aboutsummaryrefslogtreecommitdiffstats
path: root/pkg/manager/diff.go
Commit message (Collapse)AuthorAgeFilesLines
* pkg/manager: match full function names in focus areasAleksandr Nogikh2026-01-141-1/+6
| | | | | | When configuring focus areas before directed fuzzing, construct regular expressions that match the exact function names. Otherwise, we end up adding more functions than intended.
* pkg/vcs: extend ParseGitDiffAleksandr Nogikh2026-01-091-1/+3
| | | | Return not just the modified files, but also their blob hashes.
* all: use any instead of interface{}Dmitry Vyukov2025-12-221-1/+1
| | | | Any is the preferred over interface{} now in Go.
* pkg/manager: extend loop termination loggingAleksandr Nogikh2025-10-021-1/+3
| | | | | | | There are still situations where we don't properly terminate fuzzing on context cancelation. Add more logging to debug it.
* pkg/manager: reduce time spend under mutexAleksandr Nogikh2025-10-021-7/+3
| | | | | We don't need it to hold it for the call to the externally supplied callback.
* syz-cluster: configure bug title filterAleksandr Nogikh2025-10-011-16/+17
| | | | | Instead of just checking whether the bug was observed on the base crash, accept a regexp of accepted bug titles as well.
* vm: extract all the crashes from the logTaras Madan2025-08-281-2/+5
|
* pkg/manager: record the right base kernel crash titleAleksandr Nogikh2025-08-211-11/+11
| | | | | | | When we run a reproducer on a base kernel and it crashes, we must record the crash title observed on the base kernel. Rename the field to reduce the chance of confusion in the future.
* syz-cluster: share base kernel crashes between fuzzing sessionsAleksandr Nogikh2025-08-211-4/+43
| | | | | | Report base kernel crashes observed during fuzzing. Consult the common API for each patched kernel crash to see if it was already observed on the base kernel.
* vm: refactoringTaras Madan2025-08-071-3/+4
| | | | | 1. func Run optionally accepts the opts. 2. Some refactoring, more comments.
* pkg/manager: fetch boot errors during patch fuzzingAleksandr Nogikh2025-08-061-0/+17
| | | | The VM pool expects us to listen on the boot error channel.
* pkg/manager: fix a NeedRepro checkAleksandr Nogikh2025-08-061-5/+5
| | | | | It's been checking the inverse of what was needed. Rename the helper function to reduce confusion in the future.
* pkg/manager: remove a dependency on grepAleksandr Nogikh2025-08-051-11/+7
| | | | | | Instead of calling grep (the implementations of which may differ in different environments), traverse the directory and grep files with a special pkg/osutil helper functionality.
* pkg/manager: improve patched crash skip rulesAleksandr Nogikh2025-07-291-6/+13
| | | | | | | The rules were too generic - there are plenty of functions that have "stall" as substring, yet they do not relate to rcu stall bugs. Improve the rules list and add a unit test.
* pkg/manager: do a full reproduction for patched-only bugsAleksandr Nogikh2025-07-291-4/+19
| | | | | | | | After ensuring that a bug only affects the patched kernel, do one more round of reproduction and (if successful) re-report the result. This will ensure that, provided enough time, diff fuzzing results will also have minimalistic C reproducers.
* pkg/manager: improve coverage filter loggingAleksandr Nogikh2025-07-221-1/+5
| | | | | The previous message was misleading - executor's coverage filter can well be 0, it's the number of PCs per focus area that's of interest.
* pkg/manager: don't check coverage filters too earlyAleksandr Nogikh2025-07-221-7/+9
| | | | Right at the Loop() start, these are not filled out yet.
* all: determine patched symbols for focused fuzzingAleksandr Nogikh2025-07-221-8/+40
| | | | | | | | | Hash the code section of the individual symbols from vmlinux.o and use it to determine the functions that changed their bodies between the base and the patched build. If the number of affected symbols is reasonable (<5%), fuzz it with the highest priority.
* pkg/manager: don't symbolize reportsAleksandr Nogikh2025-07-211-8/+0
| | | | These are already symbolized in pkg/repro.
* pkg/manager: consider matched PCs in zero focused coverage testAleksandr Nogikh2025-07-181-4/+8
| | | | | If we matched 0 PCs for the areas of focused fuzzing, don't abort the process after 30 minutes.
* pkg/manager: fix context propagation to kernelContextAleksandr Nogikh2025-07-181-9/+8
| | | | | Use the context provided via errgroup.Group so that a single error can successfully shut down the whole diff fuzzing process.
* pkg/manager: abort fuzzing if no patched code is reachedAleksandr Nogikh2025-07-181-31/+96
| | | | | Don't waste time doing focused fuzzing if no modified code has been reached in 30 minutes after corpus triage.
* pkg/manager: symbolize diff fuzzing reportsAleksandr Nogikh2025-07-021-0/+8
| | | | | | In syz-manager, we symbolize reports right before saving them. Follow a similar approach for diff fuzzing as well and symbolize only the reports which were confirmed to only affect the patched kernel.
* pkg/manager: use reproducer reliability scoresAleksandr Nogikh2025-06-261-4/+22
| | | | | | During diff fuzzing, ignore too unreliable reproducers completely. For moderately reliable ones, do a larger number of runs.
* vm: func Run accepts contextTaras Madan2025-05-191-2/+4
| | | | It allows to use context as a single termination signal source.
