syz-fuzzer: generates hints only for the call that gave new coverage

During smashing we know what call gave new coverage,
so we can concentrate just on it.
This helps to reduce amount of hints generated (we have too many of them).

1 files changed, 8 insertions, 7 deletions

diff --git a/tools/syz-execprog/execprog.go b/tools/syz-execprog/execprog.go
index 9a9a1b48a..6c5df9ffd 100644
--- a/tools/syz-execprog/execprog.go
+++ b/tools/syz-execprog/execprog.go
@@ -179,7 +179,8 @@ func main() {
 					if *flagHints {
 						compMaps := ipc.GetCompMaps(info)
 						ncomps, ncandidates := 0, 0
-						for _, comps := range compMaps {
+						for i := range p.Calls {
+							comps := compMaps[i]
 							for v, args := range comps {
 								ncomps += len(args)
 								if *flagOutput == "stdout" {
@@ -190,13 +191,13 @@ func main() {
 									fmt.Printf("\n")
 								}
 							}
+							p.MutateWithHints(i, comps, func(p *prog.Prog) {
+								ncandidates++
+								if *flagOutput == "stdout" {
+									fmt.Printf("PROGRAM:\n%s\n", p.Serialize())
+								}
+							})
 						}
-						p.MutateWithHints(compMaps, func(p *prog.Prog) {
-							ncandidates++
-							if *flagOutput == "stdout" {
-								fmt.Printf("PROGRAM:\n%s\n", p.Serialize())
-							}
-						})
 						fmt.Printf("ncomps=%v ncandidates=%v\n", ncomps, ncandidates)
 					}
 					return true