| Commit message (Collapse) | Author | Age | Files | Lines |
| |
|
|
| |
Any is the preferred over interface{} now in Go.
|
| |
|
|
| |
./tools/syz-env bin/golangci-lint run ./... --fix
|
| |
|
|
|
| |
1. Use context for the goroutines termination.
2. uploadCoverJSONLToGCS reached 8 params, refactor.
|
| |
|
|
|
|
| |
This unifies the build() and clean() interfaces such that if a custom
compiler or make binary is provided in the manager or bisection config,
they can be taken into account by the clean() interface.
|
| |
|
|
|
|
| |
Certain environments might need a specific make command or wrap make
calls with extra logic. This lets users provide a path to a custom make
binary.
|
| |
|
|
|
|
|
| |
We currently observe episodic "job: reproducer consistency is empty"
error messages, but there's little one can do with them.
Make them more actionable.
|
| |
|
|
|
|
|
| |
Handle SIGKILL (exit code = 137) on osutil.Run() during Linux kernel image
building and return build.InfraError without reporting.
Fixes: https://github.com/google/syzkaller/issues/5317
|
| |
|
|
| |
The latter is a better suitable name.
|
| |
|
|
|
| |
The parameter defines the maximum number of CPUs involved in the kernel
build process.
|
| |
|
|
|
| |
filepath.Join() will ignore empty parameters, so we don't need these
checks.
|
| |
|
|
|
| |
This is used to add a suffix to the kernel_src config field. This is
used in Android where kernel source is under .../kernel/aosp/.
|
| |
|
|
|
| |
The "devlink: bump the instance index directly when iterating" commit
has already appeared in too many invalid fix bisection results.
|
| |
|
|
|
|
| |
Now that we also support checking whether the guilty commit is present,
we can afford to share the custom backport list among all syz-ci
managers in a number of cases.
|
| |
|
|
|
|
|
|
|
| |
Make syz-ci configuration more flexible by allowing users to set the
list of commits that should never be reported as valid bisection
results.
Keep the list of such upstream Linux commits in the code in order not to
duplicate it everywhere.
|
| |
|
|
|
|
|
| |
Judging from the bisection logs, the confidence level statistic indeed
correlates with the chance of the result being true positive.
Let's use a stricter threshold to publish fewer false positives.
|
| |
|
|
|
|
|
|
|
|
| |
Given that mail_bisect_template.txt refers to that data as "start
commit", let's directly use the information about the starting commit
that we already have.
Otherwise we get
start commit: [unknown]
in our reports.
|
| |
|
|
| |
There was a typo in the code.
|
| |
|
|
|
|
|
|
|
|
|
|
|
| |
If tree origin assessment code has identified that the bug is not
reproducible in a tree from which we merge/cherry-pick commits, use fix
bisection to identify that commit. This can e.g. be used to find fixing
commits that were not backported from Linux kernel mainline into LTS
branches.
In case of bisection errors, re-do such jobs every 30 days.
Remember in the Bug structure whether there's a fix candidate and return
the details in the full bug info API query.
|
| |
|
|
|
|
|
| |
For bisections, only return it if it's successful. We don't seem to be
interested in specific values for jobs anyway.
Do the same for KernelCommitDate.
|
| |
|
|
|
| |
This will let us use the same code for sampling-based generation of
bisection jobs as well.
|
| | |
|
| | |
|
| |
|
|
|
|
|
|
| |
It might be the case that the kernels that are being fuzzed on syz-ci
require their own backports to build/test older revisions during
bisection.
Let users specify it in the syz-ci config.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Estimate reproducer's flakiness more carefully, as it can help us get
better results.
During config minimization, do not let reproducibility drop too low.
For each test() run, estimate our confidence in the result. For now,
only consider the false negative case: if we got no crashes, it's likely
that the bug is there, but the reproducer was not lucky enough. Given an
estimate of reproduction likelihood, we can easily calculate the chance
of an invalid result: (1-probability)^runs.
