executor: support wifi subsystem fuzzing on FreeBSD

[estarriol43]

Use wtap devices, a wlan simulator, to inject raw frames into 802.11 stack in FreeBSD to fuzz WiFi subsystem.

Some known issues:
The coverage of this new pseudo syscall for FreeBSD is quite low compared to the Linux one. (~2000 LoC in FreeBSD, while ~20000 LoC in Linux). I think there may be some room for improvement.

Any suggestions are welcom!

[a-nogikh]

Please note the CI errors. Specifically,

Error: The file is not formatted/regenerated. Run 'make generate' and include it into the commit.

[estarriol43]

Thanks for your reviewing. I've fixed the formatting error according to the presubmit hook.

[a-nogikh]

It's still not happy.

executor/common_bsd.h:1:1: The file is not formatted/regenerated. Run 'make generate' and include it into the commit.
Error: The file is not formatted/regenerated. Run 'make generate' and include it into the commit.

FWIW it's better to run the command from under the syz-env container to ensure that it formats the files using the same tool versions. E.g. ./tools/syz-env make generate.

[estarriol43]

I re-checked the format using syz-env on Linux. The FreeBSD toolchain somehow produces a different result than Linux.

[markjdb]

Thanks, I'll try to test this in the coming days.

Has this produced any results (i.e., kernel crashes) for you? Do you have some evidence that it's sufficient to get decent code coverage in the net80211 stack?

[estarriol43]

I haven't found any bugs related to the net80211 stack with this patch. The coverage of this new pseudo syscall for FreeBSD is quite low compared to Linux. (~2000 LoC in FreeBSD, while ~20000 LoC in Linux).

However, Syzkaller doesn't fully support all coverage features on FreeBSD yet. It can only check how many lines of code, not which part of the code, so it would be difficult to debug this new pseudo syscall.

[khanzf]

Hi,
Is there an order of how we want to test this? For example, frames get injected into ieee80211_input_*(), are we targetting a specific parser? Or list of sub-functions?

I think enumerating what to target might be useful.