github.com/google/syzkaller@v0.0.0-20240517125934-c0f1611a36d6/sys/test/test.txt (about) 1 # Copyright 2015 syzkaller project authors. All rights reserved. 2 # Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file. 3 4 # Syscalls used in syzkaller tests. 5 6 syz_execute_func(text ptr[in, text[target]]) (disabled) 7 8 test() 9 10 # Integer types. 11 12 test$int(a0 intptr, a1 int8, a2 int16, a3 int32, a4 int64) 13 14 # String types. 15 16 test$str0(a ptr[in, string]) 17 test$str1(a ptr[in, string["foo"]]) 18 test$str2(a ptr[in, string[fixed_strings]]) 19 test$blob0(a ptr[in, array[int8]]) 20 21 fixed_strings = "foo", "bar" 22 23 # Opt arguments 24 25 test$opt0(a0 intptr[opt]) 26 test$opt1(a0 ptr[in, intptr, opt]) 27 test$opt2(a0 vma[opt]) 28 test$opt3(a0 proc[100, 4, opt]) 29 30 # Alignment and padding 31 32 test$align0(a0 ptr[in, syz_align0]) 33 test$align1(a0 ptr[in, syz_align1]) 34 test$align2(a0 ptr[in, syz_align2]) 35 test$align3(a0 ptr[in, syz_align3]) 36 test$align4(a0 ptr[in, syz_align4]) 37 test$align5(a0 ptr[in, syz_align5]) 38 test$align6(a0 ptr[in, syz_align6]) 39 test$align7(a0 ptr[in, syz_align7]) 40 41 syz_align0 { 42 f0 int16 43 f1 int32 44 f2 int8 45 f3 int16 46 f4 int64 47 } 48 49 syz_align1 { 50 f0 int16 51 f1 int32 52 f2 int8 53 f3 int16 54 f4 int64 55 } [packed] 56 57 syz_align2_packed { 58 f0 array[int16, 1] 59 } [packed] 60 61 syz_align2_not_packed { 62 f0 array[int16, 1] 63 } 64 65 syz_align2 { 66 f0 int8 67 f1 syz_align2_packed 68 f2 syz_align2_not_packed 69 } 70 71 syz_align3_noalign { 72 f0 int8 73 } 74 75 syz_align3_align4 { 76 f0 int8 77 } [align[4]] 78 79 syz_align3 { 80 f0 int8 81 f1 syz_align3_noalign 82 f2 syz_align3_align4 83 } 84 85 syz_align4_internal { 86 f0 int8 87 f1 int16 88 } [packed, align[4]] 89 90 syz_align4 { 91 f0 syz_align4_internal 92 f1 int8 93 } 94 95 syz_align5_internal { 96 f0 int64 97 f1 array[int16, 0:3] 98 } 99 100 syz_align5 { 101 f0 syz_align5_internal 102 f1 syz_align5_internal 103 f2 int8 104 } [packed] 105 106 syz_align6 { 107 f0 int8 108 f1 array[int32] 109 } 110 111 syz_align7 { 112 f0 syz_align8 113 f1 int8 114 } 115 116 syz_align8 { 117 f0 int8:1 118 f1 int8:1 119 f2 int8:1 120 f3 int16:1 121 f4 int16:1 122 f5 int16:1 123 } [packed, align[8]] 124 125 # Structs 126 127 test$struct(a0 ptr[in, syz_struct0]) 128 129 syz_struct0 { 130 f0 int64 131 f1 syz_struct1 132 } 133 134 syz_struct1 { 135 f0 int8 136 } 137 138 # Unions 139 140 test$union0(a0 ptr[in, syz_union0_struct]) 141 test$union1(a0 ptr[in, syz_union1_struct]) 142 test$union2(a0 ptr[in, syz_union2_struct]) 143 144 syz_union0 [ 145 f0 int64 146 f1 array[int64, 10] 147 f2 int8 148 ] 149 150 syz_union0_struct { 151 f int64 152 u syz_union0 153 } 154 155 syz_union1 [ 156 f0 int64 157 f1 int32 158 ] 159 160 