KFuzzTest: macros for defining fuzz tests #1

ethangraham2001 · 2025-06-23T12:12:49Z

WIP

This PR adds a macro for defining a KFuzztest case, which is exposed as a debufs entry under /sys/kernel/debug/kftf/<test-case>. Usage of this is demonstrated in this syzkaller PR ethangraham2001/syzkaller#1 that leverages it to fuzz the two simple test cases exposed here.

into a .ko file.

binary representation down. Correctly causes a KASAN repot when passing a buggy input to it.

Added support for this for x86 arch, but it is probably fragile because we aren't guarding with a #ifdef yet

lib/kftf/kftf_main.c

ramosian-glider · 2025-06-23T12:23:40Z

lib/kftf/kftf_main.c

+
+static struct kftf_simple_fuzzer_state st;
+
+// XXX: allows everyone to write - correct flags?


Single-line C-style comments are discouraged in the kernel.
Unfortunately this is never mentioned in https://www.kernel.org/doc/html/latest/process/coding-style.html.

Regarding the flags, this is a good question.
We are letting the developers expose arbitrary kernel functions to the user, so the security of the kernel under test is already severely compromised.
We can probably start with only allowing root access for now, although no one should be enabling fuzz tests on production machines anyway.

lib/kftf/kftf_main.c

include/linux/kftf.h

lib/kftf/kftf_tests.h

ramosian-glider · 2025-06-23T13:07:12Z

arch/x86/kernel/vmlinux.lds.S

 #define KEXEC_RELOCATE_KERNEL
 #endif
+
+#define KFTF_TABLE							\


I think it's more or less up to you to pick a name for this subsystem, and it's not too late to change it if you prefer something different from "KFTF" :)

ramosian-glider · 2025-06-23T13:08:41Z

include/linux/kftf.h

+			.write_callback = _write_callback_##func,           \
+		};                                                          \
+	/* user-defined write callback */                                   \
+	static ssize_t _write_callback_##func(struct file *filp,            \


The common part of the write callback that is handling writes probably doesn't need to be duplicated for each test case.

the argument type that the function takes so that the user can use tools like pahole to generate a syzkaller definition of the argument and thus fuzz the function more easily.

files. It works, and the function is exposed correctly!

user friendly.

has a line separator between it and the common linux includes, as per https://elixir.bootlin.com/linux/v6.12.5/source/mm/kfence/core.c

ethangraham2001 · 2025-06-25T10:44:50Z

include/linux/kftf.h

+ * {
+ *	// arg is provided by the macro, and is of type `struct func_arg_type`
+ *	ret = func(arg.arg1, ..., arg.argn);
+ *	validate(ret);


TODO

I think it would be great to have some kind of KFTF_BUG_ON(condition) or similar so that a bug is reported in a consistent way in the case that a fuzz tests fails.

It could look something like

#define KFTF_BUG_ON(condition) if (condition) pr_warn("some output to indicate failure")

Or perhaps ASSERT_TRUE(condition) as is the case in libFuzzer

Good point, some sort of an assertion would be good to have.

ethangraham2001 · 2025-06-27T16:31:18Z

lib/kftf/kftf_main.c

+extern const struct kftf_test_case __kftf_start[];
+extern const struct kftf_test_case __kftf_end[];


NOTE: these aren't being linked against properly if we build with CONFIG_KFTF=M (I.e. as a module). It seems a little too restrictive to enforce that the fuzz test targets always be exposed as a built-in.

That being said, not sure how to link against the fuzz targets if the module is built separately from the kernel.

pointer to function argument type. This should remove the need for a mutex guarding a shared buffer entirely, and ultimately will likely perform better.

variable, and extract common input reading functionality into a separate function.

ramosian-glider · 2025-06-25T08:48:24Z

include/linux/kftf.h

@@ -0,0 +1,130 @@
+#ifndef KFTF_H


In addition to the include guard, every kernel file should contain an SPDX license header (/* SPDX-License-Identifier: GPL-2.0 */) and a short comment explaining what it is doing.

Check include/linux/kfence.h for an example (drop (C) per go/copyright).

ramosian-glider · 2025-06-25T08:50:53Z

include/linux/kftf.h

+ *	- A mutex to protect the input buffer
+ *	- A `struct kftf_test_case` instance
+ *
+ * Example usagea:


Nit: usagea

ramosian-glider · 2025-06-25T08:51:32Z

include/linux/kftf.h

+ *	TN argn;
+ * };
+ *
+ * // Define the test case


Nit: single-line comments should end with a period.

