sys/linux: add syz_open_dev$char_usb descriptions

syz_open_dev$char_usb opens char devices with major = USB_MAJOR. Sanitize its values to make sure it doesn't open other char/block devices.
google · Aug 8, 2019 · d545e94 · d545e94
1 parent bcc419e
commit d545e94
Show file tree

Hide file tree

Showing 15 changed files with 151 additions and 11 deletions.
diff --git a/executor/defs.h b/executor/defs.h
@@ -70,7 +70,7 @@
 
 #if GOARCH_386
 #define GOARCH "386"
-#define SYZ_REVISION "eb22b8a389910e3ec878475738f280bd61b00a09"
+#define SYZ_REVISION "38f83eeb8eb860a70e47d58558925a433b2db80c"
 #define SYZ_EXECUTOR_USES_FORK_SERVER 1
 #define SYZ_EXECUTOR_USES_SHMEM 1
 #define SYZ_PAGE_SIZE 4096
@@ -80,7 +80,7 @@
 
 #if GOARCH_amd64
 #define GOARCH "amd64"
-#define SYZ_REVISION "b025d70b7713cc48e9ab783fc35e2410b69a5736"
+#define SYZ_REVISION "35a61e3d9f82704660ae851088b5cab4dd788688"
 #define SYZ_EXECUTOR_USES_FORK_SERVER 1
 #define SYZ_EXECUTOR_USES_SHMEM 1
 #define SYZ_PAGE_SIZE 4096
@@ -90,7 +90,7 @@
 
 #if GOARCH_arm
 #define GOARCH "arm"
-#define SYZ_REVISION "fdb9cb5b71481f79ff86d824721def50b72fafa5"
+#define SYZ_REVISION "aa728964114f9bdcdb61227af7a3592558e9a3ab"
 #define SYZ_EXECUTOR_USES_FORK_SERVER 1
 #define SYZ_EXECUTOR_USES_SHMEM 1
 #define SYZ_PAGE_SIZE 4096
@@ -100,7 +100,7 @@
 
 #if GOARCH_arm64
 #define GOARCH "arm64"
-#define SYZ_REVISION "26a51558327902a8e8951bd6afdcdae046006802"
+#define SYZ_REVISION "2436d280e9b215f342b807b6e7d340e8de10d2d0"
 #define SYZ_EXECUTOR_USES_FORK_SERVER 1
 #define SYZ_EXECUTOR_USES_SHMEM 1
 #define SYZ_PAGE_SIZE 4096
@@ -110,7 +110,7 @@
 
 #if GOARCH_ppc64le
 #define GOARCH "ppc64le"
-#define SYZ_REVISION "d118414cc10f2c07b6a9e1fae0e14db998375343"
+#define SYZ_REVISION "c87d0e37e231bd4df8bbd35f06200017b89567a1"
 #define SYZ_EXECUTOR_USES_FORK_SERVER 1
 #define SYZ_EXECUTOR_USES_SHMEM 1
 #define SYZ_PAGE_SIZE 4096

