78718
 // status:open
 // autogenerated by syzkaller (https://github.com/google/syzkaller)

 #define _GNU_SOURCE

 #include <endian.h>
 #include <errno.h>
 #include <fcntl.h>
 #include <stdarg.h>
 #include <stdbool.h>
 #include <stddef.h>
 #include <stdint.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <sys/mount.h>
 #include <sys/stat.h>
 #include <sys/syscall.h>
 #include <sys/types.h>
 #include <unistd.h>

 #include <linux/usb/ch9.h>

 unsigned long long procid;

 static void sleep_ms(uint64_t ms)
 {
   usleep(ms * 1000);
 }

 #define USB_DEBUG 0

 #define USB_MAX_EP_NUM 32

 struct usb_device_index {
   struct usb_device_descriptor* dev;
   struct usb_config_descriptor* config;
   unsigned config_length;
   struct usb_interface_descriptor* iface;
   struct usb_endpoint_descriptor* eps[USB_MAX_EP_NUM];
   unsigned eps_num;
 };

 static bool parse_usb_descriptor(char* buffer, size_t length,
                                  struct usb_device_index* index)
 {
   if (length <
       sizeof(*index->dev) + sizeof(*index->config) + sizeof(*index->iface))
     return false;
   index->dev = (struct usb_device_descriptor*)buffer;
   index->config = (struct usb_config_descriptor*)(buffer + sizeof(*index->dev));
   index->config_length = length - sizeof(*index->dev);
   index->iface =
       (struct usb_interface_descriptor*)(buffer + sizeof(*index->dev) +
                                          sizeof(*index->config));
   index->eps_num = 0;
   size_t offset = 0;
   while (true) {
     if (offset + 1 >= length)
       break;
     uint8_t desc_length = buffer[offset];
     uint8_t desc_type = buffer[offset + 1];
     if (desc_length <= 2)
       break;
     if (offset + desc_length > length)
       break;
     if (desc_type == USB_DT_ENDPOINT) {
       index->eps[index->eps_num] =
           (struct usb_endpoint_descriptor*)(buffer + offset);
       index->eps_num++;
     }
     if (index->eps_num == USB_MAX_EP_NUM)
       break;
     offset += desc_length;
   }
   return true;
 }

 enum usb_fuzzer_event_type {
   USB_FUZZER_EVENT_INVALID,
   USB_FUZZER_EVENT_CONNECT,
   USB_FUZZER_EVENT_DISCONNECT,
   USB_FUZZER_EVENT_SUSPEND,
   USB_FUZZER_EVENT_RESUME,
   USB_FUZZER_EVENT_CONTROL,
 };

 struct usb_fuzzer_event {
   uint32_t type;
   uint32_t length;
   char data[0];
 };

 struct usb_fuzzer_init {
   uint64_t speed;
   const char* driver_name;
   const char* device_name;
 };

 struct usb_fuzzer_ep_io {
   uint16_t ep;
   uint16_t flags;
   uint32_t length;
   char data[0];
 };

 #define USB_FUZZER_IOCTL_INIT _IOW('U', 0, struct usb_fuzzer_init)
 #define USB_FUZZER_IOCTL_RUN _IO('U', 1)
 #define USB_FUZZER_IOCTL_EVENT_FETCH _IOR('U', 2, struct usb_fuzzer_event)
 #define USB_FUZZER_IOCTL_EP0_WRITE _IOW('U', 3, struct usb_fuzzer_ep_io)
 #define USB_FUZZER_IOCTL_EP0_READ _IOWR('U', 4, struct usb_fuzzer_ep_io)
 #define USB_FUZZER_IOCTL_EP_ENABLE _IOW('U', 5, struct usb_endpoint_descriptor)
 #define USB_FUZZER_IOCTL_EP_WRITE _IOW('U', 7, struct usb_fuzzer_ep_io)
 #define USB_FUZZER_IOCTL_EP_READ _IOWR('U', 8, struct usb_fuzzer_ep_io)
 #define USB_FUZZER_IOCTL_CONFIGURE _IO('U', 9)
 #define USB_FUZZER_IOCTL_VBUS_DRAW _IOW('U', 10, uint32_t)

 int usb_fuzzer_open()
 {
   return open("/sys/kernel/debug/usb-fuzzer", O_RDWR);
 }