By the way, maybe change them to C-style? I don't insist though, as they are inside a comment anyway.

ramosian-glider · 2025-06-25T08:53:16Z

include/linux/kftf.h

+ * }
+ */
+#define FUZZ_TEST(func, func_arg_type)                                         \
+	/* input buffer. Size 2 for now, but we may support batching  */       \


Nit: single-line comments should start with a capital letter (unless that's a name of an identifier) and end with a period.

ramosian-glider · 2025-06-25T08:55:18Z

include/linux/kftf.h

+ */
+#define FUZZ_TEST(func, func_arg_type)                                         \
+	/* input buffer. Size 2 for now, but we may support batching  */       \
+	static func_arg_type input_buf_##func[2];                              \


Why do you need two elements, do you use them?

ramosian-glider · 2025-06-25T08:55:50Z

lib/Kconfig.debug

 source "lib/Kconfig.kasan"
 source "lib/Kconfig.kfence"
 source "lib/Kconfig.kmsan"
+source "lib/Kconfig.kftf"


I suggest moving it one line above, so that the source directive are sorted.

ramosian-glider · 2025-06-25T08:56:36Z

lib/kftf/kftf_main.c

@@ -0,0 +1,151 @@
+#include <linux/debugfs.h>


This file also needs an SPDX header

ramosian-glider · 2025-06-25T09:19:10Z

include/linux/kftf.h

+ * @func_arg_type: the input type of func. If func takes multiple arguments,
+ *	then one should wrap that inside of a multi-fielded struct. See usage
+ *	example below.
+ *


Nit: extra newline.

ramosian-glider · 2025-06-25T09:20:21Z

lib/kftf/kftf_main.c

+	size_t num_test_cases;
+
+	/* 
+	 * To avoid kmalloc entirely, we enforce a maximum number of fuzz tests


Why do we want to avoid kmalloc?

ramosian-glider · 2025-06-25T10:52:06Z

include/linux/kftf.h

+ * {
+ *	// arg is provided by the macro, and is of type `struct func_arg_type`
+ *	ret = func(arg.arg1, ..., arg.argn);
+ *	validate(ret);


Good point, some sort of an assertion would be good to have.

Ethan Graham added 5 commits June 18, 2025 10:02

Add simple configuration for kftf module that is built with kernel

1e0587e

into a .ko file.

kftf: Add init and exit functions to module

43dc893

kftf: simple sysfs that accepts a struct for a single function and the

42d6acc

binary representation down. Correctly causes a KASAN repot when passing a buggy input to it.

kftf: allow tests with macro definitions in .kftf section of binary.

4a35a64

Added support for this for x86 arch, but it is probably fragile because we aren't guarding with a #ifdef yet

kftf: fixx sizeof check so that it checks against the provided type.

e8992cb

ramosian-glider reviewed Jun 23, 2025

View reviewed changes

Ethan Graham added 7 commits June 23, 2025 13:45

kftf: add metadata file per fuzzed function - this contains the name of

d7adb90

the argument type that the function takes so that the user can use tools like pahole to generate a syzkaller definition of the argument and thus fuzz the function more easily.

move int_sqrt test out of kftf_tests file and into the math source

ca5ba48

files. It works, and the function is exposed correctly!

kftf: address PR comments and make the FUZZ_TEST interface a lot more

96ae8d5

user friendly.

kftf: update include block so that the relative include (kftf_tests.h)

ece3042

has a line separator between it and the common linux includes, as per https://elixir.bootlin.com/linux/v6.12.5/source/mm/kfence/core.c

delete unused file kftf_simple_fuzzer

07bfafa

kftf: per test-case input buffer with mutex

0c5cd7e

kftf: update kftf_fuzzable test

a4bb002

ethangraham2001 commented Jun 25, 2025

View reviewed changes

kftf: add some comments to module main file and kftf header file

0bddc3f

ethangraham2001 force-pushed the kftf_step1 branch from 329e538 to 0bddc3f Compare June 25, 2025 11:03

kftf: replace static test cases buffer with kmalloc'd one.

5971467

ethangraham2001 commented Jun 27, 2025

View reviewed changes

Ethan Graham added 3 commits July 1, 2025 06:35

kftf: replace input buffers for callback with dynamically allocated

d799f5c

pointer to function argument type. This should remove the need for a mutex guarding a shared buffer entirely, and ultimately will likely perform better.

kftf: replace heap allocated input buffer with function-local stack

aae72ff

variable, and extract common input reading functionality into a separate function.

kftf: fix bug in input reading logic.

72e3dec

ramosian-glider reviewed Jul 11, 2025

View reviewed changes


		static struct kftf_simple_fuzzer_state st;

		// XXX: allows everyone to write - correct flags?

		extern const struct kftf_test_case __kftf_start[];
		extern const struct kftf_test_case __kftf_end[];

KFuzzTest: macros for defining fuzz tests #1

Are you sure you want to change the base?

KFuzzTest: macros for defining fuzz tests #1

Uh oh!

Conversation

ethangraham2001 commented Jun 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

WIP

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ethangraham2001 Jun 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

TODO

Uh oh!

ethangraham2001 Jun 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

ethangraham2001 commented Jun 23, 2025 •

edited

Loading

ethangraham2001 Jun 25, 2025 •

edited

Loading

ethangraham2001 Jun 25, 2025 •

edited

Loading