1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
|
# Copyright 2017 syzkaller project authors. All rights reserved.
# Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.
# Recursive resources.
resource r0[r0] ### recursive resource r0->r0
resource r1[r2] ### recursive resource r1->r2->r1
resource r2[r1] ### recursive resource r2->r1->r2
foo$0(a0 ptr[out, r0], a1 ptr[out, r1], a2 ptr[out, r2])
# Recursive structs/unions.
sr1 {
f1 sr1 ### recursive declaration: sr1.f1 -> sr1 (mark some pointers as opt)
}
sr2 {
f1 sr3
f2 sr4
}
sr3 {
f1 ptr[in, sr3] ### recursive declaration: sr3.f1 -> sr3 (mark some pointers as opt)
}
sr4 {
f1 ptr[in, sr3]
f2 array[ptr[in, sr5], 4] ### recursive declaration: sr4.f2 -> sr5.f2 -> sr6.f1 -> sr4 (mark some pointers as opt)
}
sr5 [
f1 int32
f2 sr6
]
sr6 {
f1 sr4
}
sr7 {
f1 ptr[in, sr7, opt]
}
# Len target tests.
foo$100(a int32, b len[a])
foo$101(a len[a]) ### len target a refer to itself
foo$102(a ptr[in, len[a, int8]]) ### len target a refer to itself
foo$103(a int32, b len[c]) ### len target c does not exist
foo$104(a len[parent]) ### len target parent does not exist
foo$105(a ptr[in, int32], b ptr[in, array[len[a, int32]]])
foo$106(a int32, b ptr[in, csum[a, inet, int32]])
foo$107(a int32, b ptr[in, csum[c, inet, int32]]) ### csum target c does not exist
foo$108(a ptr[in, array[string]], b len[a]) ### len target a refer to an array with variable-size elements (do you mean bytesize?)
foo$109(a ptr[in, array[string]], b ptr[in, len[a, int32]]) ### len target a refer to an array with variable-size elements (do you mean bytesize?)
s1 {
f1 len[s2, int32] ### len target s2 does not exist
}
s2 {
f1 s1
}
foo$200(a ptr[in, s2])
foo$201(a ptr[in, s1])
# Resource ctor tests.
resource r100[int32] ### resource r100 can't be created (never mentioned as a syscall return value or output argument/field)
resource r101[int32]
resource r102[r101]
resource r103[r102]
resource r104[int8]
resource r105[int8]
resource r106[int8] ### resource r106 can't be created (never mentioned as a syscall return value or output argument/field)
resource r107[int8] ### resource r107 can't be created (never mentioned as a syscall return value or output argument/field)
foo$300(a r100)
foo$301(a ptr[out, array[r103]], b ptr[in, s300], c r107) r104
s300 {
f1 ptr[inout, s301]
f2 r106
}
s301 {
f2 r105
}
# Varlen field tests.
s400 {
f1 int32
f2 array[int8]
}
s401 {
f1 array[int8]
f2 array[int8]
} [packed]
s402 {
f1 array[int8] ### variable size field f1 in the middle of non-packed struct s402
f2 int32
}
u400 [
f1 array[int8]
f2 array[int16]
] [varlen]
u401 [
f1 filename ### variable size field f1 in non-varlen union u401
f2 text[x86_64] ### variable size field f2 in non-varlen union u401
f3 string ### variable size field f3 in non-varlen union u401
f4 string["foo", 10]
f5 string[sf400]
f6 string[sf401] ### variable size field f6 in non-varlen union u401
f7 s401 ### variable size field f7 in non-varlen union u401
]
u402 [
f1 int32
f2 int32
] [varlen]
s403 {
f1 u400 ### variable size field f1 in the middle of non-packed struct s403
f2 u402 ### variable size field f2 in the middle of non-packed struct s403
f3 int32
}
sf400 = "foo", "bar", "baz"
sf401 = "a", "b", "cd"
|
