KFuzzTest: All progress so far #6
Draft
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
added 28 commits
June 18, 2025 10:02
binary representation down. Correctly causes a KASAN repot when passing a buggy input to it.
Added support for this for x86 arch, but it is probably fragile because we aren't guarding with a #ifdef yet
the argument type that the function takes so that the user can use tools like pahole to generate a syzkaller definition of the argument and thus fuzz the function more easily.
files. It works, and the function is exposed correctly!
has a line separator between it and the common linux includes, as per https://elixir.bootlin.com/linux/v6.12.5/source/mm/kfence/core.c
pointer to function argument type. This should remove the need for a mutex guarding a shared buffer entirely, and ultimately will likely perform better.
variable, and extract common input reading functionality into a separate function.
these via sysfs, and how they can be parsed from the vmlinux binary as well.
constraints to avoid weird errors occurring during parsing.
strings) and a field being the length of another.
There was not any mechanism in place in the KFuzzTest for distinguishing between value pointers and array pointers in fuzz test inputs. This information is difficult to parse without additional semantic information on the context. We introduce a new KFTF_ANNOTATE_ARRAY macro that annotates a field in a KFuzzTest input struct as an array, removing this ambiguity.
relocation parsing code.
remove copying from userspace
guarantees for encoded structures.
ethangraham2001
force-pushed
the
kfuzztest/all
branch
from
ac414c5 to
e328953
Compare
added 3 commits
July 25, 2025 09:49
Iterating through a section where structures aren't aligned to a power-of-2 boundary leads to incorrect memory accesses.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Includes all kernel code for the KFuzzTest module. Does not include any fuzz targets.