dashboard/app/jobs.go

@@ -345,7 +345,9 @@ func createPatchTestingJobs(c context.Context, managers map[string]dashapi.Manag
 		managersList = append(managersList, decommissionedInto(name)...)
 	}
 	managersList = unique(managersList)
-	r := rand.New(rand.NewSource(timeNow(c).UnixNano()))
+
+	var allBugs []*Bug
+	var allBugKeys []*db.Key
 	for _, mgrName := range managersList {
 		bugs, bugKeys, err := loadAllBugs(c, func(query *db.Query) *db.Query {
 			return query.Filter("Status=", BugStatusOpen).
@@ -366,22 +368,27 @@ func createPatchTestingJobs(c context.Context, managers map[string]dashapi.Manag
 			}
 			return true
 		})
-		r.Shuffle(len(bugs), func(i, j int) {
-			bugs[i], bugs[j] = bugs[j], bugs[i]
-			bugKeys[i], bugKeys[j] = bugKeys[j], bugKeys[i]
-		})
-		// Also shuffle the creator functions.
-		funcs := []func(context.Context, []*Bug, []*db.Key,
-			map[string]dashapi.ManagerJobs) (*Job, *db.Key, error){
-			createPatchRetestingJobs,
-			createTreeTestJobs,
-		}
-		r.Shuffle(len(funcs), func(i, j int) { funcs[i], funcs[j] = funcs[j], funcs[i] })
-		for _, f := range funcs {
-			job, jobKey, err := f(c, bugs, bugKeys, managers)
-			if job != nil || err != nil {
-				return job, jobKey, err
-			}
+		allBugs = append(allBugs, bugs...)
+		allBugKeys = append(allBugKeys, bugKeys...)
+	}
+	r := rand.New(rand.NewSource(timeNow(c).UnixNano()))
+	// Bugs often happen on multiple instances, so let's filter out duplicates.
+	allBugs, allBugKeys = uniqueBugs(allBugs, allBugKeys)
+	r.Shuffle(len(allBugs), func(i, j int) {
+		allBugs[i], allBugs[j] = allBugs[j], allBugs[i]
+		allBugKeys[i], allBugKeys[j] = allBugKeys[j], allBugKeys[i]
+	})
+	// Also shuffle the creator functions.
+	funcs := []func(context.Context, []*Bug, []*db.Key,
+		map[string]dashapi.ManagerJobs) (*Job, *db.Key, error){
+		createPatchRetestingJobs,
+		createTreeTestJobs,
+	}
+	r.Shuffle(len(funcs), func(i, j int) { funcs[i], funcs[j] = funcs[j], funcs[i] })
+	for _, f := range funcs {
+		job, jobKey, err := f(c, allBugs, allBugKeys, managers)
+		if job != nil || err != nil {
+			return job, jobKey, err
 		}
 	}
 	return nil, nil, nil
@@ -1476,3 +1483,20 @@ func makeJobInfo(c context.Context, job *Job, jobKey *db.Key, bug *Bug, build *B
 	}
 	return info
 }
+
+func uniqueBugs(inBugs []*Bug, inKeys []*db.Key) ([]*Bug, []*db.Key) {
+	var bugs []*Bug
+	var keys []*db.Key
+
+	dups := map[string]bool{}
+	for i, bug := range inBugs {
+		hash := bug.keyHash()
+		if dups[hash] {
+			continue
+		}
+		dups[hash] = true
+		bugs = append(bugs, bug)
+		keys = append(keys, inKeys[i])
+	}
+	return bugs, keys
+}

dashboard/app/main.go

@@ -1114,7 +1114,10 @@ func createUISubsystem(ns string, item *subsystem.Subsystem, cached *Cached) *ui
 		},
 		Fixed: uiSubsystemStats{
 			Count: stats.Fixed,
-			Link:  html.AmendURL("/"+ns+"/fixed", "subsystem", item.Name),
+			Link: html.AmendURL("/"+ns+"/fixed", "label", BugLabel{
+				Label: SubsystemLabel,
+				Value: item.Name,
+			}.String()),
 		},
 	}
 }

dashboard/config/linux/bits/chromeos-6.1.yml

+# Copyright 2021 syzkaller project authors. All rights reserved.
+# Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.
+
+kernel:
+ repo: https://chromium.googlesource.com/chromiumos/third_party/kernel
+ # HEAD of chromeos-6.1 branch.
+ tag: 648e4589ec3e42719df5ce9f27240ff22c22361d
+
+shell:
+ - CHROMEOS_KERNEL_FAMILY=chromeos chromeos/scripts/prepareconfig chromiumos-x86_64 ${BUILDDIR}/.config
+ - make olddefconfig
+
+config:
+  - IO_URING

dashboard/config/linux/bits/chromeos-subsystems.yml

@@ -9,7 +9,7 @@ config:
  - PKGLIST
  - PKGLIST_USE_CONFIGFS
  - ESD_FS
- - INCREMENTAL_FS: [-chromeos-5.15] #incrementalfs absent in 5.15
+ - INCREMENTAL_FS: [-chromeos-5.15, -chromeos-6.1] #incrementalfs absent in 5.15
  - VIRTIO_FS
  - VIRTIO_WL
  - USB_CONFIGFS: [override]

dashboard/config/linux/main.yml

@@ -31,6 +31,7 @@ instances:
  - chromeos-5.4:		[chromeos, chromeos-5.4, nodefconfig, x86_64, timeouts_native, onlyusb, kasan]
  - chromeos-5.10:		[chromeos, chromeos-5.10, nodefconfig, x86_64, timeouts_native, onlyusb, kasan]
  - chromeos-5.15:		[chromeos, chromeos-5.15, nodefconfig, x86_64, timeouts_native, onlyusb, kasan]
+ - chromeos-6.1:		[chromeos, chromeos-6.1, nodefconfig, x86_64, timeouts_native, onlyusb, kasan]
  - cos-5.15-kasan:		[cos, cos-5.15, x86_64, clang, nodefconfig, baseline, timeouts_native, nonoise, kasan]
  - cos-5.15-arm64-kasan:	[cos, cos-5.15, arm64, clang, nodefconfig, baseline, timeouts_native, nonoise, kasan]
  - cos-6.1-kasan:		[cos, cos-6.1, x86_64, clang, nodefconfig, baseline, timeouts_native, nonoise, kasan]
@@ -90,5 +91,6 @@ includes:
  - chromeos-5.4.yml: [chromeos-5.4]
  - chromeos-5.10.yml: [chromeos-5.10]
  - chromeos-5.15.yml: [chromeos-5.15]
+ - chromeos-6.1.yml: [chromeos-6.1]
  - cos-5.15.yml: [cos-5.15]
  - cos-6.1.yml: [cos-6.1]

docs/research.md

 # Research work based on syzkaller
 
 _newer first_
+* [KIT: Testing OS-Level Virtualization for Functional Interference Bugs](https://doi.org/10.1145/3575693.3575731)
 * [SyzDescribe: Principled, Automated, Static Generation of Syscall Descriptions for Kernel Drivers](https://github.com/seclab-ucr/SyzDescribe)
 * [GREBE: Unveiling Exploitation Potential for Linux Kernel Bugs](https://zplin.me/papers/GREBE.pdf)
 * [Precise Detection of Kernel Data Races with Probabilistic Lockset Analysis](https://www.cs.columbia.edu/~gabe/files/oakland2023_pla.pdf)