 int usb_fuzzer_init(int fd, uint32_t speed, const char* driver,
                     const char* device)
 {
   struct usb_fuzzer_init arg;
   arg.speed = speed;
   arg.driver_name = driver;
   arg.device_name = device;
   return ioctl(fd, USB_FUZZER_IOCTL_INIT, &arg);
 }

 int usb_fuzzer_run(int fd)
 {
   return ioctl(fd, USB_FUZZER_IOCTL_RUN, 0);
 }

 int usb_fuzzer_event_fetch(int fd, struct usb_fuzzer_event* event)
 {
   return ioctl(fd, USB_FUZZER_IOCTL_EVENT_FETCH, event);
 }

 int usb_fuzzer_ep0_write(int fd, struct usb_fuzzer_ep_io* io)
 {
   return ioctl(fd, USB_FUZZER_IOCTL_EP0_WRITE, io);
 }

 int usb_fuzzer_ep0_read(int fd, struct usb_fuzzer_ep_io* io)
 {
   return ioctl(fd, USB_FUZZER_IOCTL_EP0_READ, io);
 }

 int usb_fuzzer_ep_write(int fd, struct usb_fuzzer_ep_io* io)
 {
   return ioctl(fd, USB_FUZZER_IOCTL_EP_WRITE, io);
 }

 int usb_fuzzer_ep_read(int fd, struct usb_fuzzer_ep_io* io)
 {
   return ioctl(fd, USB_FUZZER_IOCTL_EP_READ, io);
 }

 int usb_fuzzer_ep_enable(int fd, struct usb_endpoint_descriptor* desc)
 {
   return ioctl(fd, USB_FUZZER_IOCTL_EP_ENABLE, desc);
 }

 int usb_fuzzer_configure(int fd)
 {
   return ioctl(fd, USB_FUZZER_IOCTL_CONFIGURE, 0);
 }

 int usb_fuzzer_vbus_draw(int fd, uint32_t power)
 {
   return ioctl(fd, USB_FUZZER_IOCTL_VBUS_DRAW, power);
 }

 #define USB_MAX_PACKET_SIZE 1024

 struct usb_fuzzer_control_event {
   struct usb_fuzzer_event inner;
   struct usb_ctrlrequest ctrl;
   char data[USB_MAX_PACKET_SIZE];
 };

 struct usb_fuzzer_ep_io_data {
   struct usb_fuzzer_ep_io inner;
   char data[USB_MAX_PACKET_SIZE];
 };

 struct vusb_connect_string_descriptor {
   uint32_t len;
   char* str;
 } __attribute__((packed));

 struct vusb_connect_descriptors {
   uint32_t qual_len;
   char* qual;
   uint32_t bos_len;
   char* bos;
   uint32_t strs_len;
   struct vusb_connect_string_descriptor strs[0];
 } __attribute__((packed));

 static const char* default_string = "syzkaller";

 static bool lookup_connect_response(struct vusb_connect_descriptors* descs,
                                     struct usb_device_index* index,
                                     struct usb_ctrlrequest* ctrl,
                                     char** response_data,
                                     uint32_t* response_length)
 {
   uint8_t str_idx;
   switch (ctrl->bRequestType & USB_TYPE_MASK) {
   case USB_TYPE_STANDARD:
     switch (ctrl->bRequest) {
     case USB_REQ_GET_DESCRIPTOR:
       switch (ctrl->wValue >> 8) {
       case USB_DT_DEVICE:
         *response_data = (char*)index->dev;
         *response_length = sizeof(*index->dev);
         return true;
       case USB_DT_CONFIG:
         *response_data = (char*)index->config;
         *response_length = index->config_length;
         return true;
       case USB_DT_STRING:
         str_idx = (uint8_t)ctrl->wValue;
         if (str_idx >= descs->strs_len) {
           *response_data = (char*)default_string;
           *response_length = strlen(default_string);
         } else {
           *response_data = descs->strs[str_idx].str;
           *response_length = descs->strs[str_idx].len;
         }
         return true;
       case USB_DT_BOS:
         *response_data = descs->bos;
         *response_length = descs->bos_len;
         return true;
       case USB_DT_DEVICE_QUALIFIER:
         *response_data = descs->qual;
         *response_length = descs->qual_len;
         return true;
       default:
         exit(1);
         return false;
       }
       break;
     default:
       exit(1);
       return false;
     }
     break;
   default:
     exit(1);
     return false;
   }
   return false;
 }

