syz-bisect

Overview ¶

syz-bisect runs bisection to find cause/fix commit for a crash.

The tool is originally created to test pkg/bisect logic.

The tool requires a config file passed in -config flag, see Config type below for details, and a directory with info about the crash passed in -crash flag). If -fix flag is specified, it does fix bisection. Otherwise it does cause bisection. Also wanted syzkaller and kernel commits can be specified using -syzkaller_commit and -kernel_commit. HEAD is used if commits are not specified.

The crash dir should contain the following files:

• repro.cprog or repro.prog: reproducer for the crash
• repro.opts: syzkaller reproducer options (e.g. {"procs":1,"sandbox":"none",...}) (optional)

The tool stores bisection result into cause.commit or fix.commit.