syz_union1_struct { 161 f0 syz_union1 162 f1 int8 163 } [packed] 164 165 syz_union2 [ 166 f0 int64 167 f1 int32 168 ] [varlen] 169 170 syz_union2_struct { 171 f0 syz_union2 172 f1 int8 173 } [packed] 174 175 syz_union3 [ 176 f0 int32 177 ] 178 179 union_arg [ 180 f1 int8 181 f2 int64 182 f3 ptr[in, int32] 183 f4 fd 184 f5 const[1, intptr] 185 f6 flags[syz_length_flags, int32] 186 f7 proc[0, 1, int16] 187 ] 188 189 test$syz_union3(a0 ptr[in, syz_union3]) 190 test$syz_union4(a0 union_arg) 191 192 # Arrays 193 194 test$array0(a0 ptr[in, syz_array_struct]) 195 test$array1(a0 ptr[in, syz_array_trailing]) 196 test$array2(a0 ptr[in, syz_array_blob]) 197 198 # Struct with a variable-length array or variable-length unions. 199 syz_array_struct { 200 f0 int8 201 f1 array[syz_array_union, 1:2] 202 f2 int64 203 } [packed] 204 205 syz_array_union [ 206 f0 int16 207 f1 int64 208 ] [varlen] 209 210 syz_array_trailing { 211 f0 int8 212 f1 array[int8, 4:8] 213 } 214 215 syz_array_blob { 216 f0 int16 217 f1 array[int8, 16] 218 f2 int16 219 } 220 221 # Length 222 223 test$length0(a0 ptr[in, syz_length_int_struct]) 224 test$length1(a0 ptr[in, syz_length_const_struct]) 225 test$length2(a0 ptr[in, syz_length_flags_struct]) 226 test$length3(a0 ptr[in, syz_length_len_struct]) 227 test$length4(a0 ptr[in, syz_length_len2_struct]) 228 test$length5(a0 ptr[in, syz_length_parent_struct]) 229 test$length6(a0 ptr[in, syz_length_array_struct]) 230 test$length7(a0 ptr[in, syz_length_array2_struct]) 231 test$length8(a0 ptr[in, syz_length_complex_struct]) 232 test$length9(a0 ptr[in, syz_length_vma_struct]) 233 234 test$length10(a0 vma, a1 len[a0], a2 bytesize[a0], a3 bytesize2[a0], a4 bytesize4[a0]) 235 test$length11(a0 ptr[in, syz_length_large_struct], a1 len[a0]) 236 test$length12(a0 ptr[in, syz_length_large_struct, opt], a1 len[a0]) 237 test$length13(a0 ptr[inout, syz_length_large_struct], a1 ptr[inout, len[a0, int64]]) 238 test$length14(a0 ptr[inout, syz_length_large_struct], a1 ptr[inout, len[a0, int64], opt]) 239 test_length15(a0 int16, a1 len[a0]) 240 241 test$length16(a0 ptr[in, syz_length_bytesize_struct]) 242 test$length17(a0 ptr[in, syz_length_bytesize2_struct]) 243 test$length18(a0 ptr[in, syz_length_bytesize3_struct]) 244 test$length19(a0 ptr[in, syz_length_bf_struct]) 245 246 test$length20(a0 ptr[in, syz_length_parent2_struct]) 247 test$length21(a0 ptr[in, int64], a1 bitsize[a0]) 248 test$length22(a0 ptr[in, array[int8]], a1 bitsize[a0]) 249 250 syz_length_flags = 0, 1 251 252 syz_length_int_struct { 253 f0 int16 254 f1 len[f0, int16] 255 } 256 257 syz_length_const_struct { 258 f0 const[0, int32] 259 f1 len[f0, int32] 260 } 261 262 syz_length_flags_struct { 263 f0 flags[syz_length_flags, int64] 264 f1 len[f0, int64] 265 } 266 267 syz_length_len_struct { 268 f0 int32 269 f1 len[f0, int16] 270 f2 len[f1, int16] 271 } 272 273 syz_length_len2_struct { 274 f0 len[f1, int16] 275 f1 len[f0, int16] 276 } 277 278 syz_length_parent_struct { 279 f0 int16 280 f1 len[parent, int16] 281 } 282 283 syz_length_array_struct { 284 f0 array[int16, 4] 285 f1 len[f0, int16] 286 } 287 288 syz_length_array2_struct { 289 f0 array[int16, 4] 290 f1 bytesize[f0, int16] 291 } 292 293 syz_length_complex_inner_struct { 294 f0 int8 295 f1 len[f0, int8] 296 f2 len[parent, int16] 297 f3 array[int32, 3] 298 } 299 300 syz_length_complex_struct { 301 f0 len[parent, int64] 302 f1 syz_length_complex_inner_struct 303 f2 array[syz_length_complex_inner_struct, 1] 304 f3 len[f1, int32] 305 f4 len[f2, int16] 306 f5 array[int16] 307 } 308 309 syz_length_vma_struct { 310 f0 vma 311 f1 len[f0, int64] 312 } 313 314 syz_length_large_struct { 315 f0 int64 316 f1 int64 317 f2 array[int32, 8] 318 } 319 320 syz_length_bytesize_struct { 321 f0 array[int64, 2] 322 f1 len[f0, int8] 323 f2 bytesize[f0, int8] 324 f3 bytesize2[f0, int8] 325 f4 bytesize4[f0, int8] 326 f5 bytesize8[f0, int8] 327 } 328 329 syz_length_bytesize2_struct { 330 f0 int64 331 f1 bytesize[f0, int8] 332 f2 bytesize2[f0, int8] 333 f3 bytesize4[f0, int8] 334 f4 bytesize8[f0, int8] 335 } 336 337 syz_length_bytesize3_struct { 338 f0 int32 339 f1 bytesize[parent, int8] 340 f2 bytesize2[parent, int8] 341 f3 bytesize4[parent, int8] 342 f4 bytesize8[parent, int8] 343 } 344 345 syz_length_bf_struct_inner { 346 f0 int32:10 347 f1 int32:10 348 f2 int32:10 349 f3 int32:32 350 f4 int32:16 351 f5 int32:16 352 f6 int32:10 353 f7 len[parent, int32] 354 } 355 356 syz_length_bf_struct { 357 f0 syz_length_bf_struct_inner 358 f1 len[f0, int8] 359 f2 bytesize[f0, int8] 360 f3 bytesize4[f0, int8] 361 } 362 363 syz_length_parent2_struct_inner_inner { 364 f1 len[parent, int8] 365 f2 len[syz_length_parent2_struct_inner_inner, int8] 366 f3 len[syz_length_parent2_struct_inner, int8] 367 f4 len[syz_length_parent2_struct, int8] 368 } 369 370 syz_length_parent2_struct_inner { 371 f0 syz_length_parent2_struct_inner_inner 372 f1 len[parent, int8] 373 f2 len[syz_length_parent2_struct_inner, int8] 374 f3 len[syz_length_parent2_struct, int8] 375 } 376 377 syz_length_parent2_struct { 378 f0 syz_length_parent2_struct_inner 379 f1 len[parent, int8] 380 f2 len[syz_length_parent2_struct, int8] 381 } 382 383 type len_templ1[DATA1, DATA2] { 384 data DATA1 385 inner len_temp2[DATA2] 386 } 387 388 type len_temp2[DATA] { 389 data DATA 390 len len[len_templ1, int8] 391 } 392 393 test$length23(a ptr[in, len_templ1[int8, int16]]) 394 395 type len_temp3[DATA] { 396 f1 DATA 397 f2 len_nontemp4 398 } 399 400 len_nontemp4 { 401 f1 len[len_temp3, int32] 402 } 403 404 len_nontemp5 { 405 f1 len_temp3[int8] 