aboutsummaryrefslogtreecommitdiffstats
path: root/syz-cluster
diff options
context:
space:
mode:
authorAleksandr Nogikh <nogikh@google.com>2025-08-19 16:48:30 +0200
committerAleksandr Nogikh <nogikh@google.com>2025-08-21 12:29:47 +0000
commit0ae3a01ad6fae385768ebb247d999c44631a1b99 (patch)
tree2cf8fdb13c142dd94751a08f3ed1fa6824f328cd /syz-cluster
parent55d1b48ed250d44ae3796f56178fd1c4729540c9 (diff)
syz-cluster: share base kernel crashes between fuzzing sessions
Report base kernel crashes observed during fuzzing. Consult the common API for each patched kernel crash to see if it was already observed on the base kernel.
Diffstat (limited to 'syz-cluster')
-rw-r--r--syz-cluster/workflow/fuzz-step/main.go37
1 files changed, 26 insertions, 11 deletions
diff --git a/syz-cluster/workflow/fuzz-step/main.go b/syz-cluster/workflow/fuzz-step/main.go
index 849b8a3bf..7e1589115 100644
--- a/syz-cluster/workflow/fuzz-step/main.go
+++ b/syz-cluster/workflow/fuzz-step/main.go
@@ -121,33 +121,48 @@ func run(baseCtx context.Context, client *api.Client, timeout time.Duration,
eg, ctx := errgroup.WithContext(baseCtx)
bugs := make(chan *manager.UniqueBug)
+ baseCrashes := make(chan string, 16)
eg.Go(func() error {
defer log.Logf(0, "bug reporting terminated")
for {
- var bug *manager.UniqueBug
select {
- case bug = <-bugs:
+ case title := <-baseCrashes:
+ err := client.UploadBaseFinding(ctx, &api.BaseFindingInfo{
+ BuildID: *flagBaseBuild,
+ Title: title,
+ })
+ if err != nil {
+ app.Errorf("failed to report a base kernel crash %q: %v", title, err)
+ }
+ case bug := <-bugs:
+ err := reportFinding(ctx, client, bug)
+ if err != nil {
+ app.Errorf("failed to report a finding %q: %v", bug.Report.Title, err)
+ }
case <-ctx.Done():
- }
- if bug == nil {
- break
- }
- // TODO: filter out all INFO: bugs?
- err := reportFinding(ctx, client, bug)
- if err != nil {
- app.Errorf("failed to report a finding %s: %v", bug.Report.Title, err)
+ return nil
}
}
- return nil
})
eg.Go(func() error {
defer log.Logf(0, "diff fuzzing terminated")
return manager.RunDiffFuzzer(ctx, base, patched, manager.DiffFuzzerConfig{
Debug: false,
PatchedOnly: bugs,
+ BaseCrashes: baseCrashes,
Store: store,
MaxTriageTime: timeout / 2,
FuzzToReachPatched: fuzzToReachPatched(),
+ BaseCrashKnown: func(ctx context.Context, title string) (bool, error) {
+ ret, err := client.BaseFindingStatus(ctx, &api.BaseFindingInfo{
+ BuildID: *flagBaseBuild,
+ Title: title,
+ })
+ if err != nil {
+ return false, err
+ }
+ return ret.Observed, nil
+ },
})
})
const (