diff options
| author | Dmitry Vyukov <dvyukov@google.com> | 2024-08-07 15:16:35 +0200 |
|---|---|---|
| committer | Aleksandr Nogikh <nogikh@google.com> | 2024-08-07 18:47:26 +0000 |
| commit | 7013cb0d7d7b78bb0160c45d13a8d7d472835513 (patch) | |
| tree | 8955241dedf178b338a673f4254d652a0b615f01 /pkg | |
| parent | 58a20e60bf226392db3d88eb36503b9cc711a153 (diff) | |
prog: replace MinimizeParams with MinimizeMode
All callers shouldn't control lots of internal details of minimization
(if we have more params, that's just more variations to test,
and we don't have more, params is just a more convoluted way to say
if we minimize for corpus or a crash).
2 bools also allow to express 4 options, but only 3 make sense.
Also when I see MinimizeParams{} in the code, it's unclear what it means.
Replace params with mode.
And potentially "crash" minimization is not "light", it's just different.
E.g. we can simplify int arguments for reproducers (esp in snapshot mode),
but we don't need that for corpus.
Diffstat (limited to 'pkg')
| -rw-r--r-- | pkg/csource/csource_test.go | 2 | ||||
| -rw-r--r-- | pkg/fuzzer/job.go | 59 | ||||
| -rw-r--r-- | pkg/repro/repro.go | 31 |
3 files changed, 44 insertions, 48 deletions
diff --git a/pkg/csource/csource_test.go b/pkg/csource/csource_test.go index 7d67927a3..c97757d01 100644 --- a/pkg/csource/csource_test.go +++ b/pkg/csource/csource_test.go @@ -91,7 +91,7 @@ func testTarget(t *testing.T, target *prog.Target, full bool) { opts = allOptionsSingle(target.OS) opts = append(opts, ExecutorOpts) } else { - minimized, _ := prog.Minimize(syzProg, -1, prog.MinimizeParams{}, func(p *prog.Prog, call int) bool { + minimized, _ := prog.Minimize(syzProg, -1, prog.MinimizeCorpus, func(p *prog.Prog, call int) bool { return len(p.Calls) == len(syzProg.Calls) }) p.Calls = append(p.Calls, minimized.Calls...) diff --git a/pkg/fuzzer/job.go b/pkg/fuzzer/job.go index 85d2dcfe6..7a89006f1 100644 --- a/pkg/fuzzer/job.go +++ b/pkg/fuzzer/job.go @@ -301,39 +301,38 @@ func (job *triageJob) minimize(call int, info *triageCall) (*prog.Prog, int) { minimizeAttempts = 2 } stop := false - p, call := prog.Minimize(job.p, call, prog.MinimizeParams{}, - func(p1 *prog.Prog, call1 int) bool { - if stop { + p, call := prog.Minimize(job.p, call, prog.MinimizeCorpus, func(p1 *prog.Prog, call1 int) bool { + if stop { + return false + } + var mergedSignal signal.Signal + for i := 0; i < minimizeAttempts; i++ { + result := job.execute(&queue.Request{ + Prog: p1, + ExecOpts: setFlags(flatrpc.ExecFlagCollectSignal), + ReturnAllSignal: []int{call1}, + Stat: job.fuzzer.statExecMinimize, + }, 0) + if result.Stop() { + stop = true return false } - var mergedSignal signal.Signal - for i := 0; i < minimizeAttempts; i++ { - result := job.execute(&queue.Request{ - Prog: p1, - ExecOpts: setFlags(flatrpc.ExecFlagCollectSignal), - ReturnAllSignal: []int{call1}, - Stat: job.fuzzer.statExecMinimize, - }, 0) - if result.Stop() { - stop = true - return false - } - if !reexecutionSuccess(result.Info, info.errno, call1) { - // The call was not executed or failed. - continue - } - thisSignal := getSignalAndCover(p1, result.Info, call1) - if mergedSignal.Len() == 0 { - mergedSignal = thisSignal - } else { - mergedSignal.Merge(thisSignal) - } - if info.newStableSignal.Intersection(mergedSignal).Len() == info.newStableSignal.Len() { - return true - } + if !reexecutionSuccess(result.Info, info.errno, call1) { + // The call was not executed or failed. + continue } - return false - }) + thisSignal := getSignalAndCover(p1, result.Info, call1) + if mergedSignal.Len() == 0 { + mergedSignal = thisSignal + } else { + mergedSignal.Merge(thisSignal) + } + if info.newStableSignal.Intersection(mergedSignal).Len() == info.newStableSignal.Len() { + return true + } + } + return false + }) if stop { return nil, 0 } diff --git a/pkg/repro/repro.go b/pkg/repro/repro.go index 5565460c2..2091d3c88 100644 --- a/pkg/repro/repro.go +++ b/pkg/repro/repro.go @@ -372,9 +372,7 @@ func (ctx *reproContext) concatenateProgs(entries []*prog.LogEntry, dur time.Dur for i := 0; i < len(entries); i++ { ctx.reproLogf(1, "minimizing program #%d before concatenation", i) callsBefore := len(entries[i].P.Calls) - entries[i].P, _ = prog.Minimize(entries[i].P, -1, prog.MinimizeParams{ - RemoveCallsOnly: true, - }, + entries[i].P, _ = prog.Minimize(entries[i].P, -1, prog.MinimizeCallsOnly, func(p1 *prog.Prog, _ int) bool { var newEntries []*prog.LogEntry if i > 0 { @@ -432,20 +430,19 @@ func (ctx *reproContext) minimizeProg(res *Result) (*Result, error) { ctx.stats.MinimizeProgTime = time.Since(start) }() - res.Prog, _ = prog.Minimize(res.Prog, -1, prog.MinimizeParams{Light: true}, - func(p1 *prog.Prog, callIndex int) bool { - if len(p1.Calls) == 0 { - // We do want to keep at least one call, otherwise tools/syz-execprog - // will immediately exit. - return false - } - crashed, err := ctx.testProg(p1, res.Duration, res.Opts) - if err != nil { - ctx.reproLogf(0, "minimization failed with %v", err) - return false - } - return crashed - }) + res.Prog, _ = prog.Minimize(res.Prog, -1, prog.MinimizeCrash, func(p1 *prog.Prog, callIndex int) bool { + if len(p1.Calls) == 0 { + // We do want to keep at least one call, otherwise tools/syz-execprog + // will immediately exit. + return false + } + crashed, err := ctx.testProg(p1, res.Duration, res.Opts) + if err != nil { + ctx.reproLogf(0, "minimization failed with %v", err) + return false + } + return crashed + }) return res, nil } |
