KLAUS++

A framework to test the correctness of the Linux kernel patch.

Build the project

• make the gcc

cd src/gcc_find_inst
# make the gcc according to the README
cp -r gcc-bin ../../Docker-env/data

• make the patch_analyzer

cd src/patch_analyzer
make CC=/path/to/your/clang
cd .. && cp -r gcc-bin ../Docker-env/data

• make the fuzzer

cd Docker-env/data/klaus_plus_plus
make

Docker-env

Docker environment for KLAUS++.

KLAUS++ requires two arguments:

• commitid: The commit id of the buggy patch.
• syzid: The bug report id of the bug that the patch fixes.

e.g. To test the correctness of the patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=730c5fd42c1e, we need the commitid 730c5fd42c1e and the bug report(https://syzkaller.appspot.com/bug?id=53b6555b27af2cae74e2fbdac6cadc73f9cb18aa) id 53b6555b27af2cae74e2fbdac6cadc73f9cb18aa that this patch fixes.

cd Docker-env
docker build -t klaus_plus_plus . 
docker run -v $(pwd)/data:/data --rm -it --privileged klaus_plus_plus
# static analysis and instrumentation.
cd /data/fuzz_cfgs_dir/
python3 build_env.py [commitid] [syzid]
# start fuzzing.
cd [commitid]
./fuzz_start.sh

src

Source code of KLAUS++.

• patch_analyzer: static analysis tool.
• dis_calculator: tool to calculate distance for the kernel. This component is a derivative work based on the SyzDirect kernel analysis module.
  • Original Project: SyzDirect (https://github.com/seclab-fudan/SyzDirect)
  • Original Module Path: source/syzdirect/syzdirect_kernel_analysis
  • Original License: Apache License, Version 2.0 (http://www.apache.org/licenses/LICENSE-2.0)
  • Modifications: Modified the kernel interface calls to be compatible with our test environment
• build_env: script to build the enviroment for cases.
• gcc_find_inst: the tool to instrument feedback for fuzzer.

Acknowledgements

This work builds upon our earlier project, KLAUS (https://github.com/wupco/KLAUS).