From 6b36d33868a01cea153c3a9cca05aef3548e4aea Mon Sep 17 00:00:00 2001 From: Dmitry Vyukov Date: Mon, 30 Dec 2019 11:41:20 +0100 Subject: syz-manager: corpus rotation Use a random subset of syscalls/corpus/coverage for each individual VM run. Hypothesis is that this should allow fuzzer to get more coverage find more bugs in saturated state (stuck in local optimum). See the issue and comments for details. Update #1348 --- prog/target.go | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'prog/target.go') diff --git a/prog/target.go b/prog/target.go index 78cf98b3a..69398a54d 100644 --- a/prog/target.go +++ b/prog/target.go @@ -49,6 +49,9 @@ type Target struct { // Used as fallback when string type does not have own dictionary. StringDictionary []string + // Resources that play auxiliary role, but widely used throughout all syscalls (e.g. pid/uid). + AuxResources map[string]bool + // Additional special invalid pointer values besides NULL to use. SpecialPointers []uint64 @@ -139,6 +142,8 @@ func (target *Target) initTarget() { for i, c := range target.Syscalls { c.ID = i target.SyscallMap[c.Name] = c + c.inputResources = target.getInputResources(c) + c.outputResources = target.getOutputResources(c) } target.populateResourceCtors() -- cgit mrf-deployment