syz-bisect

Documentation

Overview

syz-bisect runs bisection to find cause/fix commit for a crash.

The tool is originally created to test pkg/bisect logic, the interface is not particularly handy to use.

The tool requires a config file passed in -config flag, see Config type below for details, and a directory with info about the crash passed in -crash flag). If -fix flag is specified, it does fix bisection. Otherwise it does cause bisection.

The crash dir should contain the following files:

• repro.c: C reproducer for the crash (optional)
• repro.syz: syzkaller reproducer for the crash
• repro.opts: syzkaller reproducer options (e.g. {"procs":1,"sandbox":"none",...})
• syzkaller.commit: hash of syzkaller commit which was used to trigger the crash
• kernel.commit: hash of kernel commit on which the crash was triggered
• kernel.config: kernel config file