syz-manager: fix panic in debug mode

dvyukov · a-nogikh · commit b0cc4801a294 · 2025-04-02T14:41:32.000Z
When running in debug mode, mgr.vmPool.Count()-mgr.cfg.FuzzingVMs
can become negative even for a valid config since we reduce
number of VMs to 1.
NewReproLoop panics when VM count argument is negative
since it passes it to make chan.
Cap number of repro VMs at 0.
diff --git a/syz-manager/manager.go b/syz-manager/manager.go
@@ -359,7 +359,8 @@ func RunManager(mode *Mode, cfg *mgrconfig.Config) {
 	}
 	mgr.pool = vm.NewDispatcher(mgr.vmPool, mgr.fuzzerInstance)
 	mgr.http.Pool = mgr.pool
-	mgr.reproLoop = manager.NewReproLoop(mgr, mgr.vmPool.Count()-mgr.cfg.FuzzingVMs, mgr.cfg.DashboardOnlyRepro)
+	reproVMs := max(0, mgr.vmPool.Count()-mgr.cfg.FuzzingVMs)
+	mgr.reproLoop = manager.NewReproLoop(mgr, reproVMs, mgr.cfg.DashboardOnlyRepro)
 	mgr.http.ReproLoop = mgr.reproLoop
 	mgr.http.TogglePause = mgr.pool.TogglePause
 

Original file line number	Diff line number	Diff line change
`@@ -359,7 +359,8 @@ func RunManager(mode Mode, cfg mgrconfig.Config) {`
`359`	`359`	`}`
`360`	`360`	`mgr.pool = vm.NewDispatcher(mgr.vmPool, mgr.fuzzerInstance)`
`361`	`361`	`mgr.http.Pool = mgr.pool`
`362`		`- mgr.reproLoop = manager.NewReproLoop(mgr, mgr.vmPool.Count()-mgr.cfg.FuzzingVMs, mgr.cfg.DashboardOnlyRepro)`
	`362`	`+ reproVMs := max(0, mgr.vmPool.Count()-mgr.cfg.FuzzingVMs)`
	`363`	`+ mgr.reproLoop = manager.NewReproLoop(mgr, reproVMs, mgr.cfg.DashboardOnlyRepro)`
`363`	`364`	`mgr.http.ReproLoop = mgr.reproLoop`
`364`	`365`	`mgr.http.TogglePause = mgr.pool.TogglePause`
`365`	`366`