diff --git a/executor/syscalls.h b/executor/syscalls.h
@@ -3932,6 +3932,7 @@ const call_t syscalls[] = {
     {"read", 3},
     {"read$FUSE", 3},
     {"read$alg", 3},
+    {"read$char_usb", 3},
     {"read$eventfd", 3},
     {"read$hiddev", 3},
     {"read$hidraw", 3},
@@ -4561,6 +4562,7 @@ const call_t syscalls[] = {
     {"syz_open_dev$audion", 0, (syscall_t)syz_open_dev},
     {"syz_open_dev$binder", 0, (syscall_t)syz_open_dev},
     {"syz_open_dev$cec", 0, (syscall_t)syz_open_dev},
+    {"syz_open_dev$char_usb", 0, (syscall_t)syz_open_dev},
     {"syz_open_dev$dmmidi", 0, (syscall_t)syz_open_dev},
     {"syz_open_dev$dri", 0, (syscall_t)syz_open_dev},
     {"syz_open_dev$dricontrol", 0, (syscall_t)syz_open_dev},
@@ -4790,6 +4792,7 @@ const call_t syscalls[] = {
     {"write$cgroup_pid", 4},
     {"write$cgroup_subtree", 4},
     {"write$cgroup_type", 4},
+    {"write$char_usb", 4},
     {"write$evdev", 4},
     {"write$eventfd", 4},
     {"write$hidraw", 4},
@@ -6691,6 +6694,7 @@ const call_t syscalls[] = {
     {"read", 0},
     {"read$FUSE", 0},
     {"read$alg", 0},
+    {"read$char_usb", 0},
     {"read$eventfd", 0},
     {"read$hiddev", 0},
     {"read$hidraw", 0},
@@ -7321,6 +7325,7 @@ const call_t syscalls[] = {
     {"syz_open_dev$audion", 0, (syscall_t)syz_open_dev},
     {"syz_open_dev$binder", 0, (syscall_t)syz_open_dev},
     {"syz_open_dev$cec", 0, (syscall_t)syz_open_dev},
+    {"syz_open_dev$char_usb", 0, (syscall_t)syz_open_dev},
     {"syz_open_dev$dmmidi", 0, (syscall_t)syz_open_dev},
     {"syz_open_dev$dri", 0, (syscall_t)syz_open_dev},
     {"syz_open_dev$dricontrol", 0, (syscall_t)syz_open_dev},
@@ -7550,6 +7555,7 @@ const call_t syscalls[] = {
     {"write$cgroup_pid", 1},
     {"write$cgroup_subtree", 1},
     {"write$cgroup_type", 1},
+    {"write$char_usb", 1},
     {"write$evdev", 1},
     {"write$eventfd", 1},
     {"write$hidraw", 1},
@@ -9405,6 +9411,7 @@ const call_t syscalls[] = {
     {"read", 3},
     {"read$FUSE", 3},
     {"read$alg", 3},
+    {"read$char_usb", 3},
     {"read$eventfd", 3},
     {"read$hiddev", 3},
     {"read$hidraw", 3},
@@ -10033,6 +10040,7 @@ const call_t syscalls[] = {
     {"syz_open_dev$audion", 0, (syscall_t)syz_open_dev},
     {"syz_open_dev$binder", 0, (syscall_t)syz_open_dev},
     {"syz_open_dev$cec", 0, (syscall_t)syz_open_dev},
+    {"syz_open_dev$char_usb", 0, (syscall_t)syz_open_dev},
     {"syz_open_dev$dmmidi", 0, (syscall_t)syz_open_dev},
     {"syz_open_dev$dri", 0, (syscall_t)syz_open_dev},
     {"syz_open_dev$dricontrol", 0, (syscall_t)syz_open_dev},
@@ -10260,6 +10268,7 @@ const call_t syscalls[] = {
     {"write$cgroup_pid", 4},
     {"write$cgroup_subtree", 4},
     {"write$cgroup_type", 4},
+    {"write$char_usb", 4},
     {"write$evdev", 4},
     {"write$eventfd", 4},
     {"write$hidraw", 4},
@@ -12100,6 +12109,7 @@ const call_t syscalls[] = {
     {"read", 63},
     {"read$FUSE", 63},
     {"read$alg", 63},
+    {"read$char_usb", 63},
     {"read$eventfd", 63},
     {"read$hiddev", 63},
     {"read$hidraw", 63},
@@ -12719,6 +12729,7 @@ const call_t syscalls[] = {
     {"syz_open_dev$audion", 0, (syscall_t)syz_open_dev},
     {"syz_open_dev$binder", 0, (syscall_t)syz_open_dev},
     {"syz_open_dev$cec", 0, (syscall_t)syz_open_dev},
+    {"syz_open_dev$char_usb", 0, (syscall_t)syz_open_dev},
     {"syz_open_dev$dmmidi", 0, (syscall_t)syz_open_dev},
     {"syz_open_dev$dri", 0, (syscall_t)syz_open_dev},
     {"syz_open_dev$dricontrol", 0, (syscall_t)syz_open_dev},
@@ -12942,6 +12953,7 @@ const call_t syscalls[] = {
     {"write$cgroup_pid", 64},
     {"write$cgroup_subtree", 64},
     {"write$cgroup_type", 64},
+    {"write$char_usb", 64},
     {"write$evdev", 64},
     {"write$eventfd", 64},
     {"write$hidraw", 64},
@@ -14796,6 +14808,7 @@ const call_t syscalls[] = {
     {"read", 3},
     {"read$FUSE", 3},
     {"read$alg", 3},
+    {"read$char_usb", 3},
     {"read$eventfd", 3},
     {"read$hiddev", 3},
     {"read$hidraw", 3},
@@ -15423,6 +15436,7 @@ const call_t syscalls[] = {
     {"syz_open_dev$audion", 0, (syscall_t)syz_open_dev},
     {"syz_open_dev$binder", 0, (syscall_t)syz_open_dev},
     {"syz_open_dev$cec", 0, (syscall_t)syz_open_dev},
+    {"syz_open_dev$char_usb", 0, (syscall_t)syz_open_dev},
     {"syz_open_dev$dmmidi", 0, (syscall_t)syz_open_dev},
     {"syz_open_dev$dri", 0, (syscall_t)syz_open_dev},
     {"syz_open_dev$dricontrol", 0, (syscall_t)syz_open_dev},
@@ -15652,6 +15666,7 @@ const call_t syscalls[] = {
     {"write$cgroup_pid", 4},
     {"write$cgroup_subtree", 4},
     {"write$cgroup_type", 4},
+    {"write$char_usb", 4},
     {"write$evdev", 4},
     {"write$eventfd", 4},
     {"write$hidraw", 4},

