ensure one fuzzer sync per cycle, cycle introspection

4 files changed, 18 insertions, 7 deletions

diff --git a/docs/Changelog.md b/docs/Changelog.md
index 6ae42b04..91d1a8cc 100644
--- a/docs/Changelog.md
+++ b/docs/Changelog.md
@@ -18,6 +18,7 @@ sending a mail to <afl-users+subscribe@googlegroups.com>.
       to allow replay of non-reproducable crashes, see
       AFL_PERSISTENT_RECORD in config.h and docs/envs.h
     - default cmplog level (-l) is now 2, better efficiency.
+    - ensure one fuzzer sync per cycle
   - afl-cc:
     - Removed InsTrim instrumentation as it is not as good as PCGUARD
 
diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h
index 046b0177..40a7fc85 100644
--- a/include/afl-fuzz.h
+++ b/include/afl-fuzz.h
@@ -572,6 +572,7 @@ typedef struct afl_state {
       blocks_eff_select,                /* Blocks selected as fuzzable      */
       start_time,                       /* Unix start time (ms)             */
       last_sync_time,                   /* Time of last sync                */
+      last_sync_cycle,                  /* Cycle no. of the last sync       */
       last_path_time,                   /* Time for most recent path (ms)   */
       last_crash_time,                  /* Time for most recent crash (ms)  */
       last_hang_time;                   /* Time for most recent hang (ms)   */
diff --git a/src/afl-fuzz-run.c b/src/afl-fuzz-run.c
index 83133dad..832f17bb 100644
--- a/src/afl-fuzz-run.c
+++ b/src/afl-fuzz-run.c
@@ -712,6 +712,7 @@ void sync_fuzzers(afl_state_t *afl) {
   if (afl->foreign_sync_cnt) read_foreign_testcases(afl, 0);
 
   afl->last_sync_time = get_cur_time();
+  afl->last_sync_cycle = afl->queue_cycle;
 
 }
 
diff --git a/src/afl-fuzz.c b/src/afl-fuzz.c
index a7edb924..9688c84f 100644
--- a/src/afl-fuzz.c
+++ b/src/afl-fuzz.c
@@ -1867,6 +1867,14 @@ int main(int argc, char **argv_orig, char **envp) {
                   runs_in_current_cycle > afl->queued_paths) ||
                  (afl->old_seed_selection && !afl->queue_cur))) {
 
+      if (unlikely((afl->last_sync_cycle < afl->queue_cycle ||
+                    (!afl->queue_cycle && afl->afl_env.afl_import_first)) &&
+                   afl->sync_id)) {
+
+        sync_fuzzers(afl);
+
+      }
+
       ++afl->queue_cycle;
       runs_in_current_cycle = (u32)-1;
       afl->cur_skipped_paths = 0;
@@ -1980,6 +1988,13 @@ int main(int argc, char **argv_orig, char **envp) {
 
       }
 
+  #ifdef INTROSPECTION
+      fprintf(afl->introspection_file,
+              "CYCLE cycle=%llu cycle_wo_finds=%llu expand_havoc=%u queue=%u\n",
+              afl->queue_cycle, afl->cycles_wo_finds, afl->expand_havoc,
+              afl->queued_paths);
+  #endif
+
       if (afl->cycle_schedules) {
 
         /* we cannot mix non-AFLfast schedules with others */
@@ -2031,13 +2046,6 @@ int main(int argc, char **argv_orig, char **envp) {
 
       prev_queued = afl->queued_paths;
 
-      if (afl->sync_id && afl->queue_cycle == 1 &&
-          afl->afl_env.afl_import_first) {
-
-        sync_fuzzers(afl);
-
-      }
-
     }
 
     ++runs_in_current_cycle;