一句话：通过测量研究揭示内核模糊测试中依赖挑战的普遍性，并指出其只是覆盖率不足的表象而非根因。
模糊测试操作系统内核至今仍是艰巨任务。内核中大量代码被特定内核状态锁定，现有内核模糊器难以有效探索巨大的状态空间，该问题被称为依赖挑战。已有工作虽尝试解决依赖，但多是在依赖容易识别时机会主义地恢复，依赖的普遍性与分类从未被系统研究。本文开展大规模测量研究，系统理解依赖挑战背后的真实困难。令人意外的是，即使对于已被充分模糊测试的内核模块，未解决的依赖仍占未覆盖分支的59%至88%。进一步分析表明，依赖挑战只是未能获得更高覆盖率的症状，而非根本原因。通过提炼和总结这些发现，本文为未来内核模糊测试研究提供指导，并基于测量洞见提出若干新研究方向。
Fuzz testing operating system kernels remains a daunting task to date. One known challenge is that much of the kernel code is locked under specific kernel states and current kernel fuzzers are not effective in exploring such an enormous state space. We refer to this problem as the dependency challenge. Though there are some efforts trying to address the dependency challenge, the prevalence and categorization of dependencies have never been studied. Most prior work simply attempted to recover dependencies opportunistically whenever they are relatively easy to recognize. In this paper, we undertake a substantial measurement study to systematically understand the real challenge behind dependencies. To our surprise, we show that even for well-fuzzed kernel modules, unresolved dependencies still account for 59% - 88% of the uncovered branches. Furthermore, we show that the dependency challenge is only a symptom rather than the root cause of failing to achieve more coverage. By distilling and summarizing our findings, we believe the research provides valuable guidance to future research in kernel fuzzing. Finally, we propose a number of novel research directions directly based on the insights gained from the measurement study.
@inproceedings{paperbot6942,
title = {Demystifying the dependency challenge in kernel fuzzing},
author = {Yu Hao and Hang Zhang and Guoren Li and Xingyun Du and Zhiyun Qian and Ardalan Amiri Sani},
booktitle = {ICSE},
year = {2022},
doi = {10.1145/3510003.3510126}
}