1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
|
# Copyright 2017 syzkaller project authors. All rights reserved.
# Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.
# Errors that happen during checking phase.
# Recursive resources.
resource r0[r0] ### recursive resource r0->r0
resource r1[r2] ### recursive resource r1->r2->r1
resource r2[r1] ### recursive resource r2->r1->r2
resource r3[int32] ### unused resource r3
foo$0(a0 ptr[out, r0], a1 ptr[out, r1], a2 ptr[out, r2])
foo$1(a0 r0, a1 r1, a2 r2)
# Recursive structs/unions.
sr1 {
f1 sr1 ### recursive declaration: sr1.f1 -> sr1 (mark some pointers as opt)
}
sr2 {
f1 sr3
f2 sr4
}
sr3 {
f1 ptr[in, sr3] ### recursive declaration: sr3.f1 -> sr3 (mark some pointers as opt)
}
sr4 {
f1 ptr[in, sr3]
f2 array[ptr[in, sr5], 4] ### recursive declaration: sr4.f2 -> sr5.f2 -> sr6.f1 -> sr4 (mark some pointers as opt)
}
sr5 [
f1 int32
f2 sr6
]
sr6 {
f1 sr4
}
sr7 {
f1 ptr[in, sr7, opt]
}
type templ_sr[T] {
f T
}
sr8 {
f templ_sr[sr8] ### recursive declaration: sr8.f -> templ_sr[sr8].f -> sr8 (mark some pointers as opt)
}
sr9 {
f templ_sr[ptr[in, sr9]] ### recursive declaration: sr9.f -> templ_sr[ptr[in, sr9]].f -> sr9 (mark some pointers as opt)
}
use_sr {
u2 u2
u3 u3
s3 s3
s4 s4
s6 s6
s8 s8
sr1 sr1
sr2 sr2
sr5 sr5
sr7 sr7
sr8 sr8
sr9 sr9
s400 s400
s401 s401
u400 u400
u401 u401
s402 s402
s403 s403
} [packed]
foo$sr0(a ptr[in, use_sr])
# Len target tests.
foo$100(a int32, b len[a])
foo$101(a len[a]) ### len target a refers to itself
foo$102(a ptr[in, len[a, int8]]) ### len target a refers to itself
foo$103(a int32, b len[c]) ### len target c does not exist
foo$104(a len[parent]) ### len target parent does not exist
foo$105(a ptr[in, int32], b ptr[in, array[len[a, int32]]])
foo$106(a int32, b ptr[in, csum[a, inet, int32]])
foo$107(a int32, b ptr[in, csum[c, inet, int32]]) ### csum target c does not exist
s1 {
f1 len[s2, int32] ### len target s2 does not exist
}
s2 {
f1 s1
}
s3 {
f1 int8
} [size[0]] ### size attribute has bad value 0, expect [1, 1<<20]
s4 {
f1 int8
} [size[1000000000]] ### size attribute has bad value 1000000000, expect [1, 1<<20]
s6 {
f1 int8
f2 array[int8]
} [size[10]] ### varlen struct s6 has size attribute
s7 {
f1 int32
f2 u0
}
s8 {
f1 int8
} [align[7]] ### bad struct s8 alignment 7 (must be a sane power of 2)
u0 [
f len[f1, int32] ### len target f1 does not exist
]
u1 [
f1 ptr[in, array[int8]]
f2 len[f1, int32] ### len target f1 does not exist
]
u2 [
f1 int8
] [size[0]] ### size attribute has bad value 0, expect [1, 1<<20]
u3 [
f1 int8
] [varlen, size[8]] ### varlen union u3 has size attribute
foo$200(a ptr[in, s2])
foo$201(a ptr[in, s1])
foo$202(a ptr[in, s7])
foo$203(a u1)
foo$204(a ptr[in, slen1])
slen1 {
f0 len[parent, int32]
f1 len[parent:f0, int32] ### parent can't be part of path expressions
f2 len[slen21:a, int32] ### len target a does not exist
f3 len[f0:parent, int32] ### parent can't be part of path expressions
f4 len[slen2:f, int32] ### len path slen2 does not refer to a struct
f5 len[slen22:f, int32] ### len path slen22 does not refer to a struct
f6 len[syscall, int32] ### no argument name after syscall reference
f7 len[syscall:b, int32] ### len target b does not exist
f8 offsetof[parent, int32] ### offsetof must refer to fields
f9 offsetof[slen1, int32] ### offsetof must refer to fields
slen2 ptr[in, array[slen2]]
slen21 slen2
slen22 array[slen2]
}
slen2 {
f int32
}
# Resource ctor tests.
resource r100[int32] ### resource r100 can't be created (never mentioned as a syscall return value or output argument/field)
resource r101[int32]
resource r102[r101]
resource r103[r102]
resource r104[int8]
resource r105[int8]
resource r106[int8] ### resource r106 can't be created (never mentioned as a syscall return value or output argument/field)
resource r107[int8] ### resource r107 can't be created (never mentioned as a syscall return value or output argument/field)
resource r108[int8] ### resource r108 is never used as an input(such resources are not useful)
foo$300(a0 r100, a1 r101, a2 r102, a3 r103, a4 r104)
foo$301(a ptr[out, array[r103]], b ptr[in, s300], c r107) r104
foo$302() r108
s300 {
f1 ptr[inout, s301]
