netdev - Re: [RESEND PATCH] net: Fix UAF in ieee80211_scan

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <1824fce6ffa.649b18b496010.5533738718445972188@siddh.me>
Date:   Sat, 30 Jul 2022 21:21:45 +0530
From:   Siddh Raman Pant <code@...dh.me>
To:     "Lukas Bulwahn" <lukas.bulwahn@...il.com>
Cc:     "Johannes Berg" <johannes@...solutions.net>,
        "David S . Miller" <davem@...emloft.net>,
        "Eric Dumazet" <edumazet@...gle.com>,
        "Jakub Kicinski" <kuba@...nel.org>,
        "Paolo Abeni" <pabeni@...hat.com>,
        "netdev" <netdev@...r.kernel.org>,
        "syzbot+6cb476b7c69916a0caca" 
        <syzbot+6cb476b7c69916a0caca@...kaller.appspotmail.com>,
        "linux-wireless" <linux-wireless@...r.kernel.org>,
        "syzbot+f9acff9bf08a845f225d" 
        <syzbot+f9acff9bf08a845f225d@...kaller.appspotmail.com>,
        "syzbot+9250865a55539d384347" 
        <syzbot+9250865a55539d384347@...kaller.appspotmail.com>,
        "linux-kernel-mentees" 
        <linux-kernel-mentees@...ts.linuxfoundation.org>
Subject: Re: [RESEND PATCH] net: Fix UAF in ieee80211_scan_rx()

Hello Lukas,

Sorry for the late reply.

On Thu, 21 Jul 2022 16:05:01 +0530  Lukas Bulwahn <lukas.bulwahn@...il.com> wrote:
> Siddh,
> 
> I had a look at the Bug report above. Currently, we do not have any
> syzkaller or C reproducer to confirm that the bug was actually fixed.
> 
> Now, that you have a supposed fix for the issue:
> Can you write a 'stress test' and (qemu) setup script that eventually
> makes that bug trigger (e.g., if we run the stress test for two or
> three days it will eventually trigger)? Then, we can also use that to
> confirm that your patch fixes the issue (beyond the normal sanity code
> review).
> 
> This is certainly something you can do on your side to move this patch
> forward, and other developers with testing infrastructure can pick up
> and confirm your tests and results independently.

I have been intermittently looking about this for the past few days. Since
such test creation is new to me, I am stuck at how to go about calling the
requisite function.

What I have gathered is that I need to use the netlink API or related tool
and issue the scan and recieve commands. Since qemu by default doesn't
have a WiFi interface setup by default, I was looking at simulation and
came across the mac80211_hwsim module. After building the kernel it, I
tried using `iw` command for scanning with the two phy simulated devices,
but I seem to hit a deadend due to not being able to properly use them
for the task at hand.

Do you have any resources or/and examples on such "stress tests"?

> I hope this helps, otherwise you will just need to have some patience.
> 
> Best regards,
> 
> Lukas

Eric had replied to me on the original email soon after, and I have sent
a v2. Though, I still want to see how people go about making the tests,
so any resources for further exploring will be useful.

Thanks,
Siddh