Combine all individual test() confidences into Result.Confidence. If the
resulting Confidence is too low, ignore the bisection result.
|
| |
|
|
|
|
|
|
|
| |
This condition is no longer really important -- build and test are
anyway controlled by semaphores, so if we don't take the job, nobody
else will be able to finish it sooner.
Also, we reset job statuses on syz-ci restart, so it won't be a problem
to take a job again.
|
| |
|
|
|
| |
If the bisection failed due to infrastructure problems, let's retry it
in 7 days.
|
| |
|
|
|
|
| |
Earlier it was limited to 8 hours mostly because syz-ci could execute
only one job at a time. Now that it's no longer the case, we can
increase the timeout to 12 hours.
|
| |
|
|
|
| |
1) Set the name of the instace to improve log analysis.
2) Use log.Errorf for errors that deserve human attention.
|
| |
|
|
|
| |
The functionality has become too complex to keep it together with the
other job processing code.
|
| |
|
|
|
|
|
|
|
|
|
|
| |
If merge base repo & branch are specified, syz-ci will first calculate
the merge base between KernelRepo + KernelBranch and MergeBaseRepo +
MergeBaseBranch and then it will execute patch testing on the latest
commit reachable from both.
If there's no such commit or several ones are equally good, abort the
job with an error.
Also, support a TreeOrigin job flag that will be needed later.
|
| | |
|
| |
|
|
|
| |
This should help diagnose problems when several loops should have
started.
|
| |
|
|
|
| |
The stop channel must be closed in order to pass the signal to all
listeners.
|
| |
|
|
| |
Currently a suffix is appended twice.
|
| |
|
|
|
| |
Check if there are any managers that could benefit from an extra job
processor before starting it.
|
| |
|
|
|
|
| |
Otherwise we might end up in a situation when we have stopped all
fuzzing, but wait for the job processor to report Done to the waitgroup
object.
|
| |
|
|
| |
This will help reduce the number of overcommitted VMs.
|
| |
|
|
| |
Now that we might have two, it might be helpful to split the logs.
|
| |
|
|
|
|
|
|
|
| |
Introduce a new ParallelJobs configuration parameter. If set, syz-ci
will execute the specified kinds of jobs in parallel to the main job
processing thread.
This should resolve the 7-8 hour patch testing delays when syz-ci is
busy doing a bisection.
|
| |
|
|
|
|
|
|
| |
Currently it's held during the whole job processing, which can take too
long.
Adjust it so that it's only taken when we really begin to build the
kernel or syzkaller.
|
| | |
|
| |
|
|
|
|
| |
Previously we only used the linter from the syz-ci config when building
the kernel for regular fuzzing. We were missing some plumbing to have
this setting reach patch testing and bisection jobs.
|
| |
|
|
|
|
|
| |
This allows us to bisect at least recently introduced bugs, where the
manager that found the bug uses a non standard compiler. This is usefull
during development of a new sanitizer for which a compiler with
non-upstreamed patches is required.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
| |
When bisecting a breaking commit, syzkaller starts the bisection from
the commit recorded in the last crash for the given bug. Previously the
bisection was aborted should the commit no longer exist in the repo.
Now we try to reidentify the breaking commit. For git pretty much the
best we can do is to search a commit reachable from HEAD with the same
title. Other VCS systems might have something better.
Syzkaller will still first validate that the start commit is indeed
broken in the way it expects. This prevents syzkaller from getting
confused should we accidentally pick a completely unrelated commit.
|
| |
|
|
|
| |
Before we hardcoded bisection to use gcc, now the compiler family can
be configured in the bisection config.
|
| | |
|
| |
|
|
|
| |
This might help get more insight into patch testing failures, especially
for old bugs.
|
| |
|
|
|
|
| |
Currently syzbot only saves a log if there was a build/test error.
Closes #3185
|
| |
|
|
|
|
| |
For boot-time bugs there may be no repro, yet we can test it. Only leave
a sanity check (if syz repro is present, then repro options must also
be, and vice versa).
|
| |
|
|
|
|
|
|
| |
Currently syzkaller leaves an empty CompilerID, when it has failed to
build a kernel. However, in almost all cases this is possible to do.
Query compiler information irregardless of whether the build process
is successful.
|