Re: WiFi stack fuzzing status report

2025-05-15 Thread Jian-Lin Li
Hi Farhan Khan, The idea is to use Syzkaller, a kernel fuzzer, to fuzz the WiFi stack. Syzkaller will randomly generate 802.11 frames and inject them using the syz_80211_inject_frame syscall. You can follow the write-up to set up the environment. https://hackmd.io/byPgVrEwRWSA5LKc56-30Q --

Re: WiFi stack fuzzing status report

2025-05-14 Thread Farhan Khan
On Wed, May 14, 2025, at 10:27 AM, Jian-Lin Li wrote: > Hi Tom, > > I think we can start by improving the coverage information, so we can > identify which parts of the code have been fuzzed. Currently, Syzkaller > can only report how many lines of code are covered, but not which > specific parts

Re: WiFi stack fuzzing status report

2025-05-14 Thread Jian-Lin Li
Hi Tom, I think we can start by improving the coverage information, so we can identify which parts of the code have been fuzzed. Currently, Syzkaller can only report how many lines of code are covered, but not which specific parts. The coverage functionality is implemented by the make function

Re: WiFi stack fuzzing status report

2025-05-13 Thread Tom Jones
On Tue, May 13, 2025, at 17:31, Jian-Lin Li 李建霖 wrote: > Hi All, > > PR: https://github.com/google/syzkaller/pull/5992 > > This PR aims to improve the support of Syzkaller on FreeBSD. Based on > the existing WiFi fuzzer designed for Linux, we drafted a new WiFi > fuzzer for FreeBSD. We used wt

WiFi stack fuzzing status report

2025-05-13 Thread Jian-Lin Li 李建霖
Hi All, PR: https://github.com/google/syzkaller/pull/5992 This PR aims to improve the support of Syzkaller on FreeBSD. Based on the existing WiFi fuzzer designed for Linux, we drafted a new WiFi fuzzer for FreeBSD. We used wtap, a virtual wifi driver for testing, to support WiFi fuzzing. Th