Re: [PATCH v2 0/3] [PATCH v2 0/3] [PATCH v2 0/3] net, mac80211, kernel: enable KCOV remote coverage collection for 802.11 frame handling

[Johannes Berg <johannes@sipsolutions.net>]

On Mon, 2020-10-12 at 14:18 +0300, Aleksandr Nogikh wrote:
> 
> Currently we're injecting frames via mac80211_hwsim (by pretenting to
> be wmediumd -
> https://github.com/google/syzkaller/blob/4a77ae0bdc5cd75ebe88ce7c896aae6bbf457a29/executor/common_linux.h#L4922).

Ah, ok, of course that works too :-)

> Injecting via RAW sockets would definitely be a much cleaner way, but
> to do that we need to keep a separate monitor interface. That's pretty
> hard as the fuzzer is constantly trying to break things, and direct
> injection via mac80211_hwsim seems to be a much more robust way - it
> will work as long as the virtual device is alive. hwsim0 is
> unfortunately not available as fuzzer processes are run in separate
> network namespaces, while this one is created during mac80211_hwsim
> initialization.

Oh, OK. I guess we _could_ move that also to the new namespace or
something, but if the wmediumd approach works then I think it's not
worth it.

> The current approach seems to work fine for management frames - I was
> able to create seed programs that inject valid management frames and
> these frames have the expected effect on the subsystem (e.g. injecting
> AP responses during scan/authentication/authorization forces a station
> to believe that it has successfully connected to an AP).

Great!

johannes