Fuzzing Error Handling Code in Device Drivers Based on Software Fault Injection

Device drivers remain a main source of runtime failures in operating systems. To detect bugs in device drivers, fuzzing has been commonly used in practice. However, a main limitation of existing fuzzing approaches is that they cannot effectively test error handling code. Indeed, these fuzzing approaches require effective inputs to cover target code, but much error handling code in drivers is triggered by occasional errors (such as insufficient memory and hardware malfunctions) that are not related to inputs. In this paper, based on software fault injection, we propose a new fuzzing approach named FIZZER, to test error handling code in device drivers. At compile time, FIZZER uses static analysis to recommend possible error sites that can trigger error handling code. During driver execution, by analyzing runtime information, it automatically fuzzes error-site sequences for fault injection to improve code coverage. We evaluate FIZZER on 18 device drivers in Linux 4.19, and in total find 22 real bugs. The code coverage is increased by over 15% compared to normal execution without fuzzing.

I. Introduction

Device drivers are an important part of modern operating systems. They manage hardware devices and provide fundamental support for high-level programs. For this reason, if a device driver has bugs that can occur in real execution, it may cause serious problems, such as information leaks and system crashes. Unfortunately, device drivers remain a main source of bugs found in operating systems. For example, over 50% of Linux kernel bugs are related to device drivers [1].