Fuzzing Error Handling Code in Device Drivers Based on Software Fault Injection

Zu-Ming Jiang (1) , Jia-Ju Bai (1) , Julia L. Lawall (2) , Shi-Min Hu (1)

1 THU - Tsinghua University [Beijing]
2 Whisper - Well Honed Infrastructure Software for Programming Environments and Runtimes

Device drivers remain a main source of runtime failures in operating systems. To detect bugs in device drivers, fuzzing has been commonly used in practice. However, a main limitation of existing fuzzing approaches is that they cannot effectively test error handling code. Indeed, these fuzzing approaches require effective inputs to cover target code, but much error handling code in drivers is triggered by occasional errors (such as insufficient memory and hardware malfunctions) that are not related to inputs. In this paper, based on software fault injection, we propose a new fuzzing approach named FIZZER, to test error handling code in device drivers. At compile time, FIZZER uses static analysis to recommend possible error sites that can trigger error handling code. During driver execution, by analyzing runtime information, it automatically fuzzes error-site sequences for fault injection to improve code coverage. We evaluate FIZZER on 18 device drivers in Linux 4.19, and in total find 22 real bugs. The code coverage is increased by over 15% compared to normal execution without fuzzing.

Mots clés: Bug detection; Dynamic analysis; Fuzzing; Device drivers; Fault injection

Domaines: Génie logiciel [cs.SE]; Système d'exploitation [cs.OS]

Zu-Ming Jiang, Jia-Ju Bai, Julia L. Lawall, Shi-Min Hu. Fuzzing Error Handling Code in Device Drivers Based on Software Fault Injection. ISSRE 2019 - The 30th International Symposium on Software Reliability Engineering, Oct 2019, Berlin, Germany. ⟨10.1109/ISSRE.2019.00022⟩. ⟨hal-02389293⟩