diff --git a/sys/linux/dev_char_usb.txt b/sys/linux/dev_char_usb.txt
@@ -0,0 +1,11 @@
+# Copyright 2019 syzkaller project authors. All rights reserved.
+# Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.
+
+include <include/linux/usb.h>
+
+resource fd_char_usb[fd]
+
+syz_open_dev$char_usb(dev const[0xc], major const[USB_MAJOR], minor intptr) fd_char_usb
+
+read$char_usb(fd fd_char_usb, buf buffer[out], count len[buf])
+write$char_usb(fd fd_char_usb, buf buffer[in], count len[buf])
diff --git a/sys/linux/dev_char_usb_386.const b/sys/linux/dev_char_usb_386.const
@@ -0,0 +1,4 @@
+# AUTOGENERATED FILE
+USB_MAJOR = 180
+__NR_read = 3
+__NR_write = 4
diff --git a/sys/linux/dev_char_usb_amd64.const b/sys/linux/dev_char_usb_amd64.const
@@ -0,0 +1,4 @@
+# AUTOGENERATED FILE
+USB_MAJOR = 180
+__NR_read = 0
+__NR_write = 1
diff --git a/sys/linux/dev_char_usb_arm.const b/sys/linux/dev_char_usb_arm.const
@@ -0,0 +1,4 @@
+# AUTOGENERATED FILE
+USB_MAJOR = 180
+__NR_read = 3
+__NR_write = 4
diff --git a/sys/linux/dev_char_usb_arm64.const b/sys/linux/dev_char_usb_arm64.const
@@ -0,0 +1,4 @@
+# AUTOGENERATED FILE
+USB_MAJOR = 180
+__NR_read = 63
+__NR_write = 64
diff --git a/sys/linux/dev_char_usb_ppc64le.const b/sys/linux/dev_char_usb_ppc64le.const
@@ -0,0 +1,4 @@
+# AUTOGENERATED FILE
+USB_MAJOR = 180
+__NR_read = 3
+__NR_write = 4
diff --git a/sys/linux/gen/386.go b/sys/linux/gen/386.go
@@ -40,6 +40,7 @@ var resources_386 = []*ResourceDesc{
 	{Name: "fd_cgroup_pid", Type: &IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "int32", TypeSize: 4}}}, Kind: []string{"fd", "fd_cgroup_pid"}, Values: []uint64{18446744073709551615}},
 	{Name: "fd_cgroup_subtree", Type: &IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "int32", TypeSize: 4}}}, Kind: []string{"fd", "fd_cgroup_subtree"}, Values: []uint64{18446744073709551615}},
 	{Name: "fd_cgroup_type", Type: &IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "int32", TypeSize: 4}}}, Kind: []string{"fd", "fd_cgroup_type"}, Values: []uint64{18446744073709551615}},
+	{Name: "fd_char_usb", Type: &IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "int32", TypeSize: 4}}}, Kind: []string{"fd", "fd_char_usb"}, Values: []uint64{18446744073709551615}},
 	{Name: "fd_dir", Type: &IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "int32", TypeSize: 4}}}, Kind: []string{"fd", "fd_dir"}, Values: []uint64{18446744073709551615, 18446744073709551516}},
 	{Name: "fd_dma_buf", Type: &IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "int32", TypeSize: 4}}}, Kind: []string{"fd", "fd_dma_buf"}, Values: []uint64{18446744073709551615}},
 	{Name: "fd_dmabuf", Type: &IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "int32", TypeSize: 4}}}, Kind: []string{"fd", "fd_dmabuf"}, Values: []uint64{18446744073709551615}},
@@ -39241,6 +39242,11 @@ var syscalls_386 = []*Syscall{
 		&PtrType{TypeCommon: TypeCommon{TypeName: "ptr", FldName: "buf", TypeSize: 4}, Type: &BufferType{TypeCommon: TypeCommon{TypeName: "array", ArgDir: 1, IsVarlen: true}}},
 		&LenType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "len", FldName: "size", TypeSize: 4}}, Path: []string{"buf"}},
 	}},
+	{NR: 3, Name: "read$char_usb", CallName: "read", Args: []Type{
+		&ResourceType{TypeCommon: TypeCommon{TypeName: "fd_char_usb", FldName: "fd", TypeSize: 4}},
+		&PtrType{TypeCommon: TypeCommon{TypeName: "ptr", FldName: "buf", TypeSize: 4}, Type: &BufferType{TypeCommon: TypeCommon{TypeName: "array", ArgDir: 1, IsVarlen: true}}},