f2 r106
}
s301 {
f2 r105
}
# Varlen field tests.
s400 {
f1 int32
f2 array[int8]
}
s401 {
f1 array[int8]
f2 array[int8]
} [packed]
s402 {
f1 array[int8] ### variable size field f1 in the middle of non-packed struct s402
f2 int32
}
u400 [
f1 array[int8]
f2 array[int16]
] [varlen]
u401 [
f1 filename ### variable size field f1 in non-varlen union u401
f2 text[x86_64] ### variable size field f2 in non-varlen union u401
f3 string ### variable size field f3 in non-varlen union u401
f4 string["foo", 10]
f5 string[sf400]
f6 string[sf401] ### variable size field f6 in non-varlen union u401
f7 s401 ### variable size field f7 in non-varlen union u401
]
u402 [
f1 int32
f2 int32
] [varlen]
s403 {
f1 u400 ### variable size field f1 in the middle of non-packed struct s403
f2 u402 ### variable size field f2 in the middle of non-packed struct s403
f3 int32
}
s404 { ### unused struct s404
f1 int8
}
u404 [ ### unused union u404
f1 int8
]
sf400 = "foo", "bar", "baz"
sf401 = "a", "b", "cd"
sf402 = "a", "b" ### unused string flags sf402
# Const argument checks.
foo$500(a int32[3:2]) ### bad int range [3:2]
foo$501(a ptr[in, int32[3:2]]) ### bad int range [3:2]
foo$502(a ptr[in, string["foo", C1]]) ### string value "foo\x00" exceeds buffer length 1
foo$503(a ptr[in, proc[1000, 1, int8]]) ### values starting from 1000 overflow base type
foo$504(a ptr[in, proc[20, 10, int8]]) ### values starting from 20 with step 10 overflow base type for 32 procs
foo$505(a proc[20, 0]) ### proc per-process values must not be 0
foo$506(a ptr[in, array[int32, 0]]) ### arrays of size 0 are not supported
foo$507(a ptr[in, array[int32, 0:0]]) ### arrays of size 0 are not supported
foo$508(a ptr[in, string["foo", 3]]) ### string value "foo\x00" exceeds buffer length 3
foo$509(a int8['b':'a']) ### bad int range [98:97]
foo$510(a type500)
foo$511(a int32[-10:-20]) ### bad int range [18446744073709551606:18446744073709551596]
foo$512(a ptr[in, array[int8, -2:-1]]) ### bad size range [18446744073709551614:18446744073709551615]
foo$513(a ptr[in, array[int8, -2:2]]) ### bad size range [18446744073709551614:2]
foo$514(a vma[-2:2]) ### bad size range [18446744073709551614:2]
foo$515(a ptr[in, proc[1, -10, int64]]) ### values starting from 1 with step 18446744073709551606 overflow base type for 32 procs
foo$516(a ptr[in, intptr[0:2, 1]]) ### bad int alignment 1
foo$517(a intptr[0:0xffffffff, 0]) ### bad int alignment 0
foo$518(a int64[1:100, -1]) ### int alignment 18446744073709551615 is too large for range [1:100]
foo$519(a int64[0:10, 512]) ### int alignment 512 is too large for range [0:10]
foo$520(a int8[0:16, 0xffff]) ### int alignment 65535 is too large for range [0:16]
foo$521(a int32[9:10, 8]) ### int alignment 8 is too large for range [9:10]
foo$522(a int8[0:-1, 1000]) ### int alignment 1000 is too large for range [0:255]
foo$523(a int8[0:256]) ### int range [0:256] is too large for base type of size 8
foo$524(a int8[-1000:0]) ### int range [18446744073709550616:0] is too large for base type of size 8
foo$525(a int8[-256:256]) ### int range [18446744073709551360:256] is too large for base type of size 8
foo$526(a int8[-255:255]) ### int range [18446744073709551361:255] is too large for base type of size 8
foo$527(a int16[-40000:40000]) ### int range [18446744073709511616:40000] is too large for base type of size 16
foo$528(a ptr[in, s405])
foo$529(a ptr[in, string[`abcdde`, 3]]) ### string value "\xab\xcd\xde\x00" exceeds buffer length 3
foo$530(a ptr[in, const[0x1ab, int8]]) ### const val 0x1ab does not fit into 8 bits
foo$531(a ptr[in, const[0xffffffffffffffab, int8]])
foo$532(a ptr[in, const[0x7234567812345678, int64]])
foo$533(a ptr[in, const[0x12, int8:4]]) ### const val 0x12 does not fit into 4 bits
foo$534(a ptr[in, flags[large_flags, int8]]) ### large_flags U16_MAX=0xffff doesn't fit into 8 bits
large_flags = U8_MAX, U16_MAX
type type500 proc[C1, 8, int8] ### values starting from 1 with step 8 overflow base type for 32 procs
type type501 int8 ### unused type type501
type type502[C] const[C, int8] ### unused type type502
s405 {
f1 int16:8[-256:0] ### int range [18446744073709551360:0] is too large for base type of size 8
f2 int16:8[0:256] ### int range [0:256] is too large for base type of size 8
f3 int64:16[-65541:-10] ### int range [18446744073709486075:18446744073709551606] is too large for base type of size 16
f4 int16:8[-255:0] ### int range [18446744073709551361:0] is too large for base type of size 8
}
|