Kernel
Reproducing a syzbot Bug in 5 Minutes — Now with virtme-ng!
<p>This live demo shows how to pick a real syzbot-reported bug and reproduce it locally in under five minutes using virtme-ng.
No disk images, no complex QEMU setup—just build, reproduce and verify the fix.
Perfect for anyone who wants to turn kernel fuzzing reports into real patches.
Important note: I am going to use pre-built upstream kernel containing a bug due to the talk time constarins. Hovewer, steps to rebuild an upstream kernel and use it in virtme-ng will be described.</p>
<p>Full Description:
syzbot continually discovers kernel issues, but reproducing them can be slow or intimidating.
In this lightning talk, we’ll use virtme-ng to rebuild a mainline kernel and instantly run a real syzbot reproducer inside an ephemeral VM.
We’ll trigger the crash, inspect the backtrace, apply the upstream fix, and rerun the test to verify the resolution—all live.
This workflow reduces setup time from hours to minutes and lowers the entry barrier for new contributors.
Every attendee will leave knowing how to reproduce syzbot bugs safely and efficiently on their own system.</p>
<p>Live Experiments & Demonstrations:</p>
<ul>
<li>Select an active syzbot issue (syzbot.appspot.com) and show its reproducer.</li>
<li>Build a mainline kernel and launch it via virtme-run --kdir . --repro repro.c.</li>
<li>Trigger the crash and display kernel backtrace.</li>
<li>Apply the upstream patch or manual fix.</li>
<li>Re-run the reproducer and verify crash disappearance.</li>
</ul>
<p>Key Points:</p>
<ul>
<li>Use virtme-ng for instant kernel test environments.</li>
<li>Run real syzbot reproducer without manual QEMU setup.</li>
<li>Observe, patch, and verify kernel bugs live.</li>
<li>Encourage new contributors to validate fuzzing results.</li>
<li>Demonstrate a fully reproducible workflow in < 5 minutes.</li>
</ul>
Additional information
| Live Stream | https://live.fosdem.org/watch/ua2114 |
|---|---|
| Type | devroom |
| Language | English |
More sessions
| 2/1/26 |
<p>When a kernel component like a storage driver misbehaves in production, developers face a difficult choice. They either have too little information to solve the bug or they enable slow console-level debug logs that ruin performance. This talk introduces a per-component binary logging mechanism designed to support verbose logging in production with negligible run-time cost.</p> <p>We achieve this efficiency by moving the heavy lifting to build time. using preprocessor macros, we emit parameter ...
|
| 2/1/26 |
<p>For years, Ahmad’s ideal has been simple: unpack a rootfs on a server, mount it over NFS (or usb9pfs), boot directly into it, and everything just works™.</p> <p>But as secure boot becomes the default on many embedded systems, squeezing in a network-booted kernel is getting harder and often falls outside the supported boot flow entirely.</p> <p>Fortunately, some recent improvements in the kernel build system pave the way for a far less invasive netboot setup. This talk gives a quick tour ...
|
| 2/1/26 |
<p>The linux kernel driver model has grown over the years and acquired several different mechanisms for passing device configuration data to platform drivers. This configuration can come from firmware (device-tree, ACPI) or from the kernel code itself (board-files, MFD, auxiliary drivers).</p> <p>For a less experienced driver developer, the different APIs that are used to access device properties can be quite confusing and lead to questions: should I use the OF routines? Maybe fwnode or the ...
|
| 2/1/26 |
<p>A new RFC for Netfilter/nftables arrived recently in the netfilter-devel mailing list [1], introducing flexible math operation support for network packet fields. This could solve some migration problems from iptables to nftables and in addition empower other use-cases.</p> <p>This demo will quickly show how it works with simple real-world scenarios.</p> <p>[1] https://lore.kernel.org/netfilter-devel/20250923152452.3618-1-fmancera@suse.de/</p>
|
| 2/1/26 |
<p>Tracing complex systems often requires insights from both the kernel and userspace. While tools like Linux's ftrace excel at kernel-level observability and LTTng provides low-overhead userspace tracing, unifying these disparate data sources for a holistic view remains a challenge: using LTTng for kernel tracing requires an out-of-tree kernel module, which can be a barrier for many users.</p> <p>This talk introduces bt2-ftrace-to-ctf - a new open-source project designed to bridge this gap. Our ...
|
| 2/1/26 |
<p>Creating filesystem images typically requires mounting, copying files, and hoping your build environment doesn't introduce non-determinism. New capabilities in mkfs.xfs solve both problems. You can now populate an XFS filesystem directly from a directory tree at creation time, no mount required. I'll cover the implementation approach, discuss design, and show how to use it. Useful for distributions, embedded systems, and anyone who needs verifiable filesystem artifacts.</p> <p>Reference ...
|
| 2/1/26 |
<p>Correctness of operating system kernel code is very important. Testing is helpful, but does not always thoroughly uncover all issues. In the Whisper team at Inria, we are exploring the possibility of applying formal verification, using Frama-C, to Linux kernel code. This entails writing specifications, constructing loop invariants, and checking correctness with the support of a SMT solver. This talk will report on the opportunities and challenges encountered.</p>
|