 static volatile long syz_usb_connect(volatile long a0, volatile long a1,
                                      volatile long a2, volatile long a3)
 {
   uint64_t speed = a0;
   uint64_t dev_len = a1;
   char* dev = (char*)a2;
   struct vusb_connect_descriptors* descs = (struct vusb_connect_descriptors*)a3;
   if (!dev) {
     return -1;
   }
   struct usb_device_index index;
   memset(&index, 0, sizeof(index));
   int rv = 0;
   rv = parse_usb_descriptor(dev, dev_len, &index);
   if (!rv) {
     return rv;
   }
   int fd = usb_fuzzer_open();
   if (fd < 0) {
     return fd;
   }
   char device[32];
   sprintf(&device[0], "dummy_udc.%llu", procid);
   rv = usb_fuzzer_init(fd, speed, "dummy_udc", &device[0]);
   if (rv < 0) {
     return rv;
   }
   rv = usb_fuzzer_run(fd);
   if (rv < 0) {
     return rv;
   }
   bool done = false;
   while (!done) {
     struct usb_fuzzer_control_event event;
     event.inner.type = 0;
     event.inner.length = sizeof(event.ctrl);
     rv = usb_fuzzer_event_fetch(fd, (struct usb_fuzzer_event*)&event);
     if (rv < 0) {
       return rv;
     }
     if (event.inner.type != USB_FUZZER_EVENT_CONTROL)
       continue;
     bool response_found = false;
     char* response_data = NULL;
     uint32_t response_length = 0;
     if (event.ctrl.bRequestType & USB_DIR_IN) {
       response_found = lookup_connect_response(
           descs, &index, &event.ctrl, &response_data, &response_length);
       if (!response_found) {
         return -1;
       }
     } else {
       if ((event.ctrl.bRequestType & USB_TYPE_MASK) != USB_TYPE_STANDARD ||
           event.ctrl.bRequest != USB_REQ_SET_CONFIGURATION) {
         exit(1);
         return -1;
       }
       done = true;
     }
     if (done) {
       rv = usb_fuzzer_vbus_draw(fd, index.config->bMaxPower);
       if (rv < 0) {
         return rv;
       }
       rv = usb_fuzzer_configure(fd);
       if (rv < 0) {
         return rv;
       }
       unsigned ep;
       for (ep = 0; ep < index.eps_num; ep++) {
         rv = usb_fuzzer_ep_enable(fd, index.eps[ep]);
         if (rv < 0) {
         } else {
         }
       }
     }
     struct usb_fuzzer_ep_io_data response;
     response.inner.ep = 0;
     response.inner.flags = 0;
     if (response_length > sizeof(response.data))
       response_length = 0;
     if (event.ctrl.wLength < response_length)
       response_length = event.ctrl.wLength;
     response.inner.length = response_length;
     if (response_data)
       memcpy(&response.data[0], response_data, response_length);
     else
       memset(&response.data[0], 0, response_length);
     if (event.ctrl.bRequestType & USB_DIR_IN)
       rv = usb_fuzzer_ep0_write(fd, (struct usb_fuzzer_ep_io*)&response);
     else
       rv = usb_fuzzer_ep0_read(fd, (struct usb_fuzzer_ep_io*)&response);
     if (rv < 0) {
       return rv;
     }
   }
   sleep_ms(200);
   return fd;
 }

 static volatile long syz_usb_ep_write(volatile long a0, volatile long a1,
                                       volatile long a2, volatile long a3)
 {
   int fd = a0;
   uint16_t ep = a1;
   uint32_t len = a2;
   char* data = (char*)a3;
   struct usb_fuzzer_ep_io_data io_data;
   io_data.inner.ep = ep;
   io_data.inner.flags = 0;
   if (len > sizeof(io_data.data))
     len = sizeof(io_data.data);
   io_data.inner.length = len;
   memcpy(&io_data.data[0], data, len);
   int rv = usb_fuzzer_ep_write(fd, (struct usb_fuzzer_ep_io*)&io_data);
   if (rv < 0) {
     return rv;
   }
   sleep_ms(200);
   return 0;
 }

 uint64_t r[1] = {0xffffffffffffffff};