* pkg/manager: improve error accounting during diff fuzzingAleksandr Nogikh2025-05-161-14/+25
| | | | | | | | | When running the reproducer from the patched kernel on the base kernel, stay on the safe side when encountering errors and context cancellations. Always demand 3 successful executions before declaring a bug patched-only.
* pkg/manager: wrap channel writes in selectAleksandr Nogikh2025-04-241-2/+9
| | | | | | | Writes to channels are dangerous in the presence of context cancellation - no one may be listening on the receiving side. Wrap the writes in a select that also awaits ctx.Done().
* pkg/manager: add more termination loggingAleksandr Nogikh2025-04-241-0/+3
| | | | | | | It's still unclear what exactly is causing the fuzzer to not halt at context cancellation. Log the termination of the internal syz-diff loops.
* vm/dispatcher: make pool.Run cancellableAleksandr Nogikh2025-04-231-1/+5
| | | | | | | | | | Make the pool.Run() function take a context.Context to be able to abort the callback passed to it or abort its scheduling if it's not yet running. Otherwise, if the callback is not yet started and the pool's Loop is aborted, we risk waiting for pool.Run() forever. It prevents the normal shutdown of repro.Run() and, consequently, the DiffFuzzer functionality.
* pkg/manager: provide diff fuzzer state dumpsAleksandr Nogikh2025-04-151-3/+3
| | | | | | Make the fuzzing step of syz-cluster create the manager.DiffStore object explicitly and dump its state to the logs after finishing the fuzzing session.
* pkg/manager: propagate context to the bug reproductionAleksandr Nogikh2025-04-151-2/+2
| | | | | If the context is cancelled, we need to make sure that the reproduction process is aborted as well.
* pkg/manager: disable fault injection during diff fuzzingAleksandr Nogikh2025-04-151-3/+2
| | | | | | | It may be introducing false positives into the process of determining whether the bug affects the base kernel. Let's stay on the safe side and not do it for now.
* pkg/manager: fix a missed case of context closure handlingAleksandr Nogikh2025-04-151-1/+4
| | | | | While doing a blocking write to the channel, take the possibility of the context closure into account.
* pkg/manager: add a sanity check for base kernel crashesAleksandr Nogikh2025-04-151-1/+8
| | | | | | | | | | | | | | It might be possible that: 1) The reproducer did not crash the base kernel. 2) Yet the base kernel has crashed with the same title independently since the moment we have started to find the reproducer etc. It should not be normally happening (it means that the current mechanism of checking whether the bug affects the base kernel is flawed), but it still happens. Add an extra check to avoid reporting such false positives and call log.Errorf() to ensure that the situation will be recorded in the logs.
* pkg/manager: minor cleanup of the diff fuzzer codeAleksandr Nogikh2025-04-151-7/+11
| | | | | | Add some comments. Demand that the channel for patched-only bugs is always present - otherwise what's the purpose of doing it.
* pkg/manager: wait until corpus is triaged for diff fuzzingAleksandr Nogikh2025-04-151-5/+56
| | | | | | | | | | | Track the right moment to start bug reproductions more exactly: 1) Either once 90% of the corpus is triaged (*). 2) Or once we are past 50% of the time dedicated for fuzzing. Whatever happens earlier. (*) The last percents are usually quite slow and they bring much less covered PCs that all the previous ones.
* pkg/manager: make diff fuzzer artifacts folder configurableAleksandr Nogikh2025-04-111-3/+4
|
* pkg/manager: handle context cancellationsAleksandr Nogikh2025-02-051-4/+13
| | | | There were a few spots where they were not considered.
* syz-cluster: integrate with syz-diffAleksandr Nogikh2025-02-041-17/+36
| | | | Run differential fuzzing as a workflow step.
* pkg/manager: fix RPCServer ops in RunDiffFuzzer()Aleksandr Nogikh2025-02-041-2/+9
| | | | We must not only call Listen(), but also Serve().
* pkg/manager: accept multiple patches in PatchFocusAreasAleksandr Nogikh2025-01-291-48/+53
| | | | | Make the method more flexible. Rename the variables to better reflect what is being done.
* pkg/manager: abort timers on context closureAleksandr Nogikh2025-01-291-1/+5
| | | | | There's a 15 minutes timer in the diff fuzzer that needs to be conditional on the context object.
* pkg/rpcserver: refactor to remove Fatalf callsAleksandr Nogikh2025-01-291-6/+7
| | | | Apply necessary changes to pkg/flatrpc and pkg/manager as well.
* pkg/manager: avoid log.Fatalf in manager.LoadSeedsAleksandr Nogikh2025-01-291-6/+22
| | | | This enables graceful error handling in the caller code.
* tools/syz-diff: move the logic to pkg/managerAleksandr Nogikh2025-01-231-89/+521
|
* tools: add a syz-diff toolAleksandr Nogikh2024-10-251-0/+139
This is the prototype version of the patch series fuzzing functionality based on the syzkaller fuzzing engine. The tool takes two syzkaller configs -- one for the base kernel, one for the patched kernel. Optionally the patch itself can be also provided. syz-diff will consider a bug patched-only if: 1) It happened while fuzzing the patched kernel. 2) It was never observed on the base kernel. 3) The tool found a repro on the patched kernel. 4) The repro did not crash the base kernel.
generated by ggit (джигит) mrf-deployment (git 2.46.0) at 2026-03-12 02:36:26 +0000