From 160f76ea821e29048389ecb03e8961c4e9cdf519 Mon Sep 17 00:00:00 2001
From: Aleksandr Nogikh <nogikh@google.com>
Date: Thu, 5 Oct 2023 17:40:16 +0200
Subject: pkg/compiler: support (in) for union fields

We had a problem -- using inout ANYUNION leads to syzkaller generating
copyout instructions for fmt[X, resource] types.

Add a validation rule to detect this during tests.

Fix this by supporting (in) for union fields. Previously, all union
field direction attributes were banned as they were making things more
complicated.

The (in) attribute is definitely safe and allows for more flexibility.
---
 pkg/compiler/attrs.go            | 1 +
 pkg/compiler/check.go            | 2 +-
 pkg/compiler/testdata/errors.txt | 3 ++-
 pkg/compiler/types.go            | 8 ++++----
 4 files changed, 8 insertions(+), 6 deletions(-)

(limited to 'pkg/compiler')

diff --git a/pkg/compiler/attrs.go b/pkg/compiler/attrs.go
index 46ba89b23..dc10dbc9b 100644
--- a/pkg/compiler/attrs.go
+++ b/pkg/compiler/attrs.go
@@ -31,6 +31,7 @@ var (
 	structAttrs      = makeAttrs(attrPacked, attrSize, attrAlign)
 	unionAttrs       = makeAttrs(attrVarlen, attrSize)
 	structFieldAttrs = makeAttrs(attrIn, attrOut, attrInOut, attrOutOverlay)
+	unionFieldAttrs  = makeAttrs(attrIn) // Let's still support attrIn, it's safe.
 	callAttrs        = make(map[string]*attrDesc)
 )
 
diff --git a/pkg/compiler/check.go b/pkg/compiler/check.go
index 4b2dd1330..5f7bb7108 100644
--- a/pkg/compiler/check.go
+++ b/pkg/compiler/check.go
@@ -185,7 +185,7 @@ func (comp *compiler) checkStructFields(n *ast.Struct, typ, name string) {
 	hasDirections, hasOutOverlay := false, false
 	for fieldIdx, f := range n.Fields {
 		if n.IsUnion {
-			comp.parseAttrs(nil, f, f.Attrs)
+			comp.parseAttrs(unionFieldAttrs, f, f.Attrs)
 			continue
 		}
 		attrs := comp.parseAttrs(structFieldAttrs, f, f.Attrs)
diff --git a/pkg/compiler/testdata/errors.txt b/pkg/compiler/testdata/errors.txt
index 9d625a34b..83b62cfb6 100644
--- a/pkg/compiler/testdata/errors.txt
+++ b/pkg/compiler/testdata/errors.txt
@@ -419,8 +419,9 @@ union$overlay0 [
 ]
 
 union$directions [
-	f1	int32	(in)	### unknown arg/field f1 attribute in
+	f1	int32	(in)
 	f2	int32	(out)	### unknown arg/field f2 attribute out
+	f3	int32	(inout)	### unknown arg/field f3 attribute inout
 ]
 
 
diff --git a/pkg/compiler/types.go b/pkg/compiler/types.go
index 85a5bd527..099ab0009 100644
--- a/pkg/compiler/types.go
+++ b/pkg/compiler/types.go
@@ -1104,9 +1104,9 @@ ANYUNION [
 	ANYRES16	ANYRES16
 	ANYRES32	ANYRES32
 	ANYRES64	ANYRES64
-	ANYRESDEC	fmt[dec, ANYRES64]
-	ANYRESHEX	fmt[hex, ANYRES64]
-	ANYRESOCT	fmt[oct, ANYRES64]
+	ANYRESDEC	fmt[dec, ANYRES64] (in)
+	ANYRESHEX	fmt[hex, ANYRES64] (in)
+	ANYRESOCT	fmt[oct, ANYRES64] (in)
 ] [varlen]
 
 ANYPTRS [
@@ -1120,7 +1120,7 @@ resource ANYRES32[int32]: -1, 0
 resource ANYRES64[int64]: -1, 0
 
 syz_builtin0(a ptr[in, ANYPTRS]) (disabled)
-syz_builtin1(a ptr[out, ANYUNION]) (disabled)
+syz_builtin1(a ptr[inout, ANYUNION]) (disabled)
 syz_builtin2() ANYRES8 (disabled)
 syz_builtin3() ANYRES16 (disabled)
 syz_builtin4() ANYRES32 (disabled)
-- 
cgit mrf-deployment