 int main(void)
 {
   syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0);
   intptr_t res = 0;
   memcpy((void*)0x20000100,
          "\x12\x01\x00\x00\x44\xd5\xcf\x20\x09\x15\x42\x92\x5c\xfb\x00\x00\x00"
          "\x01\x09\x02\x36\x00\x01\x00\x00\x00\x00\x09\x04\x00\x00\x04\x11\x00"
          "\x4c\x00\x09\x85\x0f\x0e\x18\x00\x00\x00\x00\x09\x05\x07\x00\x00\x00"
          "\x00\x00\x00\x09\x05\x05\x12\x00\x00\x00\x00\x00\x09\x05\x82\x13\x00"
          "\xd9\xad\x23\x44\x99\xa6\xcb\x56\x10\xe2\xda\x50\xb4\xe9\x00\x00\x00"
          "\x00",
          86);
   res = syz_usb_connect(0, 0x48, 0x20000100, 0);
   if (res != -1)
     r[0] = res;
   memcpy((void*)0x20000280,
          "\x02\xea\x1d\x3d\x79\x79\xe7\x76\xc3\x0a\xab\x7c\x79\xe6\x28\x08\x71"
          "\xb9\xbb\xb2\x39\xf0\xfc\xca\xa4\x11\x80\x4f\x70\x76\xe9\x2d\xe6\x52"
          "\xf7\xc6\x8b\xab\x96\xc2\x8d\xa0\x6b\x1a\xc5\xcc\x48\xa3\x6b\xe8\x69"
          "\x7f\x9c\x3c\xe4\x2f\x01\x2d\xa9\xe0\x91\xab\x4c\x7c\x48\x18\x27\xba"
          "\x00\x16\xa9\xdd\x15\x04\x11\x0a\xe3\x32\x24\x85\xe6\x95\xbc\x5e\xba"
          "\xf3\x0d\x8e\xae\x26\xbf\xd0\xc2\x83\x65\x2f\x03\x00\x35\xd4\xd4\x03"
          "\x0c\xd8\x4f\xcf\x61\xa2\x2d\xa2\x7c\xa4\x65",
          113);
   syz_usb_ep_write(r[0], 0, 0x155, 0x20000280);
   return 0;
 }
	// KASAN: slab-out-of-bounds Read in mceusb_dev_recv
	// https://syzkaller.appspot.com/bug?id=345aff423c4ad1a7fc904c911aa13d2040d78718
	// status:open
	// autogenerated by syzkaller (https://github.com/google/syzkaller)

	#define _GNU_SOURCE

	#include <endian.h>
	#include <errno.h>
	#include <fcntl.h>
	#include <stdarg.h>
	#include <stdbool.h>
	#include <stddef.h>
	#include <stdint.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <sys/mount.h>
	#include <sys/stat.h>
	#include <sys/syscall.h>
	#include <sys/types.h>
	#include <unistd.h>

	#include <linux/usb/ch9.h>

	unsigned long long procid;

	static void sleep_ms(uint64_t ms)
	{
	usleep(ms * 1000);
	}

	#define USB_DEBUG 0

	#define USB_MAX_EP_NUM 32

	struct usb_device_index {
	struct usb_device_descriptor* dev;
	struct usb_config_descriptor* config;
	unsigned config_length;
	struct usb_interface_descriptor* iface;
	struct usb_endpoint_descriptor* eps[USB_MAX_EP_NUM];
	unsigned eps_num;
	};

	static bool parse_usb_descriptor(char* buffer, size_t length,
	struct usb_device_index* index)
	{
	if (length <
	sizeof(index->dev) + sizeof(index->config) + sizeof(*index->iface))
	return false;
	index->dev = (struct usb_device_descriptor*)buffer;
	index->config = (struct usb_config_descriptor)(buffer + sizeof(index->dev));
	index->config_length = length - sizeof(*index->dev);
	index->iface =
	(struct usb_interface_descriptor)(buffer + sizeof(index->dev) +
	sizeof(*index->config));
	index->eps_num = 0;
	size_t offset = 0;
	while (true) {
	if (offset + 1 >= length)
	break;
	uint8_t desc_length = buffer[offset];
	uint8_t desc_type = buffer[offset + 1];
	if (desc_length <= 2)
	break;
	if (offset + desc_length > length)
	break;
	if (desc_type == USB_DT_ENDPOINT) {
	index->eps[index->eps_num] =
	(struct usb_endpoint_descriptor*)(buffer + offset);
	index->eps_num++;
	}
	if (index->eps_num == USB_MAX_EP_NUM)
	break;
	offset += desc_length;
	}
	return true;
	}

