On Mon, 2020-10-12 at 14:18 +0300, Aleksandr Nogikh wrote: > > Currently we're injecting frames via mac80211_hwsim (by pretenting to > be wmediumd - > https://github.com/google/syzkaller/blob/4a77ae0bdc5cd75ebe88ce7c896aae6bbf457a29/executor/common_linux.h#L4922). Ah, ok, of course that works too :-) > Injecting via RAW sockets would definitely be a much cleaner way, but > to do that we need to keep a separate monitor interface. That's pretty > hard as the fuzzer is constantly trying to break things, and direct > injection via mac80211_hwsim seems to be a much more robust way - it > will work as long as the virtual device is alive. hwsim0 is > unfortunately not available as fuzzer processes are run in separate > network namespaces, while this one is created during mac80211_hwsim > initialization. Oh, OK. I guess we _could_ move that also to the new namespace or something, but if the wmediumd approach works then I think it's not worth it. > The current approach seems to work fine for management frames - I was > able to create seed programs that inject valid management frames and > these frames have the expected effect on the subsystem (e.g. injecting > AP responses during scan/authentication/authorization forces a station > to believe that it has successfully connected to an AP). Great! johannes
