mirror of
https://github.com/reactos/syzkaller.git
synced 2024-11-23 11:29:46 +00:00
prog: don't squash objects that contain pointers
Squashing pointers creates several problems: - we need to generate pointer types on the fly, something we don't do in any other contexts, it complicates other changes - pointers are very special as values, if we change size of the surrounding blobs, offsets changes and we will use something that's not a pointer as pointer and vise versa, boths things are most likley very bad as inputs - squashing/any implementation is just too complex This disqualifies several types for squashing: < alloc_pd_cmd < arpt_replace < array[cmsghdr_rds] < create_cq_cmd < create_flow_cmd < create_qp_cmd < create_srq_cmd < ebt_counters_info < ip6t_replace < ipt_replace < mlx5_alloc_pd_cmd < mlx5_create_dv_qp_cmd < open_xrcd_cmd < post_recv_cmd < post_send_cmd < post_srq_recv_cmd < query_qp_cmd < query_srq_cmd < reg_mr_cmd < rereg_mr_cmd < resize_cq_cmd < usbdevfs_urb < vhost_memory < vusb_connect_descriptors and adds few new: > binder_objects > query_qp_resp > resize_cq_resp > usb_bos_descriptor > usb_string_descriptor Overall this looks sane. Majority is still unchanged.
This commit is contained in:
parent
143a10e9d6
commit
986fa4971c
31
prog/any.go
31
prog/any.go
@ -28,8 +28,6 @@ type anyTypes struct {
|
||||
// resource ANYRES64[int64]: 0xffffffffffffffff, 0
|
||||
// ANY [
|
||||
// bin array[int8]
|
||||
// ptr ptr[in, array[ANY], opt]
|
||||
// ptr64 ptr64[in, array[ANY], opt]
|
||||
// res16 ANYRES16
|
||||
// res32 ANYRES32
|
||||
// res64 ANYRES64
|
||||
@ -106,8 +104,6 @@ func initAnyTypes(target *Target) {
|
||||
},
|
||||
Fields: []Type{
|
||||
target.any.blob,
|
||||
target.any.ptrPtr,
|
||||
target.any.ptr64,
|
||||
target.any.res16,
|
||||
target.any.res32,
|
||||
target.any.res64,
|
||||
@ -160,26 +156,23 @@ func (target *Target) isComplexPtr(arg *PointerArg) bool {
|
||||
if target.isAnyPtr(arg.Type()) {
|
||||
return true
|
||||
}
|
||||
res := false
|
||||
complex, hasPtr := false, false
|
||||
ForeachSubArg(arg.Res, func(a1 Arg, ctx *ArgCtx) {
|
||||
switch typ := a1.Type().(type) {
|
||||
case *StructType:
|
||||
if typ.Varlen() {
|
||||
res = true
|
||||
ctx.Stop = true
|
||||
complex = true
|
||||
}
|
||||
case *UnionType:
|
||||
if typ.Varlen() && len(typ.Fields) > 5 {
|
||||
res = true
|
||||
ctx.Stop = true
|
||||
complex = true
|
||||
}
|
||||
case *PtrType:
|
||||
if a1 != arg {
|
||||
ctx.Stop = true
|
||||
}
|
||||
hasPtr = true
|
||||
ctx.Stop = true
|
||||
}
|
||||
})
|
||||
return res
|
||||
return complex && !hasPtr
|
||||
}
|
||||
|
||||
func (target *Target) CallContainsAny(c *Call) (res bool) {
|
||||
@ -231,18 +224,6 @@ func (target *Target) squashPtrImpl(a Arg, elems *[]Arg) {
|
||||
target.squashConst(arg, elems)
|
||||
case *ResultArg:
|
||||
target.squashResult(arg, elems)
|
||||
case *PointerArg:
|
||||
if arg.Res != nil {
|
||||
target.squashPtr(arg, false)
|
||||
*elems = append(*elems, MakeUnionArg(target.any.union, arg))
|
||||
} else {
|
||||
elem := target.ensureDataElem(elems)
|
||||
addr := target.PhysicalAddr(arg)
|
||||
for i := uint64(0); i < arg.Size(); i++ {
|
||||
elem.data = append(elem.Data(), byte(addr))
|
||||
addr >>= 8
|
||||
}
|
||||
}
|
||||
case *UnionArg:
|
||||
if !arg.Type().Varlen() {
|
||||
pad = arg.Size() - arg.Option.Size()
|
||||
|
@ -44,8 +44,8 @@ func TestSquash(t *testing.T) {
|
||||
squashed string
|
||||
}{
|
||||
{
|
||||
`foo$any0(&(0x7f0000000000)={0x11, 0x11223344, 0x2233, 0x1122334455667788, {0x1, 0x7, 0x1, 0x1, 0x1bc, 0x4}, [{0x0, @res32=0x0, 0x0, @i8=0x44, "aabb"}, {0x0, @res64=0x1, 0x0, @i32=0x11223344, "1122334455667788"}]})`,
|
||||
`foo$any0(&(0x7f0000000000)=ANY=[@ANYBLOB="1100000044332211223300000000000088776655443322117d00bc110000000000000000", @ANYRES32=0x0, @ANYBLOB="00000000000000000000000044aabb000000000000000000", @ANYRES64=0x1, @ANYBLOB="000000000000000044332211112233445566778800000000"])`,
|
||||
`foo$any0(&(0x7f0000000000)={0x11, 0x11223344, 0x2233, 0x1122334455667788, {0x1, 0x7, 0x1, 0x1, 0x1bc, 0x4}, [{@res32=0x0, @i8=0x44, "aabb"}, {@res64=0x1, @i32=0x11223344, "1122334455667788"}]})`,
|
||||
`foo$any0(&(0x7f0000000000)=ANY=[@ANYBLOB="1100000044332211223300000000000088776655443322117d00bc11", @ANYRES32=0x0, @ANYBLOB="0000000044aabb00", @ANYRES64=0x1, @ANYBLOB="44332211112233445566778800000000"])`,
|
||||
},
|
||||
}
|
||||
for i, test := range tests {
|
||||
|
@ -18,11 +18,9 @@ any0 {
|
||||
} [align[8]]
|
||||
|
||||
any1 {
|
||||
f1 ptr[in, int8, opt]
|
||||
f2 anyunion0
|
||||
f3 ptr64[in, int8, opt]
|
||||
f4 anyunion1
|
||||
f5 array[int8]
|
||||
f1 anyunion0
|
||||
f2 anyunion1
|
||||
f3 array[int8]
|
||||
} [packed, align[2]]
|
||||
|
||||
anyunion0 [
|
||||
|
Loading…
Reference in New Issue
Block a user