KFuzzTest: proof of concept #6280

ethangraham2001 · 2025-08-13T09:55:24Z

Important

These commits are not cleaned at all - they are taken directly from my personal development branch, and the intention is to cleanly chunk it up at a later point when the code has stabilized, and a kernel RFC is opened.

The source of truth for this PR is the global diff, rather than the commits themselves.

Description

Proof of concept for KFuzzTest integration in syzkaller.

Readme in docs/kfuzztest.md.

Additions

Addition of a standalone tool syz-kfuzztest.
Encoding logic for the KFuzzTest input format.
Integration into syz-manager for dynamic discovery and continuous fuzzing of
of KFuzzTest targets.
Tool that automatically parses, generates, and emits syzkaller descriptions for
for KFuzzTest targets discovered from a vmlinux binary.

docs/kfuzztest.md

tarasmadan

I'll do more batches later.

executor/common_linux.h

pkg/kcov/cdefs.go

pkg/kcov/kcov.go

prog/encodingexec.go

prog/encodingexec_test.go

syz-kfuzztest/main.go

prog/target.go

prog/kfuzztest.go

a-nogikh · 2025-08-14T14:23:26Z

prog/kfuzztest.go

+		arg := queue.pop()
+		padWithAlignment(&encoded, arg.Type().Alignment(), 0)
+
+		switch a := arg.(type) {


It's concerning that we're getting one more place in the code where we manually traverse the argument tree and switch over the argument types.

Is there some way to restructure this code using the Foreach* functions we have in https://github.com/google/syzkaller/blob/master/prog/analysis.go?

I also wonder if we can rely more on the functionality we already have in https://github.com/google/syzkaller/blob/master/prog/alloc.go and in execContext.writeArg. In particular, memAlloc could be taught to insert kFuzzTestPoisonSize between the allocated data and writeArg could optionally keep track of the pointers/where they point.

syz-kfuzztest/manager.go

tarasmadan · 2025-08-21T08:15:31Z

@gemini /review

tarasmadan · 2025-08-21T08:56:53Z

@gemini-cli /review

github-actions

📋 Review Summary

This pull request is a solid proof-of-concept for integrating KFuzzTest into syzkaller. The overall structure is well-thought-out, with clear separation of concerns between extracting KFuzzTest definitions, building syzlang descriptions, and executing the tests.

🔍 General Feedback

The main point of feedback is the extensive use of panic throughout the new code. While this might be acceptable for a proof-of-concept, it should be replaced with proper error handling to make the code more robust and suitable for production use, especially in library code.
There are a few places where constants are hardcoded (e.g., file paths, syscall IDs). It would be better to define these in a central place to improve maintainability.
The code is generally well-written and easy to follow. The addition of documentation and a standalone tool for generating descriptions is a great touch.

Overall, this is a great start, and with some improvements to error handling and configuration, it will be a valuable addition to syzkaller.

pkg/kfuzztest/builder.go

github-actions · 2025-08-21T09:00:52Z

pkg/kfuzztest/builder.go

+		}
+
+		// just appends the type as it appear in the
+	append_type:


low: The use of goto here makes the code harder to follow. It can be refactored to use a boolean flag or by restructuring the if/else blocks to avoid it.

pkg/kfuzztest/extractor.go

pkg/kfuzztest/kfuzztest.go

prog/encodingexec.go

prog/kfuzztest.go

github-actions · 2025-08-21T09:01:00Z

prog/kfuzztest.go

+
+// marshallKFuzzTestArg serializes a syzkaller Arg into a flat binary format
+// understood by the KFuzzTest kernel interface (see `include/linux/kfuzztest.h`).
+//


medium: The function panics on unsupported types. It would be better to return an error to allow the caller to handle this case, for example by skipping the unsupported program.

syz-kfuzztest/main.go

tools/kfuzztest-gen/main.go

prog/target.go

pkg/kfuzztest/kfuzztest.go

Adds a Go-native KCOV package, which helper functions for tracing a call. This is in preparation for a standalone KFuzzTest tool, which should be written in Go in order to take advantage of existing fuzzing infrastructure. Signed-off-by: Ethan Graham <[email protected]>

This commit introduces logic and types needed for KFuzzTest. In particular, we introduce a new pseudo-syscall syz_kfuzztest_run with specialized encoding for the KFuzzTest input format, as well as a new KFuzzTest attribute used to distinguish normal syscalls from KFuzzTest targets. Signed-off-by: Ethan Graham <[email protected]>

This commit introduces an extend method to target, which is used to dynamically add new system calls to a target at runtime. This is in preparation for KFuzzTest dynamic discovery which uses dwarf parsing to identify KFuzzTest targets at runtime. Signed-off-by: Ethan Graham <[email protected]>

Add pkg/kfuzztest, which contains the core logic for parsing targets fuzz targets (including domain constraints and annotations) from a vmlinux binary. This is namely used for dynamically discovering KFuzzTest targets, generating and generating syzkaller descriptions for them. Signed-off-by: Ethan Graham <[email protected]>

Introduces the syz-kfuzztest tool, as well as a new executor file in pkg/kfuzztest. This tool, alongside existing fuzzing infrastructure, performs coverage guided fuzzing of KFuzzTest targets, collecting coverage using pkg/kcov and outputting a list of collects program counters which can be fed into tools/syz-cover. Signed-off-by: Ethan Graham <[email protected]>

We favour only logging something on failure.

Remove flag package, as we only parse a single argument every time. Instead, we can just look at os.Args[1] to get the path to VMLinux.

It was proving difficult and unreliable to modify the string generation logic to ensure null-termination of KFuzzTest strings. Doing so directly within the encoding is more reliable, and seems to result in no false positive string overflows.

Prior to this, we were doing pattern matching on the dwarf type names. This is brittle, and means that support for new types (e.g., u64) would have to be added manually. Switch to an approach that recurses over the dwarf types, resolving typedefs into primitive types that map very easily onto syzkaller types. Also refactor some of the code related to annotation processing, which was become unwieldly.

tarasmadan self-requested a review August 14, 2025 08:16