+		&LenType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "len", FldName: "count", TypeSize: 4}}, Path: []string{"buf"}},
+	}},
 	{NR: 3, Name: "read$eventfd", CallName: "read", Args: []Type{
 		&ResourceType{TypeCommon: TypeCommon{TypeName: "fd_event", FldName: "fd", TypeSize: 4}},
 		&PtrType{TypeCommon: TypeCommon{TypeName: "ptr", FldName: "val", TypeSize: 4}, Type: &IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "int64", TypeSize: 8, ArgDir: 1}}}},
@@ -43089,6 +43095,11 @@ var syscalls_386 = []*Syscall{
 		&ProcType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "proc", FldName: "id", TypeSize: 4}}, ValuesPerProc: 4},
 		&ConstType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "const", FldName: "flags", TypeSize: 4}}, Val: 2},
 	}, Ret: &ResourceType{TypeCommon: TypeCommon{TypeName: "fd", FldName: "ret", TypeSize: 4, ArgDir: 1}}},
+	{Name: "syz_open_dev$char_usb", CallName: "syz_open_dev", Args: []Type{
+		&ConstType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "const", FldName: "dev", TypeSize: 4}}, Val: 12},
+		&ConstType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "const", FldName: "major", TypeSize: 4}}, Val: 180},
+		&IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "intptr", FldName: "minor", TypeSize: 4}}},
+	}, Ret: &ResourceType{TypeCommon: TypeCommon{TypeName: "fd_char_usb", FldName: "ret", TypeSize: 4, ArgDir: 1}}},
 	{Name: "syz_open_dev$dmmidi", CallName: "syz_open_dev", Args: []Type{
 		&PtrType{TypeCommon: TypeCommon{TypeName: "ptr", FldName: "dev", TypeSize: 4}, Type: &BufferType{TypeCommon: TypeCommon{TypeName: "string", TypeSize: 13}, Kind: 2, Values: []string{"/dev/dmmidi#\x00"}}},
 		&IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "intptr", FldName: "id", TypeSize: 4}}},
@@ -44215,6 +44226,11 @@ var syscalls_386 = []*Syscall{
 		&PtrType{TypeCommon: TypeCommon{TypeName: "ptr", FldName: "buf", TypeSize: 4}, Type: &BufferType{TypeCommon: TypeCommon{TypeName: "string", TypeSize: 9}, Kind: 2, Values: []string{"threaded\x00"}}},
 		&LenType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "bytesize", FldName: "len", TypeSize: 4}}, BitSize: 8, Path: []string{"buf"}},
 	}},
+	{NR: 4, Name: "write$char_usb", CallName: "write", Args: []Type{
+		&ResourceType{TypeCommon: TypeCommon{TypeName: "fd_char_usb", FldName: "fd", TypeSize: 4}},
+		&PtrType{TypeCommon: TypeCommon{TypeName: "ptr", FldName: "buf", TypeSize: 4}, Type: &BufferType{TypeCommon: TypeCommon{TypeName: "array", IsVarlen: true}}},
+		&LenType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "len", FldName: "count", TypeSize: 4}}, Path: []string{"buf"}},
+	}},
 	{NR: 4, Name: "write$evdev", CallName: "write", Args: []Type{
 		&ResourceType{TypeCommon: TypeCommon{TypeName: "fd_evdev", FldName: "fd", TypeSize: 4}},
 		&PtrType{TypeCommon: TypeCommon{TypeName: "ptr", FldName: "data", TypeSize: 4}, Type: &ArrayType{TypeCommon: TypeCommon{TypeName: "array", IsVarlen: true}, Type: &StructType{Key: StructKey{Name: "input_event"}}}},
@@ -50397,6 +50413,7 @@ var consts_386 = []ConstValue{
 	{Name: "USB_LOW_SPEED_OPERATION", Value: 1},
 	{Name: "USB_LPM_SUPPORT", Value: 2},
 	{Name: "USB_LTM_SUPPORT", Value: 2},
+	{Name: "USB_MAJOR", Value: 180},
 	{Name: "USB_PORT_STAT_CONNECTION", Value: 1},
 	{Name: "USB_PORT_STAT_C_BH_RESET", Value: 32},
 	{Name: "USB_PORT_STAT_C_CONFIG_ERROR", Value: 128},
@@ -52223,4 +52240,4 @@ var consts_386 = []ConstValue{
 	{Name: "bpf_insn_load_imm_dw", Value: 24},
 }
 
