Received-SPF: pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Sat, 30 Jul 2022 21:21:45 +0530
From:   Siddh Raman Pant <code@siddh.me>
To:     "Lukas Bulwahn" <lukas.bulwahn@gmail.com>
Cc:     "Johannes Berg" <johannes@sipsolutions.net>,
        "David S . Miller" <davem@davemloft.net>,
        "Eric Dumazet" <edumazet@google.com>,
        "Jakub Kicinski" <kuba@kernel.org>,
        "Paolo Abeni" <pabeni@redhat.com>,
        "netdev" <netdev@vger.kernel.org>,
        "syzbot+6cb476b7c69916a0caca" 
        <syzbot+6cb476b7c69916a0caca@syzkaller.appspotmail.com>,
        "linux-wireless" <linux-wireless@vger.kernel.org>,
        "syzbot+f9acff9bf08a845f225d" 
        <syzbot+f9acff9bf08a845f225d@syzkaller.appspotmail.com>,
        "syzbot+9250865a55539d384347" 
        <syzbot+9250865a55539d384347@syzkaller.appspotmail.com>,
        "linux-kernel-mentees" 
        <linux-kernel-mentees@lists.linuxfoundation.org>
Message-ID: <1824fce6ffa.649b18b496010.5533738718445972188@siddh.me>
In-Reply-To: <CAKXUXMzeSLuH31zQDe3Q_1YAvfmFR16ZsfFGmxEMiMQSKcp_Nw@mail.gmail.com>
References: <20220721101018.17902-1-code@siddh.me> <CAKXUXMzeSLuH31zQDe3Q_1YAvfmFR16ZsfFGmxEMiMQSKcp_Nw@mail.gmail.com>
Subject: Re: [RESEND PATCH] net: Fix UAF in ieee80211_scan_rx()
MIME-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
Importance: Medium
User-Agent: Zoho Mail
Precedence: bulk

Hello Lukas,

Sorry for the late reply.

On Thu, 21 Jul 2022 16:05:01 +0530  Lukas Bulwahn <lukas.bulwahn@gmail.com> wrote:
> Siddh,
> 
> I had a look at the Bug report above. Currently, we do not have any
> syzkaller or C reproducer to confirm that the bug was actually fixed.
> 
> Now, that you have a supposed fix for the issue:
> Can you write a 'stress test' and (qemu) setup script that eventually
> makes that bug trigger (e.g., if we run the stress test for two or
> three days it will eventually trigger)? Then, we can also use that to
> confirm that your patch fixes the issue (beyond the normal sanity code
> review).
> 
> This is certainly something you can do on your side to move this patch
> forward, and other developers with testing infrastructure can pick up
> and confirm your tests and results independently.

I have been intermittently looking about this for the past few days. Since
such test creation is new to me, I am stuck at how to go about calling the
requisite function.

What I have gathered is that I need to use the netlink API or related tool
and issue the scan and recieve commands. Since qemu by default doesn't
have a WiFi interface setup by default, I was looking at simulation and
came across the mac80211_hwsim module. After building the kernel it, I
tried using `iw` command for scanning with the two phy simulated devices,
but I seem to hit a deadend due to not being able to properly use them
for the task at hand.

Do you have any resources or/and examples on such "stress tests"?

> I hope this helps, otherwise you will just need to have some patience.
> 
> Best regards,
> 
> Lukas

Eric had replied to me on the original email soon after, and I have sent
a v2. Though, I still want to see how people go about making the tests,
so any resources for further exploring will be useful.

Thanks,
Siddh