Implement System Call Fuzzer: Send Invalid Arguments

Topic Overview

Breaking the Contract

Kernel syscall handlers must validate every user pointer and length. Fuzzers send garbage arguments (negative lengths, unmapped addresses, wrong fd types) hunting for panics or privilege leaks.

Fuzzing Strategy

Effective campaigns:

• Randomize args within wide ranges
• Track coverage of error branches
• Run in VM snapshots for crash recovery

For example, calling read(-1, (void*)1, SIZE_MAX) should return EBADF or EFAULT, never crash the kernel.

Why This Matters in Production

Google's syzkaller has found thousands of real Linux kernel bugs this way, including use-after-free and out-of-bounds vulnerabilities that earned CVEs, precisely by fuzzing syscall arguments like the ones you generate here (NULL pointers, negative fds, boundary sizes). The crash-catching pattern with sigsetjmp/siglongjmp mirrors how real fuzzing harnesses keep running after a target syscall corrupts memory instead of taking down the entire fuzzer process.

Debugging Checklist

Before you call the implementation done, walk failure modes on purpose. Test empty structures, single-element edge cases, maximum concurrency, and errno paths that must not crash the program. OS code usually fails in production when happy-path tests pass but invariants break under contention or memory pressure.

Implementation Notes

Keep structures small and name fields after kernel counterparts when possible. That lets you read man pages and kernel source side by side while you work. Print observable events during development; remove noisy logs once tests pass reliably.

For This Exercise

You will implement a userspace harness that mutates syscall arguments and records outcomes. The task asks you to classify results into expected errno vs unexpected signals.

Your Task

Build a small system-call fuzzer. It picks a target syscall at random, fills each argument from a pool of boundary values, calls a model kernel, and classifies the result. When the fuzzer finds a crash, it minimises the reproducer. Everything is driven by a seeded PRNG, so a run can be replayed exactly, just as real fuzzers record their seeds.

Input

cCopy
Loading…

PRNG

The state starts as splitmix64(S) (or 1 if that is 0). Each draw is xorshift64*:

cCopy
Loading…

Each iteration draws the target as targets[next() % count], in the order the targets were listed (a repeated target takes another slot). It then draws each argument, left to right, as pool[next() % size].

Model kernel

Open fds are 1, 2 and 3. A user range is valid if buf >= 0x10000, buf < 0x800000000000, and len <= 0x800000000000 - buf.

• write(fd, buf, count): bad fd gives EBADF. count 0 returns 0. An invalid range gives EFAULT. Otherwise it returns min(count, 0x7ffff000).
• lseek(fd, offset, whence): bad fd gives EBADF. The base is 0, 100 or 4096 for whence 0, 1 or 2, and any other whence gives EINVAL. A positive offset that would overflow gives EOVERFLOW (75). A negative result gives EINVAL. Otherwise it returns the new position.
• bugcopy(fd, buf, len): fd must be 3, otherwise EBADF. An invalid range gives EFAULT. len > 4096 gives a KERNEL OOPS (the planted bug: a missing bounds check). Otherwise it returns len.

Output

cCopy
Loading…

• Pointers print in hex, lengths as unsigned, and everything else as signed.
• The summary lists each distinct target in the order listed, with error counts in errno-number order (EBADF 9, EFAULT 14, EINVAL 22, EOVERFLOW 75).
• Minimisation. Start from the first crashing call. For each argument in turn, replace it with the earliest pool value that still crashes (keeping the other arguments fixed), or keep it if none does.
• Other messages: unknown target NAME, and no targets (then stop).

Example

Input:

cCopy
Loading…

Output:

cCopy
Loading…

Requirements

1. Implement the PRNG exactly as given, with unsigned 64-bit wrap-around, so every learner's run of seed S is identical.
2. Check user ranges without overflow. buf + len can wrap, so compare len against 0x800000000000 - buf instead.

Hidden tests cover a long quiet run over all three targets with crashes and minimisation, an unknown target name, a repeated target, and a single-iteration run.