On Fri, Oct 14, 2022 at 08:48:30AM +0000, Hrutvik Kanabar wrote: > From: Hrutvik Kanabar <hrutvik@xxxxxxxxxx> > > Fuzzing is a proven technique to discover exploitable bugs in the Linux > kernel. But fuzzing filesystems is tricky: highly structured disk images > use redundant checksums to verify data integrity. Therefore, > randomly-mutated images are quickly rejected as corrupt, testing only > error-handling code effectively. > > The Janus [1] and Hydra [2] projects probe filesystem code deeply by > correcting checksums after mutation. But their ad-hoc > checksum-correcting code supports only a few filesystems, and it is > difficult to support new ones - requiring significant duplication of > filesystem logic which must also be kept in sync with upstream changes. > Corrected checksums cannot be guaranteed to be valid, and reusing this > code across different fuzzing frameworks is non-trivial. > > Instead, this RFC suggests a config option: > `DISABLE_FS_CSUM_VERIFICATION`. When it is enabled, all filesystems > should bypass redundant checksum verification, proceeding as if > checksums are valid. Setting of checksums should be unaffected. Mutated > images will no longer be rejected due to invalid checksums, allowing > testing of deeper code paths. Though some filesystems implement their > own flags to disable some checksums, this option should instead disable > all checksums for all filesystems uniformly. Critically, any bugs found > remain reproducible on production systems: redundant checksums in > mutated images can be fixed up to satisfy verification. > > The patches below suggest a potential implementation for a few > filesystems, though we may have missed some checksums. The option > requires `DEBUG_KERNEL` and is not intended for production systems. > > The first user of the option would be syzbot. We ran preliminary local > syzkaller tests to compare behaviour with and without these patches. > With the patches, we found a 19% increase in coverage, as well as many > new crash types and increases in the total number of crashes: I think the build-time option inflexible, but I see the point when you're testing several filesystems that it's one place to set up the environment. Alternatively I suggest to add sysfs knob available in debuging builds to enable/disable checksum verification per filesystem. As this may not fit to other filesystems I don't suggest to do that for all but I am willing to do that for btrfs, with eventual extension to the config option you propose. The increased fuzzing coverage would be good to have.
