1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
|
// Copyright 2024 syzkaller project authors. All rights reserved.
// Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.
#include "include/fs.h"
#include "include/uapi/file_operations.h"
#include "include/uapi/unused_ioctl.h"
enum {
FOO_IOCTL12 = _IOR('c', 12, int),
};
enum {
config_foo
};
static void foo_open() {}
static void foo_read() {}
static void foo_write() {}
static void foo_mmap() {}
static void foo_mmap2() {}
static void foo_ioctl2(unsigned int cmd, unsigned long arg) {
switch (cmd) {
case FOO_IOCTL6:
case FOO_IOCTL7:
default:
}
}
static void foo_ioctl(void* file, unsigned int cmd, unsigned long arg) {
switch (cmd) {
case FOO_IOCTL1:
case FOO_IOCTL2:
case FOO_IOCTL3:
case FOO_IOCTL4:
case FOO_IOCTL5:
case FOO_IOCTL10:
case FOO_IOCTL11:
case FOO_IOCTL12:
}
foo_ioctl2(cmd, arg);
}
const struct file_operations foo = {
.open = foo_open,
.read = foo_read,
.write = foo_write,
.unlocked_ioctl = foo_ioctl,
// Such code happens after macro expansion,
// we want to extract the first function name.
.mmap = ((config_foo) ? foo_mmap : foo_mmap2),
};
static void proc_open() {}
static void proc_read() {}
static void proc_write() {}
static void proc_ioctl(void* file, unsigned int cmd, unsigned long arg) {}
const struct file_operations proc_ops[] = {
{
.open = proc_open,
.read_iter = proc_read,
.write_iter = proc_write,
},
{
.open = proc_open,
.unlocked_ioctl = proc_ioctl,
},
};
#define UNUSED_IOCTL2 _IO('c', 2)
static void unused_ioctl(void* file, unsigned int cmd, unsigned long arg) {
switch (cmd) {
case UNUSED_IOCTL1:
case UNUSED_IOCTL2:
}
}
const struct file_operations unused = {
.unlocked_ioctl = unused_ioctl,
};
|
