diff options
| author | Dmitry Vyukov <dvyukov@google.com> | 2018-12-27 13:08:02 +0100 |
|---|---|---|
| committer | Dmitry Vyukov <dvyukov@google.com> | 2018-12-27 13:11:57 +0100 |
| commit | 2b084c988691b067fb5b28a5f9f7693c27670d18 (patch) | |
| tree | 8e0e93bb9bfcc47e31418f00b1af4a168e8878fb /executor/common_test.h | |
| parent | 43cf01dd41b16b2aa2840291391031cf0b56b950 (diff) | |
pkg/csource: use 0 for missing syscall args
We don't specify trailing unused args for some syscalls
(e.g. ioctl that does not use its arg).
Executor always filled tailing unsed args with 0's
but pkg/csource didn't. Some such syscalls actually
check that the unsed arg is 0 and as the result failed with C repro.
We could statically check and eliminate all such cases,
but it turns out the warning fires in 1500+ cases:
https://gist.githubusercontent.com/dvyukov/e59ba1d9a211ee32fa0ba94fab86a943/raw/a3ace5a63f7281f0298f51ea9842ead1e4713418/gistfile1.txt
So instead fill such args with 0's in pkg/csource too.
Diffstat (limited to 'executor/common_test.h')
| -rw-r--r-- | executor/common_test.h | 30 |
1 files changed, 30 insertions, 0 deletions
diff --git a/executor/common_test.h b/executor/common_test.h index 592fafced..e0390eb68 100644 --- a/executor/common_test.h +++ b/executor/common_test.h @@ -51,6 +51,36 @@ static long syz_compare(long want, long want_len, long got, long got_len) } #endif +#if SYZ_EXECUTOR || __NR_syz_compare_int +#include <errno.h> +#include <stdarg.h> + +// syz_compare_int$4(n const[2], v0 intptr, v1 intptr, v2 intptr, v3 intptr) +static long syz_compare_int(long n, ...) +{ + va_list args; + va_start(args, n); + long v0 = va_arg(args, long); + long v1 = va_arg(args, long); + long v2 = va_arg(args, long); + long v3 = va_arg(args, long); + va_end(args); + if (n < 2 || n > 4) + return errno = E2BIG, -1; + if (n <= 2 && v2 != 0) + return errno = EFAULT, -1; + if (n <= 3 && v3 != 0) + return errno = EFAULT, -1; + if (v0 != v1) + return errno = EINVAL, -1; + if (n > 2 && v0 != v2) + return errno = EINVAL, -1; + if (n > 3 && v0 != v3) + return errno = EINVAL, -1; + return 0; +} +#endif + #if SYZ_EXECUTOR || SYZ_SANDBOX_NONE static void loop(); static int do_sandbox_none(void) |