406 f2 len_temp3[int64] 407 } 408 409 len_unaligned { 410 f1 int32 411 f2 int8 412 } 413 414 explicitly_sized { 415 f1 int8 416 } [size[42]] 417 418 explicitly_sized_union [ 419 f1 int8 420 ] [size[42]] 421 422 static_filename { 423 f1 string[filename, 10] 424 f2 string[filename, 20] 425 f3 bytesize[f1, int8] 426 f4 bytesize[f2, int8] 427 f5 bytesize[parent, int8] 428 } 429 430 test$length24(a ptr[in, len_nontemp5]) 431 test$length25(a0 ptr[in, array[array[int8]]], a1 len[a0]) 432 test$length26(a ptr[in, len_unaligned], b bytesize[a]) 433 test$length27(a0 ptr[in, explicitly_sized], a1 len[a0]) 434 test$length28(a0 ptr[in, explicitly_sized_union], a1 len[a0]) 435 test$length29(a ptr[in, static_filename]) 436 437 len_expr1 { 438 f11 len_expr2 439 f12 bytesize[syscall:a2, int32] 440 } 441 442 len_expr2 { 443 f21 len_expr3 444 f22 len_expr4 445 f23 ptr[in, len_expr4] 446 f24 ptr[in, ptr[in, len_expr4]] 447 f25 len[f21:f31, int32] 448 } 449 450 len_expr3 { 451 f31 int16 452 f32 bytesize[len_expr2:f21, int32] 453 f33 bytesize[len_expr2:f22:f41, int32] 454 f34 bytesize[len_expr1:f11:f22:f42, int32] 455 f35 bytesize[len_expr2:f23:f43, int32] 456 f36 bytesize[len_expr2:f24:f44, int32] 457 } 458 459 len_expr4 { 460 f41 array[int8, 1] 461 f42 array[int8, 3] 462 f43 array[int8, 5] 463 f44 array[int8, 6] 464 } 465 466 test$length30(a0 ptr[in, len_expr1], a1 bytesize[a0:f11], a2 ptr[in, bytesize[a0:f11:f21, int32]], a3 bytesize[a0:f11:f21:f31]) 467 468 test$offsetof0(a0 ptr[in, offsetof0]) 469 470 offsetof0 { 471 f0 int32 472 f1 int8 473 f2 int16 474 f3 int8 475 f4 int64 476 f5 int32:5 477 f6 int32:10 478 f7 int64 479 o0 offsetof[f0, int32] 480 o1 offsetof[f1, int32] 481 o2 offsetof[f2, int32] 482 o3 offsetof[f3, int32] 483 o4 offsetof[f4, int32] 484 o5 offsetof[f5, int32] 485 o6 offsetof[f6, int32] 486 o7 offsetof[f7, int32] 487 } 488 489 parent_parent_helper { 490 f1 array[int32, 8] 491 f2 parent_parent_length 492 f3 ptr[in, parent_parent_length] 493 } 494 495 parent_parent_length { 496 f1 len[parent:parent:f1, int32] 497 } 498 499 test$length32(a0 ptr[in, parent_parent_helper]) 500 501 one_parent_length { 502 f1 array[int32, 4] 503 f2 len[parent:f1, int32] 504 } 505 506 test$length33(a0 ptr[in, one_parent_length]) 507 508 parent_union_struct { 509 f1 array[int32, 4] 510 f2 ptr[in, parent_union] 511 } 512 513 parent_union [ 514 u1 len[parent:parent:f1, int32] 515 u2 int32 516 ] 517 518 test$length34(a0 ptr[in, parent_union_struct]) 519 520 struct_with_condition { 521 f1 int32 522 f2 int32 (if[value[f1] == 0x1]) 523 } [packed] 524 525 len_of_cond_struct { 526 f1 len[f2, int32] 527 f2 struct_with_condition 528 } 529 530 test$length35(a0 ptr[in, len_of_cond_struct]) 531 532 test$length_any(a0 ptr[in, syz_length_any_struct], a1 len[a0]) 