syz-manager: re-enable corpus rotation

Let's give it another chance since the previous coverage drop wasn't
completely conclusive.
Few changes that may help:
 - do rotation at 1/5 instead of 1/3 rate
 - don't send triage candidates to rotated VMs,
   since they may not have required syscalls enabled
 - don't send new inputs/coverage to rotated VMs,
   let them run in complete isolation

Update #1348

1 files changed, 7 insertions, 4 deletions

diff --git a/syz-manager/rpc.go b/syz-manager/rpc.go
index d4c4ea077..3cd3d2d08 100644
--- a/syz-manager/rpc.go
+++ b/syz-manager/rpc.go
@@ -102,8 +102,7 @@ func (serv *RPCServer) Connect(a *rpctype.ConnectArgs, r *rpctype.ConnectRes) er
 	r.EnabledCalls = serv.configEnabledSyscalls
 	r.GitRevision = prog.GitRevision
 	r.TargetRevision = serv.target.Revision
-	// TODO: temporary disabled b/c we suspect this negatively affects fuzzing.
-	if false && serv.mgr.rotateCorpus() && serv.rnd.Intn(3) != 0 {
+	if serv.mgr.rotateCorpus() && serv.rnd.Intn(5) == 0 {
 		// We do rotation every other time because there are no objective
 		// proofs regarding its efficiency either way.
 		// Also, rotation gives significantly skewed syscall selection
@@ -253,7 +252,7 @@ func (serv *RPCServer) NewInput(a *rpctype.NewInputArgs, r *int) error {
 
 		a.RPCInput.Cover = nil // Don't send coverage back to all fuzzers.
 		for _, other := range serv.fuzzers {
-			if other == f {
+			if other == f || other.rotatedSignal != nil {
 				continue
 			}
 			other.inputs = append(other.inputs, a.RPCInput)
@@ -280,12 +279,16 @@ func (serv *RPCServer) Poll(a *rpctype.PollArgs, r *rpctype.PollRes) error {
 		serv.maxSignal.Merge(newMaxSignal)
 		serv.stats.maxSignal.set(len(serv.maxSignal))
 		for _, f1 := range serv.fuzzers {
-			if f1 == f {
+			if f1 == f || f1.rotatedSignal != nil {
 				continue
 			}
 			f1.newMaxSignal.Merge(newMaxSignal)
 		}
 	}
+	if f.rotatedSignal != nil {
+		// Let rotated VMs run in isolation, don't send them anything.
+		return nil
+	}
 	r.MaxSignal = f.newMaxSignal.Split(500).Serialize()
 	if a.NeedCandidates {
 		r.Candidates = serv.mgr.candidateBatch(serv.batchSize)