From 7013cb0d7d7b78bb0160c45d13a8d7d472835513 Mon Sep 17 00:00:00 2001 From: Dmitry Vyukov Date: Wed, 7 Aug 2024 15:16:35 +0200 Subject: prog: replace MinimizeParams with MinimizeMode All callers shouldn't control lots of internal details of minimization (if we have more params, that's just more variations to test, and we don't have more, params is just a more convoluted way to say if we minimize for corpus or a crash). 2 bools also allow to express 4 options, but only 3 make sense. Also when I see MinimizeParams{} in the code, it's unclear what it means. Replace params with mode. And potentially "crash" minimization is not "light", it's just different. E.g. we can simplify int arguments for reproducers (esp in snapshot mode), but we don't need that for corpus. --- pkg/csource/csource_test.go | 2 +- pkg/fuzzer/job.go | 59 ++++++++++++++++++++++----------------------- pkg/repro/repro.go | 31 +++++++++++------------- 3 files changed, 44 insertions(+), 48 deletions(-) (limited to 'pkg') diff --git a/pkg/csource/csource_test.go b/pkg/csource/csource_test.go index 7d67927a3..c97757d01 100644 --- a/pkg/csource/csource_test.go +++ b/pkg/csource/csource_test.go @@ -91,7 +91,7 @@ func testTarget(t *testing.T, target *prog.Target, full bool) { opts = allOptionsSingle(target.OS) opts = append(opts, ExecutorOpts) } else { - minimized, _ := prog.Minimize(syzProg, -1, prog.MinimizeParams{}, func(p *prog.Prog, call int) bool { + minimized, _ := prog.Minimize(syzProg, -1, prog.MinimizeCorpus, func(p *prog.Prog, call int) bool { return len(p.Calls) == len(syzProg.Calls) }) p.Calls = append(p.Calls, minimized.Calls...) diff --git a/pkg/fuzzer/job.go b/pkg/fuzzer/job.go index 85d2dcfe6..7a89006f1 100644 --- a/pkg/fuzzer/job.go +++ b/pkg/fuzzer/job.go @@ -301,39 +301,38 @@ func (job *triageJob) minimize(call int, info *triageCall) (*prog.Prog, int) { minimizeAttempts = 2 } stop := false - p, call := prog.Minimize(job.p, call, prog.MinimizeParams{}, - func(p1 *prog.Prog, call1 int) bool { - if stop { + p, call := prog.Minimize(job.p, call, prog.MinimizeCorpus, func(p1 *prog.Prog, call1 int) bool { + if stop { + return false + } + var mergedSignal signal.Signal + for i := 0; i < minimizeAttempts; i++ { + result := job.execute(&queue.Request{ + Prog: p1, + ExecOpts: setFlags(flatrpc.ExecFlagCollectSignal), + ReturnAllSignal: []int{call1}, + Stat: job.fuzzer.statExecMinimize, + }, 0) + if result.Stop() { + stop = true return false } - var mergedSignal signal.Signal - for i := 0; i < minimizeAttempts; i++ { - result := job.execute(&queue.Request{ - Prog: p1, - ExecOpts: setFlags(flatrpc.ExecFlagCollectSignal), - ReturnAllSignal: []int{call1}, - Stat: job.fuzzer.statExecMinimize, - }, 0) - if result.Stop() { - stop = true - return false - } - if !reexecutionSuccess(result.Info, info.errno, call1) { - // The call was not executed or failed. - continue - } - thisSignal := getSignalAndCover(p1, result.Info, call1) - if mergedSignal.Len() == 0 { - mergedSignal = thisSignal - } else { - mergedSignal.Merge(thisSignal) - } - if info.newStableSignal.Intersection(mergedSignal).Len() == info.newStableSignal.Len() { - return true - } + if !reexecutionSuccess(result.Info, info.errno, call1) { + // The call was not executed or failed. + continue } - return false - }) + thisSignal := getSignalAndCover(p1, result.Info, call1) + if mergedSignal.Len() == 0 { + mergedSignal = thisSignal + } else { + mergedSignal.Merge(thisSignal) + } + if info.newStableSignal.Intersection(mergedSignal).Len() == info.newStableSignal.Len() { + return true + } + } + return false + }) if stop { return nil, 0 } diff --git a/pkg/repro/repro.go b/pkg/repro/repro.go index 5565460c2..2091d3c88 100644 --- a/pkg/repro/repro.go +++ b/pkg/repro/repro.go @@ -372,9 +372,7 @@ func (ctx *reproContext) concatenateProgs(entries []*prog.LogEntry, dur time.Dur for i := 0; i < len(entries); i++ { ctx.reproLogf(1, "minimizing program #%d before concatenation", i) callsBefore := len(entries[i].P.Calls) - entries[i].P, _ = prog.Minimize(entries[i].P, -1, prog.MinimizeParams{ - RemoveCallsOnly: true, - }, + entries[i].P, _ = prog.Minimize(entries[i].P, -1, prog.MinimizeCallsOnly, func(p1 *prog.Prog, _ int) bool { var newEntries []*prog.LogEntry if i > 0 { @@ -432,20 +430,19 @@ func (ctx *reproContext) minimizeProg(res *Result) (*Result, error) { ctx.stats.MinimizeProgTime = time.Since(start) }() - res.Prog, _ = prog.Minimize(res.Prog, -1, prog.MinimizeParams{Light: true}, - func(p1 *prog.Prog, callIndex int) bool { - if len(p1.Calls) == 0 { - // We do want to keep at least one call, otherwise tools/syz-execprog - // will immediately exit. - return false - } - crashed, err := ctx.testProg(p1, res.Duration, res.Opts) - if err != nil { - ctx.reproLogf(0, "minimization failed with %v", err) - return false - } - return crashed - }) + res.Prog, _ = prog.Minimize(res.Prog, -1, prog.MinimizeCrash, func(p1 *prog.Prog, callIndex int) bool { + if len(p1.Calls) == 0 { + // We do want to keep at least one call, otherwise tools/syz-execprog + // will immediately exit. + return false + } + crashed, err := ctx.testProg(p1, res.Duration, res.Opts) + if err != nil { + ctx.reproLogf(0, "minimization failed with %v", err) + return false + } + return crashed + }) return res, nil } -- cgit mrf-deployment