prog: fix pointer direction validation

Currently the added test description leads to crashes:

--- FAIL: TestMinimizeRandom (0.12s)
	prog_test.go:20: seed=1480014002950172453
panic: syscall syz_test$regression0: pointer arg 'f0' has output direction [recovered]
	panic: syscall syz_test$regression0: pointer arg 'f0' has output direction

The description is OK. Fix that.

2 files changed, 9 insertions, 1 deletions

diff --git a/prog/validation.go b/prog/validation.go
index c30e2eecd..4ef514490 100644
--- a/prog/validation.go
+++ b/prog/validation.go
@@ -117,7 +117,7 @@ func (c *Call) validate(ctx *validCtx) error {
 					return fmt.Errorf("syscall %v: vma arg '%v' has size 0", c.Meta.Name, typ.Name())
 				}
 			case *sys.PtrType:
-				if arg.Type.Dir() != sys.DirIn {
+				if arg.Type.Dir() == sys.DirOut {
 					return fmt.Errorf("syscall %v: pointer arg '%v' has output direction", c.Meta.Name, typ.Name())
 				}
 				if arg.Res == nil && !typ.Optional() {
diff --git a/sys/test.txt b/sys/test.txt
index a4381c1ad..e6865b467 100644
--- a/sys/test.txt
+++ b/sys/test.txt
@@ -187,3 +187,11 @@ syz_end_var_struct {
 	f1	const[0x42, int32be]
 	f2	flags[syz_end_flags, int64be]
 } [packed]
+
+# Regression tests.
+
+syz_test$regression0(a0 ptr[inout, syz_regression0_struct])
+
+syz_regression0_struct {
+	f0	buffer[out]
+}