On Wed, Aug 13, 2025 at 7:14 PM Marco Elver <elver@xxxxxxxxxx> wrote:
>
> [+Cc crypto maintainers]
>
> On Wed, 13 Aug 2025 at 15:38, Ethan Graham <ethan.w.s.graham@xxxxxxxxx> wrote:
> >
> > From: Ethan Graham <ethangraham@xxxxxxxxxx>
>
> Should also Cc crypto maintainers, as they'll be the ones giving
Thanks Marco!
> feedback on how interesting this is to them. Use
> ./scripts/get_maintainer.pl for that in the next round, and either add
> the Cc list below your Signed-off-by so that git send-email picks it
> up only for this patch, or just for the whole series (normally
> preferred, so maintainers get context of the full series).
>
> > Add KFuzzTest targets for pkcs7_parse_message, rsa_parse_pub_key, and
> > rsa_parse_priv_key to serve as real-world examples of how the framework is used.
> >
> > These functions are ideal candidates for KFuzzTest as they perform complex
> > parsing of user-controlled data but are not directly exposed at the syscall
> > boundary. This makes them difficult to exercise with traditional fuzzing tools
> > and showcases the primary strength of the KFuzzTest framework: providing an
> > interface to fuzz internal, non-exported kernel functions.
> >
> > The targets are defined directly within the source files of the functions they
> > test, demonstrating how to colocate fuzz tests with the code under test.
> >
> > Signed-off-by: Ethan Graham <ethangraham@xxxxxxxxxx>
> > ---
> > crypto/asymmetric_keys/pkcs7_parser.c | 15 ++++++++++++++
> > crypto/rsa_helper.c | 29 +++++++++++++++++++++++++++
> > 2 files changed, 44 insertions(+)
> >
> > diff --git a/crypto/asymmetric_keys/pkcs7_parser.c b/crypto/asymmetric_keys/pkcs7_parser.c
> > index 423d13c47545..e8477f8b0eaf 100644
> > --- a/crypto/asymmetric_keys/pkcs7_parser.c
> > +++ b/crypto/asymmetric_keys/pkcs7_parser.c
> > @@ -13,6 +13,7 @@
> > #include <linux/err.h>
> > #include <linux/oid_registry.h>
> > #include <crypto/public_key.h>
> > +#include <linux/kfuzztest.h>
> > #include "pkcs7_parser.h"
> > #include "pkcs7.asn1.h"
> >
> > @@ -169,6 +170,20 @@ struct pkcs7_message *pkcs7_parse_message(const void *data, size_t datalen)
> > }
> > EXPORT_SYMBOL_GPL(pkcs7_parse_message);
> >
> > +struct pkcs7_parse_message_arg {
> > + const void *data;
> > + size_t datalen;
> > +};
> > +
> > +FUZZ_TEST(test_pkcs7_parse_message, struct pkcs7_parse_message_arg)
Not sure if it has been mentioned elsewhere, but one thing I already
don't like about it is that these definitions "pollute" the actual
source files. Might not be such a big deal here, but kernel source
files for core subsystems tend to become quite large and complex
already, so not a great idea to make them even larger and harder to
follow with fuzz definitions.
As far as I'm aware, for the same reason KUnit [1] is not that popular
(or at least less popular than other approaches, like selftests [2]).
Is it possible to make it that these definitions live in separate
files or even closer to selftests?
Ignat
> > +{
> > + KFUZZTEST_EXPECT_NOT_NULL(pkcs7_parse_message_arg, data);
> > + KFUZZTEST_ANNOTATE_LEN(pkcs7_parse_message_arg, datalen, data);
> > + KFUZZTEST_EXPECT_LE(pkcs7_parse_message_arg, datalen, 16 * PAGE_SIZE);
> > +
> > + pkcs7_parse_message(arg->data, arg->datalen);
> > +}
> > +
> > /**
> > * pkcs7_get_content_data - Get access to the PKCS#7 content
> > * @pkcs7: The preparsed PKCS#7 message to access
> > diff --git a/crypto/rsa_helper.c b/crypto/rsa_helper.c
> > index 94266f29049c..79b7ddc7c48d 100644
> > --- a/crypto/rsa_helper.c
> > +++ b/crypto/rsa_helper.c
> > @@ -9,6 +9,7 @@
> > #include <linux/export.h>
> > #include <linux/err.h>
> > #include <linux/fips.h>
> > +#include <linux/kfuzztest.h>
> > #include <crypto/internal/rsa.h>
> > #include "rsapubkey.asn1.h"
> > #include "rsaprivkey.asn1.h"
> > @@ -166,6 +167,20 @@ int rsa_parse_pub_key(struct rsa_key *rsa_key, const void *key,
> > }
> > EXPORT_SYMBOL_GPL(rsa_parse_pub_key);
> >
> > +struct rsa_parse_pub_key_arg {
> > + const void *key;
> > + size_t key_len;
> > +};
> > +
> > +FUZZ_TEST(test_rsa_parse_pub_key, struct rsa_parse_pub_key_arg)
> > +{
> > + KFUZZTEST_EXPECT_NOT_NULL(rsa_parse_pub_key_arg, key);
> > + KFUZZTEST_EXPECT_LE(rsa_parse_pub_key_arg, key_len, 16 * PAGE_SIZE);
> > +
> > + struct rsa_key out;
> > + rsa_parse_pub_key(&out, arg->key, arg->key_len);
> > +}
> > +
> > /**
> > * rsa_parse_priv_key() - decodes the BER encoded buffer and stores in the
> > * provided struct rsa_key, pointers to the raw key
> > @@ -184,3 +199,17 @@ int rsa_parse_priv_key(struct rsa_key *rsa_key, const void *key,
> > return asn1_ber_decoder(&rsaprivkey_decoder, rsa_key, key, key_len);
> > }
> > EXPORT_SYMBOL_GPL(rsa_parse_priv_key);
> > +
> > +struct rsa_parse_priv_key_arg {
> > + const void *key;
> > + size_t key_len;
> > +};
> > +
> > +FUZZ_TEST(test_rsa_parse_priv_key, struct rsa_parse_priv_key_arg)
> > +{
> > + KFUZZTEST_EXPECT_NOT_NULL(rsa_parse_priv_key_arg, key);
> > + KFUZZTEST_EXPECT_LE(rsa_parse_priv_key_arg, key_len, 16 * PAGE_SIZE);
> > +
> > + struct rsa_key out;
> > + rsa_parse_priv_key(&out, arg->key, arg->key_len);
> > +}
> > --
> > 2.51.0.rc0.205.g4a044479a3-goog
> >
[1]: https://docs.kernel.org/dev-tools/kunit/index.html
[2]: https://docs.kernel.org/dev-tools/kselftest.html