-const revision_386 = "eb22b8a389910e3ec878475738f280bd61b00a09"
+const revision_386 = "38f83eeb8eb860a70e47d58558925a433b2db80c"
diff --git a/sys/linux/gen/amd64.go b/sys/linux/gen/amd64.go
@@ -40,6 +40,7 @@ var resources_amd64 = []*ResourceDesc{
 	{Name: "fd_cgroup_pid", Type: &IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "int32", TypeSize: 4}}}, Kind: []string{"fd", "fd_cgroup_pid"}, Values: []uint64{18446744073709551615}},
 	{Name: "fd_cgroup_subtree", Type: &IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "int32", TypeSize: 4}}}, Kind: []string{"fd", "fd_cgroup_subtree"}, Values: []uint64{18446744073709551615}},
 	{Name: "fd_cgroup_type", Type: &IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "int32", TypeSize: 4}}}, Kind: []string{"fd", "fd_cgroup_type"}, Values: []uint64{18446744073709551615}},
+	{Name: "fd_char_usb", Type: &IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "int32", TypeSize: 4}}}, Kind: []string{"fd", "fd_char_usb"}, Values: []uint64{18446744073709551615}},
 	{Name: "fd_dir", Type: &IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "int32", TypeSize: 4}}}, Kind: []string{"fd", "fd_dir"}, Values: []uint64{18446744073709551615, 18446744073709551516}},
 	{Name: "fd_dma_buf", Type: &IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "int32", TypeSize: 4}}}, Kind: []string{"fd", "fd_dma_buf"}, Values: []uint64{18446744073709551615}},
 	{Name: "fd_dmabuf", Type: &IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "int32", TypeSize: 4}}}, Kind: []string{"fd", "fd_dmabuf"}, Values: []uint64{18446744073709551615}},
@@ -39758,6 +39759,11 @@ var syscalls_amd64 = []*Syscall{
 		&PtrType{TypeCommon: TypeCommon{TypeName: "ptr", FldName: "buf", TypeSize: 8}, Type: &BufferType{TypeCommon: TypeCommon{TypeName: "array", ArgDir: 1, IsVarlen: true}}},
 		&LenType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "len", FldName: "size", TypeSize: 8}}, Path: []string{"buf"}},
 	}},
+	{Name: "read$char_usb", CallName: "read", Args: []Type{
+		&ResourceType{TypeCommon: TypeCommon{TypeName: "fd_char_usb", FldName: "fd", TypeSize: 4}},
+		&PtrType{TypeCommon: TypeCommon{TypeName: "ptr", FldName: "buf", TypeSize: 8}, Type: &BufferType{TypeCommon: TypeCommon{TypeName: "array", ArgDir: 1, IsVarlen: true}}},
+		&LenType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "len", FldName: "count", TypeSize: 8}}, Path: []string{"buf"}},
+	}},
 	{Name: "read$eventfd", CallName: "read", Args: []Type{
 		&ResourceType{TypeCommon: TypeCommon{TypeName: "fd_event", FldName: "fd", TypeSize: 4}},
 		&PtrType{TypeCommon: TypeCommon{TypeName: "ptr", FldName: "val", TypeSize: 8}, Type: &IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "int64", TypeSize: 8, ArgDir: 1}}}},
@@ -43611,6 +43617,11 @@ var syscalls_amd64 = []*Syscall{
 		&ProcType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "proc", FldName: "id", TypeSize: 8}}, ValuesPerProc: 4},
