KFuzzTest: all the changes made. #9
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
added 30 commits
June 18, 2025 10:02
binary representation down. Correctly causes a KASAN repot when passing a buggy input to it.
Added support for this for x86 arch, but it is probably fragile because we aren't guarding with a #ifdef yet
the argument type that the function takes so that the user can use tools like pahole to generate a syzkaller definition of the argument and thus fuzz the function more easily.
files. It works, and the function is exposed correctly!
has a line separator between it and the common linux includes, as per https://elixir.bootlin.com/linux/v6.12.5/source/mm/kfence/core.c
pointer to function argument type. This should remove the need for a mutex guarding a shared buffer entirely, and ultimately will likely perform better.
variable, and extract common input reading functionality into a separate function.
these via sysfs, and how they can be parsed from the vmlinux binary as well.
constraints to avoid weird errors occurring during parsing.
strings) and a field being the length of another.
There was not any mechanism in place in the KFuzzTest for distinguishing between value pointers and array pointers in fuzz test inputs. This information is difficult to parse without additional semantic information on the context. We introduce a new KFTF_ANNOTATE_ARRAY macro that annotates a field in a KFuzzTest input struct as an array, removing this ambiguity.
relocation parsing code.
remove copying from userspace
guarantees for encoded structures.
ethangraham2001
force-pushed
the
kfuzztest/relocations-revisited
branch
from
d286890 to
45f4942
Compare
added 15 commits
August 7, 2025 19:32
kfuzztest: update documentation
Checks that KASAN is enabled before poisoning a region.
We now check for overflows a lot more carefully, and validate the input so that regions don't point out of bounds. Fix some nits etc...
We now assume that there is at least 8 bytes of padding before the payload. This means that we never poison the relocation table, which isn't a bad thing in my opinion.
ethangraham2001
force-pushed
the
kfuzztest/relocations-revisited
branch
from
611f62f to
eab275f
Compare
added 10 commits
August 8, 2025 09:14
Function now bails out when CONFIG_KASAN is not built in, which prevents checks.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This is a big diff of all of the changes made by KFuzzTest. This will need to be
chunked up before sending an RFC.