syz-manager configuration

[Jason Thomas]

Hello,

Where can I find the syz-manager config of the instances run by syzbot? For example, I would like to know the number of VM instances used, number of processes per VM, allocated memory etc.

Regards,

Jason

[Jason Thomas]

Hello,

I found this config: https://github.com/google/syzkaller/blob/master/pkg/mgrconfig/testdata/qemu.cfg from the syzkaller repo. Is this the same one used by syzbot for running the instances?

[Dmitry Vyukov]

On Sun, 12 Jun 2022 at 07:19, Jason Thomas <jason.th...@gmail.com> wrote:
>
> Hello,
>
> Where can I find the syz-manager config of the instances run by syzbot? For example, I would like to know the number of VM instances used, number of processes per VM, allocated memory etc.

Hi Jason,

These configs are not open.
What aspects are you interested in and why?

[Jason Thomas]

Hi Dmitry,

Thanks a lot for your reply. Our syzkaller runs look very different from the syzbot runs. I am mainly interested in #vms, memory, processes, blocked syscalls, ignored warnings, etc., so we can reproduce syzbot set up locally.

--

JT

[Jason Thomas]

Specifically, I am facing the following issue:

I ran this syzkaller version on this kernel commit with this kernel config for 24 hours, and I am getting around ~9M executions. However, the branch coverage is around 186K and the signal is around 300K which is way lesser than the syzbot's run (signal: 600K) for the same syzkaller and kernel version. I am a little bit puzzled about the outcome. Any insight into why this could happen? I am leaning towards thinking that it has something to do with disabled syscalls. 

--

JT

[Dmitry Vyukov]

A typical instance config looks as follows:

"manager_config": {
"name": "ci-upstream-kasan-gce",
"target": "linux/amd64",
"hub_domain": "upstream/kasan",
"sandbox": "namespace",
"procs": 6,
"type": "gce",
"vm": {
"count": 10,
"machine_type": "e2-standard-2",
"gcs_path": "syzkaller/disks"
},
"disable_syscalls": [ "perf_event_open*" ]
}

But then syzbot has multiple such instances and the corpus is
accumulated over years, it won't saturate in 24h.