 		&ConstType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "const", FldName: "flags", TypeSize: 8}}, Val: 2},
 	}, Ret: &ResourceType{TypeCommon: TypeCommon{TypeName: "fd", FldName: "ret", TypeSize: 4, ArgDir: 1}}},
+	{Name: "syz_open_dev$char_usb", CallName: "syz_open_dev", Args: []Type{
+		&ConstType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "const", FldName: "dev", TypeSize: 8}}, Val: 12},
+		&ConstType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "const", FldName: "major", TypeSize: 8}}, Val: 180},
+		&IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "intptr", FldName: "minor", TypeSize: 8}}},
+	}, Ret: &ResourceType{TypeCommon: TypeCommon{TypeName: "fd_char_usb", FldName: "ret", TypeSize: 4, ArgDir: 1}}},
 	{Name: "syz_open_dev$dmmidi", CallName: "syz_open_dev", Args: []Type{
 		&PtrType{TypeCommon: TypeCommon{TypeName: "ptr", FldName: "dev", TypeSize: 8}, Type: &BufferType{TypeCommon: TypeCommon{TypeName: "string", TypeSize: 13}, Kind: 2, Values: []string{"/dev/dmmidi#\x00"}}},
 		&IntType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "intptr", FldName: "id", TypeSize: 8}}},
@@ -44737,6 +44748,11 @@ var syscalls_amd64 = []*Syscall{
 		&PtrType{TypeCommon: TypeCommon{TypeName: "ptr", FldName: "buf", TypeSize: 8}, Type: &BufferType{TypeCommon: TypeCommon{TypeName: "string", TypeSize: 9}, Kind: 2, Values: []string{"threaded\x00"}}},
 		&LenType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "bytesize", FldName: "len", TypeSize: 8}}, BitSize: 8, Path: []string{"buf"}},
 	}},
+	{NR: 1, Name: "write$char_usb", CallName: "write", Args: []Type{
+		&ResourceType{TypeCommon: TypeCommon{TypeName: "fd_char_usb", FldName: "fd", TypeSize: 4}},
+		&PtrType{TypeCommon: TypeCommon{TypeName: "ptr", FldName: "buf", TypeSize: 8}, Type: &BufferType{TypeCommon: TypeCommon{TypeName: "array", IsVarlen: true}}},
+		&LenType{IntTypeCommon: IntTypeCommon{TypeCommon: TypeCommon{TypeName: "len", FldName: "count", TypeSize: 8}}, Path: []string{"buf"}},
+	}},
 	{NR: 1, Name: "write$evdev", CallName: "write", Args: []Type{
 		&ResourceType{TypeCommon: TypeCommon{TypeName: "fd_evdev", FldName: "fd", TypeSize: 4}},
 		&PtrType{TypeCommon: TypeCommon{TypeName: "ptr", FldName: "data", TypeSize: 8}, Type: &ArrayType{TypeCommon: TypeCommon{TypeName: "array", IsVarlen: true}, Type: &StructType{Key: StructKey{Name: "input_event"}}}},
@@ -50933,6 +50949,7 @@ var consts_amd64 = []ConstValue{
 	{Name: "USB_LOW_SPEED_OPERATION", Value: 1},
 	{Name: "USB_LPM_SUPPORT", Value: 2},
 	{Name: "USB_LTM_SUPPORT", Value: 2},
+	{Name: "USB_MAJOR", Value: 180},
 	{Name: "USB_PORT_STAT_CONNECTION", Value: 1},
 	{Name: "USB_PORT_STAT_C_BH_RESET", Value: 32},
 	{Name: "USB_PORT_STAT_C_CONFIG_ERROR", Value: 128},
@@ -52760,4 +52777,4 @@ var consts_amd64 = []ConstValue{
 	{Name: "bpf_insn_load_imm_dw", Value: 24},
 }
 
-const revision_amd64 = "b025d70b7713cc48e9ab783fc35e2410b69a5736"
+const revision_amd64 = "35a61e3d9f82704660ae851088b5cab4dd788688"