基于反馈驱动的Fuzzing改进LockDoc内核测试
Improving Linux-Kernel Tests for LockDoc with Feedback-driven Fuzzing
摘要：
LockDoc是一种从系统处于基准负载下时记录的动态执行跟踪中提取内核数据结构的锁定规则的方法。这些锁定规则可以例如用于定位同步错误。对于高规则精度和彻底的错误发现，该方法在很大程度上取决于基准测试的选择：它们必须触发内核子系统中与目标数据结构相关的尽可能多的代码的执行。然而，现有的测试套件，如Linux测试项目（LTP）提供的那些测试套件，在LTP的情况下，仅实现了VFS子系统的大约35%的基本块覆盖率，当为与文件系统相关的数据结构提取锁定规则时，VFS子系统是相关的子系统。在本文中，我们将讨论如何补充LTP套件以提高LockDoc场景的代码覆盖率。我们重新调整了syzkaller --一个覆盖率引导的模糊器，目标是验证内核API的鲁棒性--1）不以内核崩溃为目标，2）最大化特定内核子系统的代码覆盖率。因此，我们生成了可以在LTP之外运行的新基准程序，并将VFS基本块覆盖率提高了26.1%。
英文摘要：
LockDoc is an approach to extract locking rules for kernel data structures from a dynamic execution trace recorded while the system is under a benchmark load. These locking rules can e.g. be used to locate synchronization bugs. For high rule precision and thorough bug finding, the approach heavily depends on the choice of benchmarks: They must trigger the execution of as much code as possible in the kernel subsystem relevant for the targeted data structures. However, existing test suites such as those provided by the Linux Test Project (LTP) only achieve -- in the case of LTP -- about 35 percent basic-block coverage for the VFS subsystem, which is the relevant subsystem when extracting locking rules for filesystem-related data structures. In this article, we discuss how to complement the LTP suites to improve the code coverage for our LockDoc scenario. We repurpose syzkaller -- a coverage-guided fuzzer with the goal to validate the robustness of kernel APIs -- to 1) not aim for kernel crashes, and to 2) maximize code coverage for a specific kernel subsystem. Thereby, we generate new benchmark programs that can be run in addition to the LTP, and increase VFS basic-block coverage by 26.1 percent.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