533 534 syz_length_any_struct { 535 f0 int32 536 f1 int32 537 f2 int32 538 f3 int32 539 f4 array[int8] 540 } [packed] 541 542 # Big endian 543 544 test$end0(a0 ptr[in, syz_end_int_struct]) 545 test$end1(a0 ptr[in, syz_end_var_struct]) 546 547 syz_end_flags = 0, 1 548 549 syz_end_int_struct { 550 f0 int8 551 f1 int16be 552 f2 int32be 553 f3 int64be 554 } [packed] 555 556 syz_end_var_struct { 557 f0 len[parent, int16be] 558 f1 const[0x42, int32be] 559 f2 flags[syz_end_flags, int64be] 560 } [packed] 561 562 # Vma type 563 564 test$vma0(v0 vma, l0 len[v0], v1 vma[5], l1 len[v1], v2 vma[7:9], l2 len[v2]) 565 566 # Text type 567 568 test$text_x86_real(a0 ptr[in, text[x86_real]], a1 len[a0]) 569 test$text_x86_16(a0 ptr[in, text[x86_16]], a1 len[a0]) 570 test$text_x86_32(a0 ptr[in, text[x86_32]], a1 len[a0]) 571 test$text_x86_64(a0 ptr[in, text[x86_64]], a1 len[a0]) 572 573 # Regression tests 574 575 test$regression0(a0 ptr[inout, syz_regression0_struct]) 576 577 syz_regression0_struct { 578 f0 buffer[out] 579 } 580 581 test$regression1(a1 ptr[in, array[syz_regression1_struct]]) 582 583 syz_regression1_struct { 584 f0 array[int8, 4] 585 } 586 587 test$regression2(a1 ptr[in, array[int32, 4]]) 588 589 excessive_fields { 590 f1 int8 591 } 592 593 type_confusion [ 594 f1 int8 595 ] 596 597 test_excessive_args1() 598 test_excessive_args2(a1 int8) 599 test$excessive_fields1(a1 ptr[in, excessive_fields]) 600 test$type_confusion1(a1 ptr[in, type_confusion]) 601 test$out_const(a1 ptr[out, const[1, int32]]) 602 603 # Bitfields 604 605 syz_bf_flags = 0, 1, 2 606 607 syz_bf_struct0 { 608 f0 flags[syz_bf_flags, int16:10] 609 f1 int64 610 f2 const[0x2, int16:5] 611 f3 int16:6 612 f4 const[0x42, int32:15] 613 f5 len[parent, int16:11] 614 f6 len[parent, int16be:11] 615 f7 int8 616 } 617 618 syz_bf_struct1_internal { 619 f0 int32:10 620 f1 int32:10 621 f2 int32:10 622 } 623 624 syz_bf_struct1 { 625 f0 syz_bf_struct1_internal 626 f1 int8 627 } 628 629 syz_bf_struct2 { 630 f0 int64:4 631 f1 int64:8 632 f2 int64:12 633 f3 int64:20 634 f4 int64:16 635 } 636 637 syz_bf_struct3 { 638 f0 int64be:4 639 f1 int64be:8 640 f2 int64be:12 641 f3 int64be:20 642 f4 int64be:16 643 } 644 645 syz_bf_struct26 { 646 f0 bytesize[parent, int32] 647 f1 int32:16[bitmask_flags2] 648 f2 int32:8 649 f3 int32:8[0x18] 650 } 651 652 test$bf0(a0 ptr[in, syz_bf_struct0]) 653 test$bf1(a0 ptr[in, syz_bf_struct1]) 654 test$bf2(a0 ptr[in, syz_bf_struct26]) 655 656 # Checksums 657 658 test$csum_encode(a0 ptr[in, syz_csum_encode]) 659 test$csum_ipv4(a0 ptr[in, syz_csum_ipv4_header]) 660 test$csum_ipv4_tcp(a0 ptr[in, syz_csum_ipv4_tcp_packet]) 661 test$csum_ipv6_tcp(a0 ptr[in, syz_csum_ipv6_tcp_packet]) 662 test$csum_ipv4_udp(a0 ptr[in, syz_csum_ipv4_udp_packet]) 663 test$csum_ipv6_udp(a0 