syzkaller icon indicating copy to clipboard operation
syzkaller copied to clipboard

all: modify device driver parameters during fuzzing

Open fellair opened this issue 6 months ago • 0 comments

Is your feature request related to a problem? Please describe. Some specific filesystems (like zonefs) or devices (gadgets, /dev/nullb0 as zoned device) can only be properly tested if they are preemptively set up correctly. With /dev/nullb0, for instance, we could pass 'null_blk.zone=1' as an extra kernel parameter but then, as far as I can tell, for the durarion of fuzzing that device will remain zoned, expanding coverage in one place and shrinking it elsewhere.

Describe the solution you'd like I see several flawed options, could really use some guidance here:

  1. Kernel module options - too restrictive. Plus for syzbot, you have to regenerate configs much too often.
  2. sysctl or syscall that emulates sysctl - for /dev/nullb0, we can write into /sys/kernel/config/... and change device nature via configfs interface. Might also be useful for fuzzing gadgets... Maybe a pseudo-syscall that is properly described in /sys/linux/*.txt and allows to write specific things to chosen parameter files?

Additional context In https://github.com/google/syzkaller/pull/6088, most ioctls dealing with zones won't go far as /dev/nullb0 is not zoned.

fellair avatar Jun 12 '25 19:06 fellair