Additional usage instructions about syzkaller HOT 7 CLOSED

Yes, syz-repro does not recognize "no output" as crash. It should.

"no output" means that fuzzer appears to be hanged and does not produce any output for some time. This can mean that kernel got deadlocked. Try to copy bin/syz-execprog, bin/syz-executor and crash-qemu-3-1456169236767423401 into a VM, and then execute:
$ ./syz-execprog -cover=0 -repeat=0 -procs=20 qemu-3-1456169236767423401
And check what happens with kernel and with syz-executor processes. Do they look healthy?

from syzkaller.

Where is it looking for syz-executor at?

root@bitbox:~# ls bin/
syz-execprog  syz-executor  syz-mutate  syz-prog2c  syz-repro  syz-stress  syz-upgrade
root@bitbox:~# ./bin/syz-execprog -cover=0 -repeat=0 -procs=20 ./crash-qemu-0-1456169225187357935
2016/02/24 16:54:31 parsed 4 programs
2016/02/24 16:54:31 executed 0 programs
result: failed=false hanged=false err=failed to start executor binary: fork/exec /root: permission denied
result: failed=false hanged=false err=failed to start executor binary: fork/exec /root: permission denied
result: failed=false hanged=false err=failed to start executor binary: fork/exec /root: permission denied
result: failed=false hanged=false err=failed to start executor binary: fork/exec /root: permission denied
result: failed=false hanged=false err=failed to start executor binary: fork/exec /root: permission denied

and from the bin/

root@bitbox:~/bin# ./syz-execprog -cover=0 -repeat=0 -procs=20 ../crash-qemu-0-1456169225187357935
2016/02/24 16:55:30 parsed 4 programs
2016/02/24 16:55:30 executed 0 programs
result: failed=false hanged=false err=failed to start executor binary: fork/exec /root/bin: permission denied
result: failed=false hanged=false err=failed to start executor binary: fork/exec /root/bin: permission denied
result: failed=false hanged=false err=failed to start executor binary: fork/exec /root/bin: permission denied

from syzkaller.

The most recent version looks for it in the CWD. But you can specify syz-executor path explicitly with:

$ ./syz-execproc -executor ./syz-executor ....

from syzkaller.

Ok, so it does indeed appear to hang, but nothing interesting in dmesg, etc..

from syzkaller.

What's the state of syz-executor processes in top/ps? If they hang in D state, then it's bad. If they are unkillable, then it is even worse.
It can also help to enable more debugging configs like CONFIG_RCU_STALL_COMMON, CONFIG_PROVE_RCU, CONFIG_WQ_WATCHDOG. Then maybe kernel will auto diagnose the issue.

from syzkaller.

To localize the offending program you can execute programs from the crash log one-by-one starting from the end. And find out which one leads to hangs.

from syzkaller.

Closing as this seems to non-actionable.
syz-repro now understands "no output" and "lost connection" crashes.

from syzkaller.