ptr[in, syz_csum_ipv6_udp_packet]) 664 test$csum_ipv6_icmp(a0 ptr[in, syz_csum_ipv6_icmp_packet]) 665 666 syz_csum_encode { 667 f0 int16 668 f1 int16be 669 f2 array[int32, 0:4] 670 f3 int8:4 671 f4 int8:4 672 f5 array[int8, 4] 673 } [packed] 674 675 syz_csum_ipv4_header { 676 csum csum[parent, inet, int16] 677 src_ip int32be 678 dst_ip int32be 679 } [packed] 680 681 syz_csum_tcp_header { 682 csum csum[syz_csum_tcp_packet, pseudo, IPPROTO_TCP, int16] 683 } [packed] 684 685 syz_csum_tcp_packet { 686 header syz_csum_tcp_header 687 payload array[int8] 688 } [packed] 689 690 syz_csum_ipv4_tcp_packet { 691 header syz_csum_ipv4_header 692 payload syz_csum_tcp_packet 693 } [packed] 694 695 syz_csum_ipv6_header { 696 src_ip array[int8, 16] 697 dst_ip array[int8, 16] 698 } [packed] 699 700 syz_csum_ipv6_tcp_packet { 701 header syz_csum_ipv6_header 702 payload syz_csum_tcp_packet 703 } [packed] 704 705 syz_csum_udp_packet { 706 csum csum[parent, pseudo, IPPROTO_UDP, int16] 707 payload array[int8] 708 } [packed] 709 710 syz_csum_ipv4_udp_packet { 711 header syz_csum_ipv4_header 712 payload syz_csum_udp_packet 713 } [packed] 714 715 syz_csum_ipv6_udp_packet { 716 header syz_csum_ipv6_header 717 payload syz_csum_udp_packet 718 } [packed] 719 720 syz_csum_icmp_packet { 721 csum csum[parent, pseudo, IPPROTO_ICMPV6, int16] 722 payload array[int8] 723 } [packed] 724 725 syz_csum_ipv6_icmp_packet { 726 header syz_csum_ipv6_header 727 payload syz_csum_icmp_packet 728 } [packed] 729 730 # Recursion 731 732 syz_recur_0 { 733 a0 ptr[in, syz_recur_0, opt] 734 } 735 736 syz_recur_1 { 737 a0 ptr[in, syz_recur_1, opt] 738 a1 ptr[in, syz_recur_2, opt] 739 } 740 741 syz_recur_2_0 { 742 a0 ptr[in, syz_recur_2_0, opt] 743 a1 ptr[in, syz_recur_2_0, opt] 744 a2 ptr[in, syz_recur_2_0, opt] 745 a3 ptr[in, syz_recur_2_0, opt] 746 } 747 748 syz_recur_2 { 749 a0 ptr[in, syz_recur_0, opt] 750 a1 ptr[in, syz_recur_1, opt] 751 a2 ptr[in, syz_recur_2_0, opt] 752 a3 ptr[in, syz_recur_2_0, opt] 753 a4 ptr[in, syz_recur_2, opt] 754 a5 ptr[in, syz_recur_2, opt] 755 } 756 757 test$recur0(a0 ptr[inout, syz_recur_0]) 758 test$recur1(a0 ptr[inout, syz_recur_1]) 759 test$recur2(a0 ptr[inout, syz_recur_2]) 760 761 # Resources. 762 763 resource fd[int32]: 0xffffffffffffffff, 999 764 resource syz_res[int32]: 0xffff 765 766 test$res0() syz_res 767 test$res1(a0 syz_res) 768 test$res2() fd 769 test$res3(a0 ptr[out, syz_res]) 770 771 # ONLY_32BITS_CONST const is not present on all arches. 772 # Ensure that it does not break build. 773 774 resource syz_missing_const_res[int32]: ONLY_32BITS_CONST 775 776 test$missing_resource() syz_missing_const_res 777 test$missing_struct(a ptr[in, syz_use_missing]) 778 779 syz_missing_const_struct { 780 a0 const[ONLY_32BITS_CONST, int32] 781 } 782 783 syz_use_missing { 784 a0 syz_missing_const_res 785 a1 syz_missing_const_struct 786 } 787 788 # Hints tests. 