	enum usb_fuzzer_event_type {
	USB_FUZZER_EVENT_INVALID,
	USB_FUZZER_EVENT_CONNECT,
	USB_FUZZER_EVENT_DISCONNECT,
	USB_FUZZER_EVENT_SUSPEND,
	USB_FUZZER_EVENT_RESUME,
	USB_FUZZER_EVENT_CONTROL,
	};

	struct usb_fuzzer_event {
	uint32_t type;
	uint32_t length;
	char data[0];
	};

	struct usb_fuzzer_init {
	uint64_t speed;
	const char* driver_name;
	const char* device_name;
	};

	struct usb_fuzzer_ep_io {
	uint16_t ep;
	uint16_t flags;
	uint32_t length;
	char data[0];
	};

	#define USB_FUZZER_IOCTL_INIT _IOW('U', 0, struct usb_fuzzer_init)
	#define USB_FUZZER_IOCTL_RUN _IO('U', 1)
	#define USB_FUZZER_IOCTL_EVENT_FETCH _IOR('U', 2, struct usb_fuzzer_event)
	#define USB_FUZZER_IOCTL_EP0_WRITE _IOW('U', 3, struct usb_fuzzer_ep_io)
	#define USB_FUZZER_IOCTL_EP0_READ _IOWR('U', 4, struct usb_fuzzer_ep_io)
	#define USB_FUZZER_IOCTL_EP_ENABLE _IOW('U', 5, struct usb_endpoint_descriptor)
	#define USB_FUZZER_IOCTL_EP_WRITE _IOW('U', 7, struct usb_fuzzer_ep_io)
	#define USB_FUZZER_IOCTL_EP_READ _IOWR('U', 8, struct usb_fuzzer_ep_io)
	#define USB_FUZZER_IOCTL_CONFIGURE _IO('U', 9)
	#define USB_FUZZER_IOCTL_VBUS_DRAW _IOW('U', 10, uint32_t)

	int usb_fuzzer_open()
	{
	return open("/sys/kernel/debug/usb-fuzzer", O_RDWR);
	}

	int usb_fuzzer_init(int fd, uint32_t speed, const char* driver,
	const char* device)
	{
	struct usb_fuzzer_init arg;
	arg.speed = speed;
	arg.driver_name = driver;
	arg.device_name = device;
	return ioctl(fd, USB_FUZZER_IOCTL_INIT, &arg);
	}

	int usb_fuzzer_run(int fd)
	{
	return ioctl(fd, USB_FUZZER_IOCTL_RUN, 0);
	}

	int usb_fuzzer_event_fetch(int fd, struct usb_fuzzer_event* event)
	{
	return ioctl(fd, USB_FUZZER_IOCTL_EVENT_FETCH, event);
	}

	int usb_fuzzer_ep0_write(int fd, struct usb_fuzzer_ep_io* io)
	{
	return ioctl(fd, USB_FUZZER_IOCTL_EP0_WRITE, io);
	}

	int usb_fuzzer_ep0_read(int fd, struct usb_fuzzer_ep_io* io)
	{
	return ioctl(fd, USB_FUZZER_IOCTL_EP0_READ, io);
	}

	int usb_fuzzer_ep_write(int fd, struct usb_fuzzer_ep_io* io)
	{
	return ioctl(fd, USB_FUZZER_IOCTL_EP_WRITE, io);
	}

	int usb_fuzzer_ep_read(int fd, struct usb_fuzzer_ep_io* io)
	{
	return ioctl(fd, USB_FUZZER_IOCTL_EP_READ, io);
	}

	int usb_fuzzer_ep_enable(int fd, struct usb_endpoint_descriptor* desc)
	{
	return ioctl(fd, USB_FUZZER_IOCTL_EP_ENABLE, desc);
	}

	int usb_fuzzer_configure(int fd)
	{
	return ioctl(fd, USB_FUZZER_IOCTL_CONFIGURE, 0);
	}

	int usb_fuzzer_vbus_draw(int fd, uint32_t power)
	{
	return ioctl(fd, USB_FUZZER_IOCTL_VBUS_DRAW, power);
	}

