KfuzzTest RFC.

[ethangraham2001]

Cover letter:

Subject: [PATCH v1 RFC 0/5] kfuzztest: a new framework for fuzzing
kernel functions

This patch series introduces KFuzzTest, a lightweight framework for creating
in-kernel fuzz targets for internal kernel functions.

The primary motivation for KFuzzTest is to simplify the fuzzing of low-level,
relatively stateless functions (e.g., data parsers, format converters) that are
difficult to exercise effectively from the syscall boundary. It is intended for
in-situ fuzzing of kernel code without requiring that it be built as a separate
userspace library or that its dependencies be stubbed out. Using a simple
macro-based API, developers can add a new fuzz target with minimal boilerplate
code.

The core design consists of three main parts:
1. A `FUZZ_TEST(name, struct_type)` macro that allows developers to
   easily define a fuzz test.
2. A binary input format that allows a userspace fuzzer to serialize
   complex, pointer-rich C structures into a single buffer.
3. Metadata for test targets, constraints, and annotations, which is
   emitted into dedicated ELF sections to allow for discovery and
   inspection by userspace tools.

To prove its viability, KFuzzTest has already been integrated with Syzkaller
for coverage-guided fuzzing. We have also developed a standalone, in-VM tool
to provide a low-friction path for developers to immediately begin writing and
running fuzz targets.

This series is an RFC to gather early feedback on the overall design and
approach. We are particularly interested in feedback on:
- The general utility of such a framework.
- The design of the binary serialization format.
- The use of ELF sections for metadata and discovery.

A known issue in this version is the redefinition of two KASAN constants.
This is a temporary measure to facilitate this RFC, as a proper refactoring
causes build issues that we feel are best addressed separately from the initial
design discussion of KFuzzTest.

The patch series is structured as follows:
- Patch 1 refactors KASAN to expose functions needed by KFuzzTest.
- Patch 2 introduces the core KFuzzTest API and data structures.
- Patch 3 adds the runtime implementation for the framework.
- Patch 4 adds documentation.
- Patch 5 provides example fuzz targets.

Ethan Graham (5):
  mm/kasan: expose poisoning functions for external modules
  kfuzztest: add user-facing API and data structures
  kfuzztest: implement core module and input processing
  kfuzztest: add ReST documentation
  kfuzztest: add example fuzz targets

 Documentation/dev-tools/index.rst     |   1 +
 Documentation/dev-tools/kfuzztest.rst | 187 +++++++++
 arch/x86/kernel/vmlinux.lds.S         |  22 ++
 include/linux/kasan.h                 |  28 ++
 include/linux/kfuzztest.h             | 537 ++++++++++++++++++++++++++
 lib/Kconfig.debug                     |   1 +
 lib/Kconfig.kfuzztest                 |  20 +
 lib/Makefile                          |   2 +
 lib/kfuzztest/Makefile                |   4 +
 lib/kfuzztest/examples.c              |  75 ++++
 lib/kfuzztest/main.c                  | 161 ++++++++
 lib/kfuzztest/parse.c                 | 131 +++++++
 lib/kfuzztest/relocations.c           | 104 +++++
 mm/kasan/kasan.h                      |  28 --
 14 files changed, 1273 insertions(+), 28 deletions(-)
 create mode 100644 Documentation/dev-tools/kfuzztest.rst
 create mode 100644 include/linux/kfuzztest.h
 create mode 100644 lib/Kconfig.kfuzztest
 create mode 100644 lib/kfuzztest/Makefile
 create mode 100644 lib/kfuzztest/examples.c
 create mode 100644 lib/kfuzztest/main.c
 create mode 100644 lib/kfuzztest/parse.c
 create mode 100644 lib/kfuzztest/relocations.c