etc

~ scripts and random things
git clone https://github.com/djnnvx/etc.git
kernel.config (6588B)
      1 # Linux USB stack fuzzing VM — minimal kernel configuration fragment.
      2 #
      3 # Applied over `make allnoconfig` using:
      4 #   scripts/kconfig/merge_config.sh -m .config ../qemu/kernel.config
      5 #   make olddefconfig
      6 #
      7 # Targets: USB core/enumeration, USB gadget framework, host controller drivers.
      8 # Instrument with KASAN + UBSAN + KCOV for maximum crash visibility.
      9 # syzkaller uses KCOV for coverage feedback and KASAN to detect memory errors.
     10 
     11 # ── basic 64-bit SMP kernel ──────────────────────────────────────────────
     12 CONFIG_64BIT=y
     13 CONFIG_SMP=y
     14 CONFIG_NR_CPUS=4
     15 CONFIG_PREEMPT_NONE=y
     16 CONFIG_HZ_100=y
     17 
     18 # ── needed for kernel to function correctly ──────────────────────────────
     19 CONFIG_PRINTK=y
     20 CONFIG_BUG=y
     21 CONFIG_ELF_CORE=n
     22 CONFIG_FUTEX=y
     23 CONFIG_EPOLL=y
     24 CONFIG_SIGNALFD=y
     25 CONFIG_EVENTFD=y
     26 CONFIG_AIO=y
     27 CONFIG_ADVISE_SYSCALLS=y
     28 CONFIG_MEMFD_CREATE=y
     29 CONFIG_POSIX_TIMERS=y
     30 
     31 # ── memory ───────────────────────────────────────────────────────────────
     32 CONFIG_MEMORY_ISOLATION=n
     33 CONFIG_SLUB=y
     34 # KASAN requires slab merging disabled — merged slabs collapse redzone separation
     35 CONFIG_SLAB_MERGE_DEFAULT=n
     36 
     37 # ── networking ───────────────────────────────────────────────────────────
     38 CONFIG_NET=y
     39 CONFIG_INET=y
     40 CONFIG_PACKET=y
     41 CONFIG_UNIX=y
     42 CONFIG_IPV6=n
     43 CONFIG_TCP_CONG_CUBIC=y
     44 CONFIG_DEFAULT_TCP_CONG="cubic"
     45 CONFIG_NETFILTER=n
     46 CONFIG_NET_SCHED=n
     47 
     48 # ── network device drivers ───────────────────────────────────────────────
     49 CONFIG_NETDEVICES=y
     50 CONFIG_ETHERNET=y
     51 CONFIG_NET_VENDOR_INTEL=y
     52 CONFIG_E1000=y
     53 CONFIG_VIRTIO_NET=y
     54 
     55 # ── PCI (needed for e1000 and USB host controllers) ──────────────────────
     56 CONFIG_PCI=y
     57 CONFIG_PCIEPORTBUS=y
     58 
     59 # ── USB core ─────────────────────────────────────────────────────────────
     60 CONFIG_USB_SUPPORT=y
     61 CONFIG_USB=y
     62 CONFIG_USB_PCI=y
     63 CONFIG_USB_HCD_TEST_MODE=n
     64 CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
     65 
     66 # ── USB host controllers (xHCI + EHCI exercised by dummy_hcd enumeration) ─
     67 CONFIG_USB_XHCI_HCD=y
     68 CONFIG_USB_XHCI_PCI=y
     69 CONFIG_USB_EHCI_HCD=y
     70 CONFIG_USB_EHCI_PCI=y
     71 CONFIG_USB_OHCI_HCD=y
     72 CONFIG_USB_OHCI_HCD_PCI=y
     73 
     74 # ── raw_gadget + dummy_hcd — the core of syz_usb_connect fuzzing ─────────
     75 #
     76 # dummy_hcd acts as both a USB host controller and a USB device controller
     77 # simultaneously. raw_gadget exposes the device side to userspace, so
     78 # syzkaller can present arbitrary USB descriptors to the kernel's USB core.
     79 #
     80 # Attack flow: syzkaller writes crafted descriptors via raw_gadget →
     81 #   USB core parses them (CONFIG_USB) → host controller driver handles URBs
     82 #   (CONFIG_USB_XHCI_HCD etc.) → class drivers bind (HID, storage, etc.)
     83 CONFIG_USB_GADGET=y
     84 CONFIG_USB_DUMMY_HCD=y
     85 CONFIG_USB_RAW_GADGET=y
     86 
     87 # ── USB gadget framework (configfs interface) ────────────────────────────
     88 # Exercised by syzkaller-gadget-fw profile: mkdir/write on configfs paths.