	#define USB_MAX_PACKET_SIZE 1024

	struct usb_fuzzer_control_event {
	struct usb_fuzzer_event inner;
	struct usb_ctrlrequest ctrl;
	char data[USB_MAX_PACKET_SIZE];
	};

	struct usb_fuzzer_ep_io_data {
	struct usb_fuzzer_ep_io inner;
	char data[USB_MAX_PACKET_SIZE];
	};

	struct vusb_connect_string_descriptor {
	uint32_t len;
	char* str;
	} __attribute__((packed));

	struct vusb_connect_descriptors {
	uint32_t qual_len;
	char* qual;
	uint32_t bos_len;
	char* bos;
	uint32_t strs_len;
	struct vusb_connect_string_descriptor strs[0];
	} __attribute__((packed));

	static const char* default_string = "syzkaller";

	static bool lookup_connect_response(struct vusb_connect_descriptors* descs,
	struct usb_device_index* index,
	struct usb_ctrlrequest* ctrl,
	char** response_data,
	uint32_t* response_length)
	{
	uint8_t str_idx;
	switch (ctrl->bRequestType & USB_TYPE_MASK) {
	case USB_TYPE_STANDARD:
	switch (ctrl->bRequest) {
	case USB_REQ_GET_DESCRIPTOR:
	switch (ctrl->wValue >> 8) {
	case USB_DT_DEVICE:
	response_data = (char)index->dev;
	response_length = sizeof(index->dev);
	return true;
	case USB_DT_CONFIG:
	response_data = (char)index->config;
	*response_length = index->config_length;
	return true;
	case USB_DT_STRING:
	str_idx = (uint8_t)ctrl->wValue;
	if (str_idx >= descs->strs_len) {
	response_data = (char)default_string;
	*response_length = strlen(default_string);
	} else {
	*response_data = descs->strs[str_idx].str;
	*response_length = descs->strs[str_idx].len;
	}
	return true;
	case USB_DT_BOS:
	*response_data = descs->bos;
	*response_length = descs->bos_len;
	return true;
	case USB_DT_DEVICE_QUALIFIER:
	*response_data = descs->qual;
	*response_length = descs->qual_len;
	return true;
	default:
	exit(1);
	return false;
	}
	break;
	default:
	exit(1);
	return false;
	}
	break;
	default:
	exit(1);
	return false;
	}
	return false;
	}

	static volatile long syz_usb_connect(volatile long a0, volatile long a1,
	volatile long a2, volatile long a3)
	{
	uint64_t speed = a0;
	uint64_t dev_len = a1;
	char* dev = (char*)a2;
	struct vusb_connect_descriptors* descs = (struct vusb_connect_descriptors*)a3;
	if (!dev) {
	return -1;
	}
	struct usb_device_index index;
	memset(&index, 0, sizeof(index));
	int rv = 0;
	rv = parse_usb_descriptor(dev, dev_len, &index);
	if (!rv) {
	return rv;
	}
	int fd = usb_fuzzer_open();
	if (fd < 0) {
	return fd;
	}
	char device[32];
	sprintf(&device[0], "dummy_udc.%llu", procid);
	rv = usb_fuzzer_init(fd, speed, "dummy_udc", &device[0]);
	if (rv < 0) {
	return rv;
	}
	rv = usb_fuzzer_run(fd);
	if (rv < 0) {
	return rv;
	}
	bool done = false;
	while (!done) {
	struct usb_fuzzer_control_event event;
	event.inner.type = 0;
	event.inner.length = sizeof(event.ctrl);
	rv = usb_fuzzer_event_fetch(fd, (struct usb_fuzzer_event*)&event);
	if (rv < 0) {
	return rv;
	}
	if (event.inner.type != USB_FUZZER_EVENT_CONTROL)
	continue;
	bool response_found = false;
	char* response_data = NULL;
	uint32_t response_length = 0;
	if (event.ctrl.bRequestType & USB_DIR_IN) {
	response_found = lookup_connect_response(
	descs, &index, &event.ctrl, &response_data, &response_length);
	if (!response_found) {
	return -1;
	}
	} else {
	if ((event.ctrl.bRequestType & USB_TYPE_MASK) != USB_TYPE_STANDARD \|\|
	event.ctrl.bRequest != USB_REQ_SET_CONFIGURATION) {
	exit(1);
	return -1;
	}
	done = true;
	}
	if (done) {
	rv = usb_fuzzer_vbus_draw(fd, index.config->bMaxPower);
	if (rv < 0) {
	return rv;
	}
	rv = usb_fuzzer_configure(fd);
	if (rv < 0) {
	return rv;
	}
	unsigned ep;
	for (ep = 0; ep < index.eps_num; ep++) {
	rv = usb_fuzzer_ep_enable(fd, index.eps[ep]);
	if (rv < 0) {
	} else {
	}
	}
	}
	struct usb_fuzzer_ep_io_data response;
	response.inner.ep = 0;
	response.inner.flags = 0;
	if (response_length > sizeof(response.data))
	response_length = 0;
	if (event.ctrl.wLength < response_length)
	response_length = event.ctrl.wLength;
	response.inner.length = response_length;
	if (response_data)
	memcpy(&response.data[0], response_data, response_length);
	else
	memset(&response.data[0], 0, response_length);
	if (event.ctrl.bRequestType & USB_DIR_IN)
	rv = usb_fuzzer_ep0_write(fd, (struct usb_fuzzer_ep_io*)&response);
	else
	rv = usb_fuzzer_ep0_read(fd, (struct usb_fuzzer_ep_io*)&response);
	if (rv < 0) {
	return rv;
	}
	}
	sleep_ms(200);
	return fd;
	}

