Execution with sanitizers, integration with syzkaller

Execution with sanitizers, integration with syzkaller

[Sabyrzhan Tasbolatov]

Hello,

Thanks for the amazing project!

From https://github.com/sashiko-dev/sashiko README.md:

> Stage 3: Execution flow verification. Traces C code execution flow,
> checking for logic errors, missing return checks, unhandled error paths,
> and off-by-one errors.

I wonder if sashiko's Stage 3 can be configured or altered
with KASAN, KMSAN etc. sanitizers. I couldn't find how the execution works.
Perhaps, such as sanitizers could improve the PATCH review,
as the optional flag during Stage 3.

This also brings up a vague thought about sashiko + syzkaller projects,
where sashiko could provide information about the similar bugs found
in the PATCH, if any, among syzkaller reports. Like adding syzkaller
mailing list
reports as context as well.

Re: Execution with sanitizers, integration with syzkaller

[Roman Gushchin]

Sabyrzhan Tasbolatov <snovitoll@gmail.com> writes:

> Hello,
>
> Thanks for the amazing project!

Thanks!

> From https://github.com/sashiko-dev/sashiko README.md:
>
>> Stage 3: Execution flow verification. Traces C code execution flow,
>> checking for logic errors, missing return checks, unhandled error paths,
>> and off-by-one errors.
>
> I wonder if sashiko's Stage 3 can be configured or altered
> with KASAN, KMSAN etc. sanitizers. I couldn't find how the execution works.
> Perhaps, such as sanitizers could improve the PATCH review,
> as the optional flag during Stage 3.

Do you mean actually build and run the kernel?
If so, it's not what I want to build into Sashiko directly, because
it will require significant infrastructure, a lot of hardware and
corresponding support and will complicate things a lot. However there
will be a database of pre-existing kernel bugs open to other trusted
tools (e.g. syzkaller) which will be able to enrich ai findings.

> This also brings up a vague thought about sashiko + syzkaller projects,
> where sashiko could provide information about the similar bugs found
> in the PATCH, if any, among syzkaller reports. Like adding syzkaller
> mailing list
> reports as context as well.

Sorry, not sure I got your idea. Can you elaborate please?

Thanks!