git clone https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
cd linux-next
sudo dnf builddep -y kernel

# полная очистка
make mrproper

# генерация стандартного конфига
make ARCH=x86_64 defconfig

# <-- config from https://portal.linuxtesting.ru/LVCFuzzingKernelOptions.html#main

# включаем namespaces
scripts/config -e CONFIG_NAMESPACES \
    -e CONFIG_UTS_NS \
    -e CONFIG_IPC_NS \
    -e CONFIG_PID_NS \
    -e CONFIG_NET_NS \
    -e CONFIG_USER_NS \
    -e CONFIG_CGROUP_PIDS \
    -e CONFIG_MEMCG

# Поддержка USB
scripts/config -e CONFIG_USB \
               -e CONFIG_USB_GADGET \
               -e CONFIG_USB_LIBCOMPOSITE

# Поддержка Bluetooth
scripts/config -e CONFIG_BT \
               -e CONFIG_BT_BREDR

# Поддержка IEEE 802.15.4
scripts/config -e CONFIG_IEEE802154 \
               -e CONFIG_IEEE802154_6LOWPAN \
               -e CONFIG_MAC802154 \
               -e CONFIG_MAC802154_HWSIM

# Чтобы отобразить покрытие кода в веб-интерфейсе:
scripts/config -e CONFIG_DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT

# применяем конфиг
make olddefconfig

# собираем сжатый образ ядра
make -j"$(nproc)" bzImage

git clone https://github.com/google/syzkaller.git
cd syzkaller
make -j"$(nproc)" all
./create-image.sh --distribution trixie
mkdir workdir && cd workdir
wget https://portal.linuxtesting.ru/pub/syzkaller/corpus-2025-01-24.db.gpg --no-check-certificate
gpg --output corpus.db --decrypt corpus-2025-01-24.db.gpg

{
  "target": "linux/amd64",
  "http": "localhost:22200",
  "workdir": "syzkaller/workdir",
  "kernel_obj": "linux-next",
  "image": "syzkaller/trixie.img",
  "sshkey": "syzkaller/trixie.id_rsa",
  "syzkaller": "syzkaller",
  "procs": 2,
  "type": "qemu",
  "sandbox": "none",
  "reproduce": true,
  "vm": {
    "count": 4,
    "cpu": 2,
    "mem": 4096,
    "kernel": "linux-next/arch/x86_64/boot/bzImage",
    "cmdline": "panic_on_warn=1 oops=panic slub_debug=FZP console=ttyS0 earlyprintk=serial mitigations=off vsyscall=native rcupdate.rcu_expedited=1"
  },
  "disable_syscalls": ["keyctl", "add_key", "request_key"]
}

cd syzkaller
bin/syz-manager -config manager.cfg

2025/08/17 21:25:52 serving rpc on tcp://42507
2025/08/17 21:25:52 serving http on http://localhost:22200
2025/08/17 21:26:36 machine check:
disabled the following syscalls:
...
BinFmtMisc              : enabled
Comparisons             : enabled
Coverage                : enabled
DelayKcovMmap           : enabled
DevlinkPCI              : PCI device 0000:00:10.0 is not available
ExtraCoverage           : enabled
Fault                   : enabled
KCSAN                   : write(/sys/kernel/debug/kcsan, on) failed
KcovResetIoctl          : kernel does not support ioctl(KCOV_RESET_TRACE)
LRWPANEmulation         : netlink: adding device lowpan0 type lowpan link wpan0
Leak                    : enabled
NetDevices              : enabled
NetInjection            : enabled
NicVF                   : PCI device 0000:00:11.0 is not available
SandboxAndroid          : setfilecon: setxattr failed.
SandboxNamespace        : enabled
SandboxNone             : enabled
SandboxSetuid           : enabled
Swap                    : enabled
USBEmulation            : enabled
VhciInjection           : enabled
WifiEmulation           : enabled
syscalls                : 2408/8048

2025/08/17 21:57:33 VM 2: crash: KASAN: slab-use-after-free Write in __xfrm_state_delete
2025/08/17 22:11:53 VM 2: crash: possible deadlock in input_inject_event
2025/08/17 22:12:56 VM 3: crash: INFO: task hung in __iterate_supers

⚠️ - занятые под репродюсинг крашей виртуальные машины, могут почти полностью парализовать фаззинг, потому как syzkaller оперирует только выделенным ему количеством виртуальных машин в конфиге.

cd syzkaller
bin/syz-repro -config manager.cfg workdir/crashes/6bfbc3ea5a876102628620dec078f4992586f034/log0

KASAN: slab-use-after-free Read in xfrm_alloc_spi
general protection fault in xfrm_alloc_spi
possible deadlock in input_inject_event
WARNING in __rate_control_send_low

#!/bin/bash

bzImage='linux-next/arch/x86/boot/bzImage'
qemuImage='syzkaller/trixie.img'

qemu-system-x86_64 \
  -m 2G \
  -smp 2 \
  -kernel $bzImage \
  -append 'console=ttyS0 root=/dev/sda earlyprintk=serial net.ifnames=0 nokaslr' \
  -drive file=$qemuImage,format=raw \
  -net user,host=10.0.2.10,hostfwd=tcp:127.0.0.1:10021-:22 \
  -net nic,model=e1000 \
  -enable-kvm \
  -nographic \
  -pidfile vm.pid

grep kasan /proc/kallsyms | wc -l

scp -P 10021 -i trixie.id_rsa workdir/crashes/6bfbc3ea5a876102628620dec078f4992586f034/repro.c root@127.0.0.1:/root

gcc repro.c -o repro
./repro

В случае использования pthread нужно добавить опцию `-pthread`

#include <fcntl.h>
#include <linux/cdrom.h>
#include <sys/ioctl.h>
#include <sys/mman.h>
#include <string.h>

#define SIZE 14

void main()
{
    unsigned char buf[SIZE];
    memset(buf, 0x42, SIZE);
    static struct cdrom_generic_command cgc;
    static const unsigned char cdb[12] = { 0x6f, 0x79, 0xa6, 0x9f, 0xa8, 0xa3, 0x5f, 0x4b, 0x77, 0xef, 0xec, 0x7d };
    memcpy(cgc.cmd, cdb, sizeof(cdb));
    cgc.buffer         = buf;
    cgc.buflen         = SIZE;
    cgc.data_direction = CGC_DATA_WRITE;
    int fd = open("/dev/cdrom", O_RDONLY | O_NONBLOCK);
    ioctl(fd, CDROM_SEND_PACKET, &cgc);
}

assert(cls != NULL);

import sqlite3

class A:
    def value(self):
        return 1

con = sqlite3.connect(":memory:")
con.create_window_function("f", 1, A)

con.execute("CREATE TABLE t(x)")
con.execute("INSERT INTO t VALUES (1)")

con.execute("""
    SELECT f(x)
    OVER (ROWS BETWEEN 1 PRECEDING AND 1 PRECEDING)
    FROM t
""").fetchall()

zsh: segmentation fault (core dumped)  python3