KFuzzTest integration #6280

ethangraham2001 · 2025-08-13T09:55:24Z

Description

KFuzzTest integration in syzkaller.

Readme in docs/kfuzztest.md, syz-kfuzztest-specific documentation in docs/syz-kfuzztest.md.

Additions

Addition of a standalone tool syz-kfuzztest.
Encoding logic for the KFuzzTest input format.
Integration into syz-manager for dynamic discovery and continuous fuzzing of
of KFuzzTest targets.
Tool that automatically parses, generates, and emits syzkaller descriptions for
for KFuzzTest targets discovered from a vmlinux binary.
Function for fetching syz_kfuzztest_run's ID from a target (cached)

Modifications

Restricted mutation for KFuzzTest targets
target.lazyInit() fetches KFuzzTest run's ID
Targets can now be extended with new syscalls

docs/kfuzztest.md

tarasmadan

I'll do more batches later.

executor/common_linux.h

pkg/kcov/cdefs.go

pkg/kcov/kcov.go

prog/encodingexec.go

prog/encodingexec_test.go

syz-kfuzztest/main.go

prog/target.go

prog/kfuzztest.go

syz-kfuzztest/manager.go

tarasmadan · 2025-08-21T08:15:31Z

@gemini /review

tarasmadan · 2025-08-21T08:56:53Z

@gemini-cli /review

github-actions

📋 Review Summary

This pull request is a solid proof-of-concept for integrating KFuzzTest into syzkaller. The overall structure is well-thought-out, with clear separation of concerns between extracting KFuzzTest definitions, building syzlang descriptions, and executing the tests.

🔍 General Feedback

The main point of feedback is the extensive use of panic throughout the new code. While this might be acceptable for a proof-of-concept, it should be replaced with proper error handling to make the code more robust and suitable for production use, especially in library code.
There are a few places where constants are hardcoded (e.g., file paths, syscall IDs). It would be better to define these in a central place to improve maintainability.
The code is generally well-written and easy to follow. The addition of documentation and a standalone tool for generating descriptions is a great touch.

Overall, this is a great start, and with some improvements to error handling and configuration, it will be a valuable addition to syzkaller.

pkg/kfuzztest/builder.go

pkg/kfuzztest/extractor.go

pkg/kfuzztest/kfuzztest.go

prog/encodingexec.go

prog/kfuzztest.go

syz-kfuzztest/main.go

tools/kfuzztest-gen/main.go

prog/target.go

pkg/kfuzztest/kfuzztest.go

pkg/mgrconfig/load.go

tools/syz-prog2c/prog2c.go

pkg/kfuzztest/kfuzztest.go

tools/syz-mutate/mutate.go

tools/kfuzztest-gen/main.go

syz-manager/manager.go

syz-kfuzztest/manager.go

pkg/kfuzztest/executor.go

executor/common_linux.h

pkg/mgrconfig/load.go

tools/syz-execprog/execprog.go

pkg/vminfo/linux_syscalls.go

pkg/kfuzztest/extractor.go

pkg/kfuzztest/kfuzztest.go

pkg/kfuzztest/builder.go

pkg/kfuzztest/executor.go

prog/rand.go

Add a Go-native KCOV package, with a helper functions for tracing a a function. This is in preparation for a standalone KFuzzTest tool, which should be written in Go in order to take advantage of existing fuzzing infrastructure. The hard-coded coverage buffer size is the same as the executor program, defined as `512 << 10` in `executor/executor.cc`. Signed-off-by: Ethan Graham <ethangraham@google.com>

Add syz_kfuzztest_run pseudo-syscall, KFuzzTest attribute, and encoding logic. KFuzzTest targets, which are invoked in the executor with the new syz_kfuzztest_run pseudo-syscall, require specialized encoding. To differentiate KFuzzTest calls from standard syzkaller calls, we introduce a new attribute called KFuzzTest or "kfuzz_test" in syzkaller descriptions that can be used to annotate calls. Signed-off-by: Ethan Graham <ethangraham@google.com>

As KFuzzTest targets are discovered at boot, we need a mechanism for adding these to the array of enabled system calls. This is implemented by the new Extend method, which performs this setup. Signed-off-by: Ethan Graham <ethangraham@google.com>

All non-base variants of syz_kfuzztest_run (i.e., those that are discovered dynamically) are encoded so that they map onto the base variant which is defined in kfuzztest.txt, and known by the executor. We add a function for fetching this, that is wrapped in a sync.once block to avoid repeated iteration over the target's array of syscalls. Signed-off-by: Ethan Graham <ethangraham@google.com>

Add a new package, pkg/kfuzztest, that implements dynamic discovery of KFuzzTest targets by parsing a vmlinux kernel binary. Signed-off-by: Ethan Graham <ethangraham@google.com>

Internal kernel functions (and as a result KFuzzTest) have stricter contracts than system calls. For this reason, we must avoid mutating the following cases: - Length arguments not matching the length of the related buffer. - Strings not being null-terminated. Add special cases for KFuzzTest calls that avoids these situations. Signed-off-by: Ethan Graham <ethangraham@google.com>

Add logic for dynamic KFuzzTest target discovery in syz-manager. By default, all KFuzzTest targets are enabled when the enable_kfuzztest config option is set to true.

Signed-off-by: Ethan Graham <ethangraham@google.com>

syz-kfuzztest is a new standalone designed for fuzzing KFuzzTest on a live kernel VM (e.g., inside QEMU). It has no dependencies on the executor program, instead directly writing into a KFuzzTest target's debugfs entry. Signed-off-by: Ethan Graham <ethangraham@google.com>

Add a tool for generating a syscaller description for every KFuzzTest target discovered in a vmlinux binary and outputting it to stdout. Signed-off-by: Ethan Graham <ethangraham@google.com>

Add documentation for syzkaller's KFuzzTest integration, and a separate documentation file for the syz-kfuzztest program. Signed-off-by: Ethan Graham <ethangraham@google.com>

Introduce a KFuzzTest mode for the fuzzer so that a smaller number of recommended calls can be used if we are fuzzing KFuzzTest targets. Signed-off-by: Ethan Graham <ethangraham@google.com>

If vmlinux is specified as a flag, we perform a setup stage where we parse vmlinux for KFuzzTest targets. Signed-off-by: Ethan Graham <ethangraham@google.com>

Previously, the generated KFuzzTest programs were reusing the address of the top-level input struct. A problem could arise when the encoded blob is large and overflows into another allocated region - this certainly happens in the case where the input struct points to some large char buffer, for example. While this wasn't directly a problem, it could lead to racy behavior when running KFuzzTest targets concurrently. To fix this, we now introduce an additional buffer parameter into syz_kfuzztest_run that is as big as the maximum accepted input size in the KFuzzTest kernel code. When this buffer is allocated, we ensure that we have some allocated space in the program that can hold the entire encoded input. This works in practice, but has not been tested with concurrent KFuzzTest executions yet.

blackgnezdo · 2025-10-01T01:15:22Z

This seems to have broken at least FreeBSD and OpenBSD

a-nogikh · 2025-10-01T09:36:57Z

Oh, I didn't notice it, thanks for reporting.
I've sent #6392 that should fix it.

tarasmadan self-requested a review August 14, 2025 08:16