Skip to content

Commit

Permalink
syz-manager: re-enable corpus rotation
Browse files Browse the repository at this point in the history
Let's give it another chance since the previous coverage drop wasn't
completely conclusive.
Few changes that may help:
 - do rotation at 1/5 instead of 1/3 rate
 - don't send triage candidates to rotated VMs,
   since they may not have required syscalls enabled
 - don't send new inputs/coverage to rotated VMs,
   let them run in complete isolation

Update google#1348
  • Loading branch information
dvyukov committed Oct 1, 2020
1 parent 64e2fe3 commit 697a9cf
Showing 1 changed file with 7 additions and 4 deletions.
11 changes: 7 additions & 4 deletions syz-manager/rpc.go
Original file line number Diff line number Diff line change
Expand Up @@ -102,8 +102,7 @@ func (serv *RPCServer) Connect(a *rpctype.ConnectArgs, r *rpctype.ConnectRes) er
r.EnabledCalls = serv.configEnabledSyscalls
r.GitRevision = prog.GitRevision
r.TargetRevision = serv.target.Revision
// TODO: temporary disabled b/c we suspect this negatively affects fuzzing.
if false && serv.mgr.rotateCorpus() && serv.rnd.Intn(3) != 0 {
if serv.mgr.rotateCorpus() && serv.rnd.Intn(5) == 0 {
// We do rotation every other time because there are no objective
// proofs regarding its efficiency either way.
// Also, rotation gives significantly skewed syscall selection
Expand Down Expand Up @@ -253,7 +252,7 @@ func (serv *RPCServer) NewInput(a *rpctype.NewInputArgs, r *int) error {

a.RPCInput.Cover = nil // Don't send coverage back to all fuzzers.
for _, other := range serv.fuzzers {
if other == f {
if other == f || other.rotatedSignal != nil {
continue
}
other.inputs = append(other.inputs, a.RPCInput)
Expand All @@ -280,12 +279,16 @@ func (serv *RPCServer) Poll(a *rpctype.PollArgs, r *rpctype.PollRes) error {
serv.maxSignal.Merge(newMaxSignal)
serv.stats.maxSignal.set(len(serv.maxSignal))
for _, f1 := range serv.fuzzers {
if f1 == f {
if f1 == f || f1.rotatedSignal != nil {
continue
}
f1.newMaxSignal.Merge(newMaxSignal)
}
}
if f.rotatedSignal != nil {
// Let rotated VMs run in isolation, don't send them anything.
return nil
}
r.MaxSignal = f.newMaxSignal.Split(500).Serialize()
if a.NeedCandidates {
r.Candidates = serv.mgr.candidateBatch(serv.batchSize)
Expand Down

0 comments on commit 697a9cf

Please sign in to comment.