Constructing Domain-Specific Fuzzer for WebGPU Shader Compilers
summary
A domain-specific fuzzer with a custom IR for semantically valid mutations and a harness that extracts Dawn’s tint and interfaces to user‑mode drivers runs against Mesa and Android GPU stacks. It implements ~15 mutation/codegen strategies, achieves ~40% compilation success, emulates GPU IOCTLs with a stop‑GPU, and uses in-memory instrumentation of vendor shared objects to collect coverage. Results show ~14 Linux/Mesa bugs, ~9 Android bugs (multiple fixes and submissions), and additional Windows findings; the harness and fuzzer reliably trigger use‑after‑free and memory safety crashes.
AI-written summary · about
chapters (12)
- 0:00Introduction to WebGPU
- 2:10WebGPU in Chrome architecture
- 5:42Vulnerable shader compiler components
- 8:37Fuzzing shader compilation pipeline
- 13:31Shader mutation techniques
- 13:51Fuzzing Mesa on Linux
- 16:44Android GPU stack fuzzing
- 19:51Coverage for Android libraries
- 20:54Bug fixes and workarounds
- 22:19Future fuzzer improvements
- 24:54Defending complex GPU drivers
- 25:37Summary of findings
related talks
29mVirtual Device Fuzzing Support in QEMU
46mFor The Win: The Art Of The Windows Kernel Fuzzing
52mStructure aware fuzzing
16mELFuzz: Efficient Input Generation via LLM-driven Synthesis Over Fuzzer Space
01mFun and Practice for exercising your ARM(64)
22mCharm: Facilitating Dynamic Analysis of Device Drivers of Mobile Systems
27mAttacking the WebAssembly Compiler of WebKit
29mEvent-based Fuzzing, Patch-based Research, and Comment Police: Finding Bugs Through a Bug