syz-fuzzer: relax triage signal conditions

Don't discard programs if signal is flaky.
We already do this for inputs from corpus,
do this for all inputs.

1 files changed, 7 insertions, 12 deletions

diff --git a/syz-fuzzer/proc.go b/syz-fuzzer/proc.go
index 6cfd92c71..9867c787d 100644
--- a/syz-fuzzer/proc.go
+++ b/syz-fuzzer/proc.go
@@ -116,24 +116,19 @@ func (proc *Proc) triageInput(item *WorkTriage) {
 		minimizeAttempts = 3
 	)
 	// Compute input coverage and non-flaky signal for minimization.
-	notexecuted := 0
 	for i := 0; i < signalRuns; i++ {
 		info := proc.executeRaw(proc.execOptsCover, item.p, StatTriage)
-		if len(info) == 0 || len(info[item.call].Signal) == 0 {
-			// The call was not executed. Happens sometimes.
-			notexecuted++
-			if notexecuted > signalRuns/2 {
-				return // if happens too often, give up
-			}
+		if len(info) == 0 || len(info[item.call].Signal) == 0 ||
+			item.info.Errno == 0 && info[item.call].Errno != 0 {
+			// The call was not executed or failed.
 			continue
 		}
 		inf := info[item.call]
 		thisSignal := signal.FromRaw(inf.Signal, signalPrio(item.p.Target, call, &inf))
-		newSignal = newSignal.Intersection(thisSignal)
-		// Without !minimized check manager starts losing some considerable amount
-		// of coverage after each restart. Mechanics of this are not completely clear.
-		if newSignal.Empty() && item.flags&ProgMinimized == 0 {
-			return
+		newSignal1 := newSignal.Intersection(thisSignal)
+		if !newSignal1.Empty() {
+			newSignal = newSignal1
+
 		}
 		inputCover.Merge(inf.Cover)
 	}