From c1ff9c10cf949b3fe952f6d4e86016b2f837d941 Mon Sep 17 00:00:00 2001 From: Dmitry Vyukov Date: Thu, 1 Oct 2020 12:00:06 +0200 Subject: syz-manager: re-enable corpus rotation Let's give it another chance since the previous coverage drop wasn't completely conclusive. Few changes that may help: - do rotation at 1/5 instead of 1/3 rate - don't send triage candidates to rotated VMs, since they may not have required syscalls enabled - don't send new inputs/coverage to rotated VMs, let them run in complete isolation Update #1348 --- syz-manager/rpc.go | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/syz-manager/rpc.go b/syz-manager/rpc.go index d4c4ea077..3cd3d2d08 100644 --- a/syz-manager/rpc.go +++ b/syz-manager/rpc.go @@ -102,8 +102,7 @@ func (serv *RPCServer) Connect(a *rpctype.ConnectArgs, r *rpctype.ConnectRes) er r.EnabledCalls = serv.configEnabledSyscalls r.GitRevision = prog.GitRevision r.TargetRevision = serv.target.Revision - // TODO: temporary disabled b/c we suspect this negatively affects fuzzing. - if false && serv.mgr.rotateCorpus() && serv.rnd.Intn(3) != 0 { + if serv.mgr.rotateCorpus() && serv.rnd.Intn(5) == 0 { // We do rotation every other time because there are no objective // proofs regarding its efficiency either way. // Also, rotation gives significantly skewed syscall selection @@ -253,7 +252,7 @@ func (serv *RPCServer) NewInput(a *rpctype.NewInputArgs, r *int) error { a.RPCInput.Cover = nil // Don't send coverage back to all fuzzers. for _, other := range serv.fuzzers { - if other == f { + if other == f || other.rotatedSignal != nil { continue } other.inputs = append(other.inputs, a.RPCInput) @@ -280,12 +279,16 @@ func (serv *RPCServer) Poll(a *rpctype.PollArgs, r *rpctype.PollRes) error { serv.maxSignal.Merge(newMaxSignal) serv.stats.maxSignal.set(len(serv.maxSignal)) for _, f1 := range serv.fuzzers { - if f1 == f { + if f1 == f || f1.rotatedSignal != nil { continue } f1.newMaxSignal.Merge(newMaxSignal) } } + if f.rotatedSignal != nil { + // Let rotated VMs run in isolation, don't send them anything. + return nil + } r.MaxSignal = f.newMaxSignal.Split(500).Serialize() if a.NeedCandidates { r.Candidates = serv.mgr.candidateBatch(serv.batchSize) -- cgit mrf-deployment