Re: [PATCH v4 1/6] kfuzztest: add user-facing API and data structures

[Alexander Potapenko]

On Mon, Jan 12, 2026 at 8:28 PM Ethan Graham <ethan.w.s.graham@xxxxxxxxx> wrote:

> diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
> index ae2d2359b79e..5aa46dbbc9b2 100644
> --- a/include/asm-generic/vmlinux.lds.h
> +++ b/include/asm-generic/vmlinux.lds.h
> @@ -373,7 +373,8 @@ defined(CONFIG_AUTOFDO_CLANG) || defined(CONFIG_PROPELLER_CLANG)
>         TRACE_PRINTKS()                                                 \
>         BPF_RAW_TP()                                                    \
>         TRACEPOINT_STR()                                                \
> -       KUNIT_TABLE()
> +       KUNIT_TABLE()                                                   \
> +       KFUZZTEST_TABLE()
>
>  /*
>   * Data section helpers
> @@ -966,6 +967,17 @@ defined(CONFIG_AUTOFDO_CLANG) || defined(CONFIG_PROPELLER_CLANG)
>                 BOUNDED_SECTION_POST_LABEL(.kunit_init_test_suites, \
>                                 __kunit_init_suites, _start, _end)
>
> +#ifdef CONFIG_KFUZZTEST
> +#define KFUZZTEST_TABLE()                                              \
> +       . = ALIGN(PAGE_SIZE);                                           \

Can you remind me if PAGE_SIZE alignment is strictly required here?


> +
> +#define KFUZZTEST_MAX_INPUT_SIZE (PAGE_SIZE * 16)

Right now KFUZZTEST_MAX_INPUT_SIZE is only used in a single C file,
can you move it there?


> + * User-provided Logic:
> + * The developer must provide the body of the fuzz test logic within the curly
> + * braces following the macro invocation. Within this scope, the framework
> + * implicitly defines the following variables:
> + *
> + * - `char *data`: A pointer to the raw input data.
> + * - `size_t datalen`: The length of the input data.
> + *
> + * Example Usage:
> + *
> + * // 1. The kernel function that we want to fuzz.
> + * int process_data(const char *data, size_t datalen);

Maybe we'd better use u8 or unsigned char here for clarity?


                                \
> +               void *buffer;                                                                                           \
> +               int ret;                                                                                                \
> +                                                                                                                       \
> +               ret = kfuzztest_write_cb_common(filp, buf, len, off, &buffer);                                          \
> +               if (ret < 0)                                                                                            \
> +                       goto out;                                                                                       \
> +               ret = kfuzztest_simple_logic_##test_name(buffer, len);                                                  \
> +               if (ret == 0)                                                                                           \
> +                       ret = len;                                                                                      \
> +               kfree(buffer);                                                                                          \

Please ensure we have includes for everything used in this header
(e.g. linux/slab.h is missing).