How thejh/syzkaller works
syzkaller is a coverage-guided kernel fuzzer. Its principal workflow is to manage virtual machines, run fuzzers that generate and execute syscall programs, collect execution feedback and crashes, and minimize/reproduce failures. Target syscall descriptions and the shared executor support that work; reporting and dashboard services handle discovered bugs. The repository also includes CI management and a distributed hub. Some links are documented only at the product level because relevant implementation excerpts were not provided.
Main entry points: manager.go Fuzz manager · fuzzer.go Fuzzer process · prog.go Program model · vm.go VM pool
Components 20
Fuzzing runtime
- Fuzz manager
syz-manager/manager.go - Fuzzer process
syz-fuzzer/fuzzer.go - Program model
prog/prog.go - Executor IPC
pkg/ipc/ipc.go - Target executor
executor/executor.cc - Linux support
executor/common_linux.h - VM pool
vm/vm.go
Target support
- Syscall descriptions
sys/linux/gen/amd64.go - Target registry
sys/targets/targets.go - Description checker
pkg/compiler/check.go - Manager configuration
pkg/mgrconfig/config.go
Crash triage
- Crash monitor
vm/vm.go - Reproducer
pkg/repro/repro.go - Kernel report parser
pkg/report/linux.go
Operations and reporting
- Bug dashboard
dashboard/app/main.go - Dashboard API
dashboard/dashapi/dashapi.go - CI manager
syz-ci/manager.go - Fuzzer hub
syz-hub/hub.go - Corpus database
pkg/db/db.go
Other components
- Fuzzer operator
Connections 21
- Fuzzer operator → Fuzz manager: configures
- Fuzz manager → VM pool: creates VMs
syz-manager/manager.go - Fuzz manager → Corpus database: stores corpus
- Fuzz manager → Reproducer: requests reproduction
syz-manager/manager.go - Fuzz manager → Dashboard API: sends stats
syz-manager/manager.go - Fuzzer process → Fuzz manager: exchanges RPC
syz-fuzzer/fuzzer.go - Fuzzer process → Program model: generates programs
syz-fuzzer/fuzzer.go - Fuzzer process → Executor IPC: executes through
syz-fuzzer/fuzzer.go - Executor IPC → Target executor: controls execution
- Target executor → Linux support: uses support
executor/common_linux.h - Program model → Syscall descriptions: uses descriptions
- Description checker → Target registry: checks targets
pkg/compiler/check.go - Description checker → Program model: checks programs
pkg/compiler/check.go - Fuzz manager → Manager configuration: loads config
- VM pool → Crash monitor: monitors output
vm/vm.go - Crash monitor → Kernel report parser: parses reports
- Reproducer → VM pool: tests candidates
pkg/repro/repro.go - CI manager → Fuzz manager: restarts process
syz-ci/manager.go - CI manager → Dashboard API: reports builds
- Dashboard API → Bug dashboard: serves bug data
- Fuzzer process → Fuzzer hub: shares inputs