     89 CONFIG_CONFIGFS_FS=y
     90 CONFIG_USB_CONFIGFS=y
     91 CONFIG_USB_CONFIGFS_SERIAL=y
     92 CONFIG_USB_CONFIGFS_ACM=y
     93 CONFIG_USB_CONFIGFS_NCM=y
     94 CONFIG_USB_CONFIGFS_MASS_STORAGE=y
     95 CONFIG_USB_CONFIGFS_F_HID=y
     96 CONFIG_USB_CONFIGFS_F_UVC=y
     97 
     98 # ── USB class drivers (bind when fake device enumerates via dummy_hcd) ───
     99 CONFIG_USB_HID=y
    100 CONFIG_HID=y
    101 CONFIG_HID_GENERIC=y
    102 CONFIG_USB_HIDDEV=y
    103 CONFIG_USB_STORAGE=y
    104 CONFIG_USB_ACM=y
    105 CONFIG_USB_SERIAL=y
    106 CONFIG_USB_SERIAL_GENERIC=y
    107 
    108 # ── modules ──────────────────────────────────────────────────────────────
    109 CONFIG_MODULES=y
    110 CONFIG_MODULE_UNLOAD=y
    111 CONFIG_MODULE_FORCE_UNLOAD=n
    112 
    113 # ── filesystem / initramfs ───────────────────────────────────────────────
    114 CONFIG_TMPFS=y
    115 CONFIG_PROC_FS=y
    116 CONFIG_PROC_SYSCTL=y
    117 CONFIG_SYSFS=y
    118 CONFIG_DEVTMPFS=y
    119 CONFIG_DEVTMPFS_MOUNT=y
    120 CONFIG_BLK_DEV_INITRD=y
    121 CONFIG_RD_GZIP=y
    122 CONFIG_INITRAMFS_SOURCE=""
    123 
    124 # ── TTY / serial console ─────────────────────────────────────────────────
    125 CONFIG_TTY=y
    126 CONFIG_VT=n
    127 CONFIG_SERIAL_8250=y
    128 CONFIG_SERIAL_8250_CONSOLE=y
    129 CONFIG_SERIAL_8250_NR_UARTS=4
    130 
    131 # ── clock / timers ───────────────────────────────────────────────────────
    132 CONFIG_RTC_CLASS=y
    133 CONFIG_HW_RANDOM=y
    134 
    135 # ── namespaces (syzkaller sandbox support) ───────────────────────────────
    136 CONFIG_NAMESPACES=y
    137 CONFIG_UTS_NS=y
    138 CONFIG_IPC_NS=y
    139 CONFIG_PID_NS=y
    140 CONFIG_NET_NS=y
    141 CONFIG_USER_NS=y
    142 CONFIG_CGROUPS=y
    143 
    144 # ── disable as much as possible for fast boot ────────────────────────────
    145 CONFIG_ACPI=n
    146 CONFIG_ACPI_SLEEP=n
    147 CONFIG_HIBERNATION=n
    148 CONFIG_SUSPEND=n
    149 CONFIG_PM=n
    150 CONFIG_SOUND=n
    151 CONFIG_DRM=n
    152 CONFIG_FB=n
    153 CONFIG_FRAMEBUFFER_CONSOLE=n
    154 CONFIG_INPUT=n
    155 CONFIG_SERIO=n
    156 CONFIG_WIRELESS=n
    157 CONFIG_RFKILL=n
    158 CONFIG_CRYPTO_HW=n
    159 
    160 # ── sanitizers (KASAN, KCOV, UBSAN) ─────────────────────────────────────
    161 # KASAN: catches heap overflows, UAF, OOB reads.
    162 # Overhead: ~2x slowdown, 8x extra RAM. Use -m 2048M in QEMU.
    163 CONFIG_KASAN=y
    164 CONFIG_KASAN_GENERIC=y
    165 CONFIG_KASAN_OUTLINE=y
    166 CONFIG_KASAN_TAGS=n
    167 
    168 # UBSAN: catches undefined behaviour (integer overflow, OOB, etc.)
    169 CONFIG_UBSAN=y
    170 CONFIG_UBSAN_BOUNDS=y
    171 CONFIG_UBSAN_SANITIZE_ALL=y
    172 
    173 CONFIG_DEBUG_LIST=y
    174 
    175 # KCOV: syzkaller's coverage feedback mechanism.
    176 # syzkaller reads /sys/kernel/debug/kcov per-task to guide mutation.
    177 CONFIG_KCOV=y
    178 CONFIG_KCOV_ENABLE_COMPARISONS=y
    179 CONFIG_KCOV_INSTRUMENT_ALL=y
    180 
    181 CONFIG_DEBUG_FS=y
    182 CONFIG_PANIC_ON_OOPS=y
    183 
    184 CONFIG_CC_OPTIMIZE_FOR_SIZE=n
    185 CONFIG_KERNEL_XZ=n
    186 CONFIG_KERNEL_GZIP=y