789 790 test$hint_int(a0 ptr[in, hint_ints]) 791 test$hint_data(a0 ptr[in, array[int8]]) 792 793 hint_ints { 794 int1_0 int8 795 int2_0 int16 796 int4_0 int32 797 int8_0 int64 798 int2_12 int16:12 799 } 800 801 # Mutation tests. 802 803 mutate0() 804 mutate1() 805 mutate2() 806 mutate3(vec ptr[in, array[int32[0:1]]], vlen len[vec]) 807 mutate4(data ptr[in, array[int8]], size bytesize[data]) 808 mutate5(filename ptr[in, filename], flags flags[open_flags]) fd 809 mutate6(fd fd, data ptr[in, array[int8]], size bytesize[data]) 810 mutate7(a0 ptr[in, string], a1 len[a0]) 811 mutate8(a0 proc[100, 4, opt]) 812 mutate9(filename ptr[in, filename]) 813 mutate10(filename ptr[out, filename]) 814 815 # Test for arguments mutation 816 mutate_integer(b1 bool8, b2 bool8, b3 bool8, b4 bool8, b5 bool8, b6 bool8, b7 bool8, b8 bool8, i9 int64) 817 mutate_integer2(b1 bool64, i1 int64, i2 int32, i3 int16[0x0:0x8], i4 int8[0x0:0x8]) 818 mutate_flags(filename ptr[in, filename], i1 int64, b1 bool16, flags flags[bitmask_flags]) 819 mutate_flags2(filename ptr[in, filename], flags flags[bitmask_flags2]) 820 mutate_flags3(filename ptr[in, filename], flags flags[open_flags2]) 821 mutate_array(i1 int64, i2 int64[0x0:0x1fffffff], vec ptr[in, array[int32[0:1]]]) 822 mutate_array2(vec ptr[in, array[syz_struct1]]) 823 mutate_union(p ptr[in, syz_union0]) 824 mutate_buffer(p buffer[out]) 825 mutate_rangedbuffer(p ptr[out, array[int8, 5:10]]) 826 827 open_flags = 0xabababab, 0xcdcdcdcd 828 open_flags2 = 0xaaaaaaaa, 0xaaaabbbb, 0xbbbbbbbb, 0xbbbbcccc, 0xcccccccc, 0xccccdddd, 0xdddddddd, 0xddddeeee, 0xeeeeeeee, 0xeeeeffff, 0xffffffff 829 830 bitmask_flags = 0x1, 0x8, 0x10 831 bitmask_flags2 = 0x1, 0x2, 0x4, 0x8, 0x10, 0x20, 0x40, 0x80 832 833 # Minimization tests. 834 835 minimize$0(a0 proc[10, 2], a1 proc[10, 2, opt]) 836 837 # Serialization tests. 838 839 serialize0(a ptr[in, serialize0_struct]) 840 serialize1(a ptr[out, array[int8]], b len[a]) 841 serialize2(a ptr[in, array[int8]]) 842 serialize3(a ptr[in, compressed_image]) (no_generate, no_minimize) 843 844 serialize0_struct { 845 a string[serialize_strings, 10] 846 b string[serialize_strings, 5] 847 } 848 849 serialize_strings = "aaa", "bbb", "hash", "HI" 850 851 # Unsupported syscalls due to resources. 852 853 resource unsupported[int32] 854 855 unsupported$0(a unsupported) unsupported 856 unsupported$1(a unsupported) unsupported 857 858 foo$arch_specific_const_as_array_size(a ptr[in, array[int8, ARCH_64_SPECIFIC_CONST]]) 859 860 # Fallback coverage. 