الفوركس الخيارات الثنائية الخيارات الثنائية الخيارات الثنائية الخيارات الثنائية الخيارات الثنائية الخيارات الثنائية الخيارات الثنائية الخيارات الثنائية الخيارات الثنائية الخيارات الثنائية الخيارات الثنائية الخيارات الثنائية الخيارات الثنائية الخيارات الثنائية الخيارات الثنائية الخيارات الثنائية الخيارات الثنائية الخيارات الثنائية الخيارات الثنائية الخيارات الثنائية الخيارات

Syzkaller's edge coverage (trace-pc) treats every call to copy_from_user() as identical, even when a size argument of 1 versus 1000 triggers entirely different security consequences. That context-blind feedback is the single biggest blind spot in coverage-guided kernel fuzzing today.

The Blindness of Edge Coverage

KCOV's trace-pc mode records only which basic blocks were visited, not what values flowed through them. Two invocations of the same function that hit the same edges but carry different argument values are indistinguishable. For a kernel function like copy_from_user(), the difference between a size of 1 and 1000 can mean a harmless copy or a buffer overflow, but the fuzzer sees neither.

How the LLVM Pass Works

The paper's author built an LLVM instrumentation pass that emits lightweight callbacks at function entry and return, capturing structured tuples of program counter, argument metadata, and field values. Composite types are decomposed automatically via DWARF DICompositeType metadata — zero source annotation required. A lock-free per-task ring buffer delivers these records to user space without interfering with existing KCOV or syzkaller infrastructure.

Dual Utility: Better Fuzzing and Cleaner Root-Cause Analysis

Fuzzers gain state-aware feedback for mutation guidance into value-dependent state transitions — think state machines hidden inside kernel code that edge coverage can't touch. Security analysts get deterministic argument records for root-cause analysis, replacing the usual spaghetti of printk or kprobe scripts.

Rust Support Without Compiler Modification

Two Rust instrumentation paths are provided: a post-compilation pipeline requiring no rustc modification, and native instrumentation via rustc built against the custom LLVM. These are the only runtime methods for capturing Rust function arguments given that drgn/vmcore fails under -O2 DWARF elision.

With this framework, kernel fuzzers can finally navigate value-dependent state machines, and security audits shift from cluttered printk logs to structured argument records pulled from a lock-free ring buffer.

Source: Beyond Edge Coverage: Per-Task Data-Flow Extraction at Kernel Function Boundaries via LLVM
Domain: arxiv.org