# Copyright 2017 syzkaller project authors. All rights reserved. # Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file. # Recursive resources. resource r0[r0] ### recursive resource r0->r0 resource r1[r2] ### recursive resource r1->r2->r1 resource r2[r1] ### recursive resource r2->r1->r2 resource r3[int32] ### unused resource r3 foo$0(a0 ptr[out, r0], a1 ptr[out, r1], a2 ptr[out, r2]) # Recursive structs/unions. sr1 { f1 sr1 ### recursive declaration: sr1.f1 -> sr1 (mark some pointers as opt) } sr2 { f1 sr3 f2 sr4 } sr3 { f1 ptr[in, sr3] ### recursive declaration: sr3.f1 -> sr3 (mark some pointers as opt) } sr4 { f1 ptr[in, sr3] f2 array[ptr[in, sr5], 4] ### recursive declaration: sr4.f2 -> sr5.f2 -> sr6.f1 -> sr4 (mark some pointers as opt) } sr5 [ f1 int32 f2 sr6 ] sr6 { f1 sr4 } sr7 { f1 ptr[in, sr7, opt] } type templ_sr[T] { f T } sr8 { f templ_sr[sr8] ### recursive declaration: sr8.f -> templ_sr[sr8].f -> sr8 (mark some pointers as opt) } sr9 { f templ_sr[ptr[in, sr9]] ### recursive declaration: sr9.f -> templ_sr[ptr[in, sr9]].f -> sr9 (mark some pointers as opt) } use_sr { u2 u2 u3 u3 s3 s3 s4 s4 s6 s6 sr1 sr1 sr2 sr2 sr5 sr5 sr7 sr7 sr8 sr8 sr9 sr9 s400 s400 s401 s401 u400 u400 u401 u401 s402 s402 s403 s403 } [packed] foo$sr0(a ptr[in, use_sr]) # Len target tests. foo$100(a int32, b len[a]) foo$101(a len[a]) ### len target a refer to itself foo$102(a ptr[in, len[a, int8]]) ### len target a refer to itself foo$103(a int32, b len[c]) ### len target c does not exist foo$104(a len[parent]) ### len target parent does not exist foo$105(a ptr[in, int32], b ptr[in, array[len[a, int32]]]) foo$106(a int32, b ptr[in, csum[a, inet, int32]]) foo$107(a int32, b ptr[in, csum[c, inet, int32]]) ### csum target c does not exist s1 { f1 len[s2, int32] ### len target s2 does not exist } s2 { f1 s1 } s3 { f1 int8 } [size[0]] ### size attribute has bad value 0, expect [1, 1<<20] s4 { f1 int8 } [size[1000000000]] ### size attribute has bad value 1000000000, expect [1, 1<<20] s6 { f1 int8 f2 array[int8] } [size[10]] ### varlen struct s6 has size attribute u1 [ f1 ptr[in, array[int8]] f2 len[f1, int32] ### len target f1 does not exist ] u2 [ f1 int8 ] [size[0]] ### size attribute has bad value 0, expect [1, 1<<20] u3 [ f1 int8 ] [varlen, size[8]] ### varlen union u3 has size attribute foo$200(a ptr[in, s2]) foo$201(a ptr[in, s1]) foo$202(a u1) # Resource ctor tests. resource r100[int32] ### resource r100 can't be created (never mentioned as a syscall return value or output argument/field) resource r101[int32] resource r102[r101] resource r103[r102] resource r104[int8] resource r105[int8] resource r106[int8] ### resource r106 can't be created (never mentioned as a syscall return value or output argument/field) resource r107[int8] ### resource r107 can't be created (never mentioned as a syscall return value or output argument/field) foo$300(a r100) foo$301(a ptr[out, array[r103]], b ptr[in, s300], c r107) r104 s300 { f1 ptr[inout, s301] f2 r106 } s301 { f2 r105 } # Varlen field tests. s400 { f1 int32 f2 array[int8] } s401 { f1 array[int8] f2 array[int8] } [packed] s402 { f1 array[int8] ### variable size field f1 in the middle of non-packed struct s402 f2 int32 } u400 [ f1 array[int8] f2 array[int16] ] [varlen] u401 [ f1 filename ### variable size field f1 in non-varlen union u401 f2 text[x86_64] ### variable size field f2 in non-varlen union u401 f3 string ### variable size field f3 in non-varlen union u401 f4 string["foo", 10] f5 string[sf400] f6 string[sf401] ### variable size field f6 in non-varlen union u401 f7 s401 ### variable size field f7 in non-varlen union u401 ] u402 [ f1 int32 f2 int32 ] [varlen] s403 { f1 u400 ### variable size field f1 in the middle of non-packed struct s403 f2 u402 ### variable size field f2 in the middle of non-packed struct s403 f3 int32 } s404 { ### unused struct s404 f1 int8 } u404 [ ### unused union u404 f1 int8 ] sf400 = "foo", "bar", "baz" sf401 = "a", "b", "cd" sf402 = "a", "b" ### unused string flags sf402 # Const argument checks. foo$500(a int32[3:2]) ### bad int range [3:2] foo$501(a ptr[in, int32[3:2]]) ### bad int range [3:2] foo$502(a ptr[in, string["foo", C1]]) ### string value "foo\x00" exceeds buffer length 1 foo$503(a ptr[in, proc[1000, 1, int8]]) ### values starting from 1000 overflow base type foo$504(a ptr[in, proc[20, 10, int8]]) ### values starting from 20 with step 10 overflow base type for 32 procs foo$505(a proc[20, 0]) ### proc per-process values must not be 0 foo$506(a ptr[in, array[int32, 0]]) ### arrays of size 0 are not supported foo$507(a ptr[in, array[int32, 0:0]]) ### arrays of size 0 are not supported foo$508(a ptr[in, string["foo", 3]]) ### string value "foo\x00" exceeds buffer length 3 foo$509(a int8['b':'a']) ### bad int range [98:97] foo$510(a type500) foo$511(a int32[-10:-20]) ### bad int range [18446744073709551606:18446744073709551596] foo$512(a ptr[in, array[int8, -2:-1]]) ### bad size range [18446744073709551614:18446744073709551615] foo$513(a ptr[in, array[int8, -2:2]]) ### bad size range [18446744073709551614:2] foo$514(a vma[-2:2]) ### bad size range [18446744073709551614:2] foo$515(a ptr[in, proc[1, -10, int64]]) ### values starting from 1 with step 18446744073709551606 overflow base type for 32 procs type type500 proc[C1, 8, int8] ### values starting from 1 with step 8 overflow base type for 32 procs type type501 int8 ### unused type type501 type type502[C] const[C, int8] ### unused type type502