🤖 AI Summary
Traditional edge-covering fuzzing struggles to distinguish execution paths that differ only in parameter values, often missing critical state transitions. This work proposes a context-aware feedback mechanism for kernel fuzzing that captures data flow across function boundaries by leveraging LLVM instrumentation to record parameters and return values. It uniquely employs DWARF metadata to automatically resolve composite types without requiring source-code annotations. To enable efficient, zero-interference logging alongside existing tools like KCOV and syzkaller, the approach introduces a lock-free per-task ring buffer, supporting accurate parameter capture even for Rust kernel modules compiled under -O2 optimization. Evaluated across five vulnerability classes—including out-of-bounds accesses, use-after-free, double-free, deep propagation bugs, and Rust FFI issues—the method incurs less than 3% runtime overhead while significantly enhancing fuzzing guidance precision and security analysis efficiency.
📝 Abstract
Coverage-guided kernel fuzzers such as syzkaller rely on edge coverage (trace-pc) as their sole feedback signal. This context-blind approach cannot distinguish execution paths that differ only in argument values. for example, two invocations of copy_from_user() with different size parameters hit identical basic blocks yet have vastly different security implications. We present BOUNDARY FLOW, an LLVM-based instrumentation framework that extends Linux KCOV with data-flow extraction of function arguments and return values. A compiler pass (-fsanitize-coverage=dataflow-args, dataflow-ret) emits lightweight callbacks capturing a structured tuple <PC, arg_idx, arg_size, ptr, offsets[]> at function entry and <PC, ret_size, ptr, offsets[]> at return. Composite types are automatically decomposed via DWARF DICompositeType metadata with zero source annotation. A separate kernel device(/sys/kernel/debug/kcov_dataflow) provides lock-free per-task ring buffers with no inter ference to existing KCOV or syzkaller infrastructure. We demonstrate dual utility: fuzzers gain state-aware feedback for mutation guidance into value-dependent state transitions, and security analysts obtain deterministic argument records for root-cause analysis without printk or kprobe overhead. A post-compilation pipeline (rustc, opt, llc) enables Rust kernel module instrumentation without modifying rustc, the only runtime method for capturing Rust function arguments given that drgn/vmcore fails under-O2 DWARF elision. Evaluated on five vulnerability classes (OOB, UAF, double-free, 10 deep chain propagation, Rust FFI, Rust for Linux Modules) with <3% overhead on instrumented paths.