github.com/google/syzkaller@v0.0.0-20240517125934-c0f1611a36d6/sys/fuchsia/test/handle (about)

     1  r0 = syz_job_default()
     2  zx_job_create(r0, 0x0, &AUTO=<r1=>0x0)
     3  zx_socket_create(0x0, &AUTO=<r2=>0x0, &AUTO=<r3=>0x0)
     4  
     5  # Duplicate the child job handle with the same rights (ZX_DEFAULT_JOB_RIGHTS), then with no rights.
     6  
     7  zx_handle_duplicate(r1, 0x80000000, &AUTO=<r4=>0x0)
     8  zx_handle_duplicate(r1, 0x0, &AUTO=<r5=>0x0)
     9  
    10  # Duplicating a handle without ZX_RIGHT_DUPLICATE should fail.
    11  # Duplicating a handle with rights that are not a subset of the original's rights should also fail.
    12  
    13  zx_handle_duplicate(r5, 0x1, &AUTO) # ZX_ERR_ACCESS_DENIED
    14  zx_handle_duplicate(r1, 0x10, &AUTO) # ZX_ERR_INVALID_ARGS
    15  
    16  # Replace a job handle with the same rights.
    17  # The original handle is now invalid.
    18  
    19  zx_handle_replace(r4, 0x80000000, &AUTO=<r6=>0x0)
    20  zx_object_get_info$ZX_INFO_HANDLE_VALID(r4, 0x1, nil, 0, nil, nil) # ZX_ERR_BAD_HANDLE
    21  
    22  # Replacing a handle with rights that are not a subset of the original's rights should fail.
    23  # Even though zx_handle_replace returned an error, the handles we tried to replace are invalidated.
    24  
    25  zx_object_get_info$ZX_INFO_HANDLE_VALID(r5, 0x1, nil, 0, nil, nil)
    26  zx_object_get_info$ZX_INFO_HANDLE_VALID(r6, 0x1, nil, 0, nil, nil)
    27  
    28  zx_handle_replace(r5, 0x1, &AUTO) # ZX_ERR_INVALID_ARGS
    29  zx_handle_replace(r6, 0x10, &AUTO) # ZX_ERR_INVALID_ARGS
    30  
    31  zx_object_get_info$ZX_INFO_HANDLE_VALID(r5, 0x1, nil, 0, nil, nil) # ZX_ERR_BAD_HANDLE
    32  zx_object_get_info$ZX_INFO_HANDLE_VALID(r6, 0x1, nil, 0, nil, nil) # ZX_ERR_BAD_HANDLE
    33  
    34  # Close one of the socket handles.
    35  # This should block operations on the handle's peer.
    36  
    37  zx_handle_close(r2)
    38  zx_object_get_info$ZX_INFO_HANDLE_VALID(r2, 0x1, nil, 0, nil, nil) # ZX_ERR_BAD_HANDLE
    39  zx_socket_read(r3, 0x0, &AUTO, 0x10, &AUTO) # ZX_ERR_PEER_CLOSED
    40  
    41  # Close the remaining handles.
    42  # Operations on those handles should now fail.
    43  
    44  zx_handle_close_many(&AUTO=[r0, r1, r3], 0x3)
    45  zx_object_get_info$ZX_INFO_HANDLE_VALID(r0, 0x1, nil, 0, nil, nil) # ZX_ERR_BAD_HANDLE
    46  zx_object_get_info$ZX_INFO_HANDLE_VALID(r1, 0x1, nil, 0, nil, nil) # ZX_ERR_BAD_HANDLE
    47  zx_object_get_info$ZX_INFO_HANDLE_VALID(r3, 0x1, nil, 0, nil, nil) # ZX_ERR_BAD_HANDLE
    48  zx_handle_duplicate(r0, 0x80000000, &AUTO) # ZX_ERR_BAD_HANDLE