Finding Bugs in File Systems with an Extensible Fuzzing Framework
Finding Bugs in File Systems with an Extensible Fuzzing Framework
复制标题
DOI：
10.1145/3391202
复制
发表时间：
2020-05
期刊：
影响因子：
--
通讯作者：
Seulbae Kim;Meng Xu;Sanidhya Kashyap;Jungyeon Yoon;Wen Xu;Taesoo Kim
中科院分区：
文献类型：
--
作者：
Seulbae Kim;Meng Xu;Sanidhya Kashyap;Jungyeon Yoon;Wen Xu;Taesoo Kim
文件系统太大而不能无bug。尽管手写测试套件已被广泛用于对文件系统进行压力测试，但它们很难跟上文件系统大小和复杂性的快速增长，从而导致引入新的错误。这些bug有各种各样的形式：缓冲区溢出到复杂的语义bug。尽管存在特定于错误的检查器，但它们通常缺乏彻底探索文件系统状态的方法。更重要的是，目前还没有一个统包解决方案能够将文件系统各个方面的检查工作统一到一个整体中。在本文中，为了突出以通用方式应用模糊查找任何类型的文件系统错误的潜力，我们提出了Hydra，一个可扩展的模糊框架。Hydra为文件系统模糊化提供了构建块，包括输入变更器、反馈引擎、测试执行器和错误后处理器。因此，开发人员只需要专注于构建核心逻辑，以发现他们感兴趣的bug。我们展示了Hydra的有效性，它有四个检查器，可以搜索崩溃不一致、POSIX违规、逻辑断言失败和内存错误。到目前为止，Hydra已经在Linux文件系统中发现了157个新的bug，其中包括三个在已验证的文件系统（FSCQ和Yxv6）中。
File systems are too large to be bug free. Although handwritten test suites have been widely used to stress file systems, they can hardly keep up with the rapid increase in file system size and complexity, leading to new bugs being introduced. These bugs come in various flavors: buffer overflows to complicated semantic bugs. Although bug-specific checkers exist, they generally lack a way to explore file system states thoroughly. More importantly, no turnkey solution exists that unifies the checking effort of various aspects of a file system under one umbrella. In this article, to highlight the potential of applying fuzzing to find any type of file system bugs in a generic way, we propose Hydra, an extensible fuzzing framework. Hydra provides building blocks for file system fuzzing, including input mutators, feedback engines, test executors, and bug post-processors. As a result, developers only need to focus on building the core logic for finding bugs of their interests. We showcase the effectiveness of Hydra with four checkers that hunt crash inconsistency, POSIX violations, logic assertion failures, and memory errors. So far, Hydra has discovered 157 new bugs in Linux file systems, including three in verified file systems (FSCQ and Yxv6).