diff options
| author | Aleksandr Nogikh <nogikh@google.com> | 2024-08-16 16:34:01 +0200 |
|---|---|---|
| committer | Dmitry Vyukov <dvyukov@google.com> | 2024-08-16 15:17:33 +0000 |
| commit | dbc93b085f18cf00b6c0e077c902b5f83ecbe76c (patch) | |
| tree | 767e4b9151e51c1009799448073c7758afceb11f /syz-manager | |
| parent | 76120936f2d7ff5d4222671f6965fb2c2d258217 (diff) | |
syz-manager: define a reminimization threshold
Let it be equal to 15 calls for now.
Don't reminimize corpus programs that have fewer calls.
Always reminimize hub programs that no less calls.
Diffstat (limited to 'syz-manager')
| -rw-r--r-- | syz-manager/hub.go | 2 | ||||
| -rw-r--r-- | syz-manager/manager.go | 7 |
2 files changed, 6 insertions, 3 deletions
diff --git a/syz-manager/hub.go b/syz-manager/hub.go index 75ac8f6a0..5fd2356f6 100644 --- a/syz-manager/hub.go +++ b/syz-manager/hub.go @@ -245,7 +245,7 @@ func (hc *HubConnector) processProgs(inputs []rpctype.HubInput) (minimized, smas } min, smash := matchDomains(hc.domain, inp.Domain) var flags fuzzer.ProgFlags - if min { + if min && len(p.Calls) < reminimizeThreshold { minimized++ flags |= fuzzer.ProgMinimized } diff --git a/syz-manager/manager.go b/syz-manager/manager.go index fe3398b69..704129b1b 100644 --- a/syz-manager/manager.go +++ b/syz-manager/manager.go @@ -664,6 +664,9 @@ func (mgr *Manager) loadCorpus() []fuzzer.Candidate { return candidates } +// Programs that do more than 15 system calls are to be treated with suspicion and re-minimized. +const reminimizeThreshold = 15 + // reminimizeSubset clears the fuzzer.ProgMinimized flag of a small subset of seeds. // The ultimate objective is to gradually clean up the poorly minimized corpus programs. // reminimizeSubset assumes that candidates are sorted in the order of ascending len(Prog.Calls). @@ -671,8 +674,8 @@ func reminimizeSubset(candidates []fuzzer.Candidate) int { if len(candidates) == 0 { return 0 } - // Only consider the top 10% of the largest programs. - threshold := len(candidates[len(candidates)*9/10].Prog.Calls) + // Focus on the top 10% of the largest programs in the corpus. + threshold := max(reminimizeThreshold, len(candidates[len(candidates)*9/10].Prog.Calls)) var resetIndices []int for i, info := range candidates { if info.Flags&fuzzer.ProgMinimized == 0 { |