861 862 fallback$0() fd 863 fallback$1(a fd) 864 breaks_returns() (breaks_returns) 865 866 # AUTO 867 868 test$auto0(a const[0x42], b ptr[in, auto_struct0], c len[b], d int32) 869 870 auto_struct0 { 871 f0 len[parent, int32] 872 f1 const[0x43, int32] 873 f2 int32 874 } 875 876 test$auto1(a const[0x42], b ptr[in, auto_struct1], c len[b], d int32) 877 878 auto_struct1 { 879 f0 len[parent, int32] 880 f1 const[0x43, int32] 881 f2 const[0, int32] 882 } 883 884 test$auto2(a const[0x42], b ptr[in, auto_struct2], c len[b], d int32) 885 886 auto_struct2 { 887 f0 len[parent, int32] 888 f1 auto_struct1 889 } 890 891 # Attributes 892 893 resource disabled_resource[int32] 894 895 disabled0() (disabled) 896 disabled1() disabled_resource (disabled) 897 disabled2(a disabled_resource) (disabled) 898 899 # Struct/union field direction attribute (overrides ptr dir) 900 901 resource r100[int32] 902 resource r101[int32] 903 resource r102[int32] 904 resource r103[int32] 905 resource r104[int32] 906 907 test$r100_consumer(a r100) 908 test$r101_consumer(a r101) 909 test$r102_consumer_recur(a ptr[out, syz_r102_in_recur0]) 910 test$r103_consumer(a r103) 911 test$r104_producer(a ptr[out, r104]) 912 test$r100_producer(a ptr[in, syz_r100_out]) 913 test$r101_producer_recur(a ptr[in, syz_r101_out_recur0]) 914 test$r102_producer(a ptr[out, r102]) 915 test$r103_producer_r104_consumer(a ptr[inout, syz_r103_r104_u], b ptr[inout, syz_r103_r104_s]) 916 917 syz_r100_out { 918 f0 r100 (out) 919 } 920 921 syz_r101_out_recur0 { 922 f0 ptr[in, syz_r101_out_recur1] 923 } 924 925 syz_r101_out_recur1 { 926 f0 r101 (out) 927 } 928 929 syz_r102_in_recur0 { 930 f0 ptr[out, syz_r102_in_recur1] 931 } 932 933 syz_r102_in_recur1 { 934 f0 r102 (in) 935 } 936 937 syz_r103_r104_u { 938 opt0 r103 (out) 939 opt1 r104 (in) 940 } 941 942 syz_r103_r104_s { 943 opt0 r103 (out) 944 opt1 r104 (in) 945 } 946 947 # Optional resources 948 949 resource optional_res1[int32] 950 resource optional_res2[int32] 951 resource required_res1[int32] 952 resource required_res2[int32] 953 954 test_args4 { 955 a required_res2 956 } 957 958 test_args3 { 959 a required_res1 960 } 961 962 test_args2 { 963 a ptr[in, test_args3] 964 b array[optional_res2] 965 } 966 967 test_args1 { 968 a0 ptr64[out, test_args4] 969 a1 ptr64[in, array[optional_res1], opt] 970 a2 ptr64[in, test_args2, opt] 971 a3 ptr64[in, test_args3] 972 a4 ptr64[in, test_args4] 973 } 974 975 test_args0 { 976 a1 optional_res1 977 a2 optional_res2 978 a3 required_res1 979 a4 required_res2 980 } 981 982 test$output_res(arg ptr[out, test_args0]) 983 test$optional_res(arg ptr[in, test_args1]) 984 985 resource common[int32] 986 resource subtype_of_common[common] 987 988 test$produce_common() common 989 test$also_produce_common() common 990 test$produce_subtype_of_common() subtype_of_common 991 992 test$consume_common(val common) 993 test$consume_subtype_of_common(val subtype_of_common)