	static volatile long syz_usb_ep_write(volatile long a0, volatile long a1,
	volatile long a2, volatile long a3)
	{
	int fd = a0;
	uint16_t ep = a1;
	uint32_t len = a2;
	char* data = (char*)a3;
	struct usb_fuzzer_ep_io_data io_data;
	io_data.inner.ep = ep;
	io_data.inner.flags = 0;
	if (len > sizeof(io_data.data))
	len = sizeof(io_data.data);
	io_data.inner.length = len;
	memcpy(&io_data.data[0], data, len);
	int rv = usb_fuzzer_ep_write(fd, (struct usb_fuzzer_ep_io*)&io_data);
	if (rv < 0) {
	return rv;
	}
	sleep_ms(200);
	return 0;
	}

	uint64_t r[1] = {0xffffffffffffffff};

	int main(void)
	{
	syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0);
	intptr_t res = 0;
	memcpy((void*)0x20000100,
	"\x12\x01\x00\x00\x44\xd5\xcf\x20\x09\x15\x42\x92\x5c\xfb\x00\x00\x00"
	"\x01\x09\x02\x36\x00\x01\x00\x00\x00\x00\x09\x04\x00\x00\x04\x11\x00"
	"\x4c\x00\x09\x85\x0f\x0e\x18\x00\x00\x00\x00\x09\x05\x07\x00\x00\x00"
	"\x00\x00\x00\x09\x05\x05\x12\x00\x00\x00\x00\x00\x09\x05\x82\x13\x00"
	"\xd9\xad\x23\x44\x99\xa6\xcb\x56\x10\xe2\xda\x50\xb4\xe9\x00\x00\x00"
	"\x00",
	86);
	res = syz_usb_connect(0, 0x48, 0x20000100, 0);
	if (res != -1)
	r[0] = res;
	memcpy((void*)0x20000280,
	"\x02\xea\x1d\x3d\x79\x79\xe7\x76\xc3\x0a\xab\x7c\x79\xe6\x28\x08\x71"
	"\xb9\xbb\xb2\x39\xf0\xfc\xca\xa4\x11\x80\x4f\x70\x76\xe9\x2d\xe6\x52"
	"\xf7\xc6\x8b\xab\x96\xc2\x8d\xa0\x6b\x1a\xc5\xcc\x48\xa3\x6b\xe8\x69"
	"\x7f\x9c\x3c\xe4\x2f\x01\x2d\xa9\xe0\x91\xab\x4c\x7c\x48\x18\x27\xba"
	"\x00\x16\xa9\xdd\x15\x04\x11\x0a\xe3\x32\x24\x85\xe6\x95\xbc\x5e\xba"
	"\xf3\x0d\x8e\xae\x26\xbf\xd0\xc2\x83\x65\x2f\x03\x00\x35\xd4\xd4\x03"
	"\x0c\xd8\x4f\xcf\x61\xa2\x2d\xa2\x7c\xa4\x65",
	113);
	syz_usb_ep_write(r[0], 0, 0x155, 0x20000280);
	return 0;
	}