Skip to content

Conversation

@choller
Copy link
Contributor

@choller choller commented Nov 22, 2023

Each Nyx instance requires a numeric id when being created. Nyx internally assumes that id 0 is the parent id and all non-zero ids are child instances that will run what the parent runs. For this purpose, fsrv->nyx_id is actually populated with the id used with -M/-S. Mistakenly the code currently uses nyx_bind_cpu_id though which works by coincidence if you only ever run a single AFL++ instance with -M on a device and the CPU with id 0 is not busy already. Running two AFL++ instances with -M in parallel will cause a Nyx assertion to fail and reveals the failure.

@vanhauser-thc vanhauser-thc changed the base branch from stable to dev November 22, 2023 14:48
@vanhauser-thc
Copy link
Member

@schumilo fine with you?

@schumilo
Copy link
Contributor

Patch looks good and yes, this is indeed a silly bug we want to fix.
I haven't tested the AFL++ companion tools yet, but I would expect the tools to remain functional with this patch applied.

We should probably also remove nyx_bind_cpu_id as it is no longer used. From what I remember, libnyx does not bind a QEMU-Nyx process to a specific CPU-ID anymore (this has changed at some point during development). Instead, this is now up to the fuzzer, which in this case is already handled by AFL++.

@vanhauser-thc vanhauser-thc merged commit 0547c49 into AFLplusplus:dev Nov 27, 2023
@vanhauser-thc
Copy link
Member

Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants