Re: Execution with sanitizers, integration with syzkaller

Sabyrzhan Tasbolatov <[email protected]> writes:

> Hello,
>
> Thanks for the amazing project!

Thanks!

> From https://github.com/sashiko-dev/sashiko README.md:
>
>> Stage 3: Execution flow verification. Traces C code execution flow,
>> checking for logic errors, missing return checks, unhandled error paths,
>> and off-by-one errors.
>
> I wonder if sashiko's Stage 3 can be configured or altered
> with KASAN, KMSAN etc. sanitizers. I couldn't find how the execution works.
> Perhaps, such as sanitizers could improve the PATCH review,
> as the optional flag during Stage 3.

Do you mean actually build and run the kernel?
If so, it's not what I want to build into Sashiko directly, because
it will require significant infrastructure, a lot of hardware and
corresponding support and will complicate things a lot. However there
will be a database of pre-existing kernel bugs open to other trusted
tools (e.g. syzkaller) which will be able to enrich ai findings.

> This also brings up a vague thought about sashiko + syzkaller projects,
> where sashiko could provide information about the similar bugs found
> in the PATCH, if any, among syzkaller reports. Like adding syzkaller
> mailing list
> reports as context as well.

Sorry, not sure I got your idea. Can you elaborate please?

Thanks!