live USB image crashes

[eboritzki-cloud]

Anytime I attempt to run the ./fragattack.py wlan0 ping command, regardless of target HW configuration or power state, I get a kernel crash.

setup: liveUSB image on a Dell laptop without internal WiFi, Alfa AWUS036ACM connected directly to USB port. targets under test are cabled directly together with coax (SMA with attenuators and a splitter to add in the Alfa adapter, the equipment under test communicates to each other correctly in this configuration).

Error: kernel dereference error address=0x00000000

top of the stack is drv_add_interface

I can't get the computer to mount a drive after the crash to save off the dmesg log.

I have seen this when running ./fragattack.py wlan0 ping --inject-test self
and when running ./fragattack.py wlan0 ping without other commands

interestingly, ./test-injection.py wlan0 works correctly

[vanhoefm]

Alfa AWUS036ACM connected directly to USB port

What if you try using a different USB port? In the past, I've had cases where a USB 2.0 port resulted in working Wi-Fi, but a USB 3.0 didn't.

What happens if you run the following command:

sudo iw wlan0 interface add wlan0mon type monitor

If that works, you can also try to enable and use this monitor interface, to see whether that reproduces the crash:

sudo ifconfig wlan0mon up
tcpdump -i wlan0mon

Also double-check that Wi-Fi is disabled in the Network Manager.

[eboritzki-cloud]

I tried everything you suggested, still get the same crash. A little more details:
demsg output:
BUG: kernel NULL pointer dereference, address: 000000000000020
#PF: supervisor write access in kernel mode
#PF: error code(0x0002) - not present page
PGD 0 P4D 0
Oops: 0002 [#1] SMP NOPTI
CPU: 20 PID: 6982 Comm: wpa_supplicant Tainted: P W OE 5.8.0-43-generic #49~20.04.1-Ubuntu
Hardware name : {hardware name}
RIP: 0010:mt76x02_add_interface+0x11f/0x170 [mt76x02_lib]
{more dumps}

[vanhoefm]

So does the crash also happen immediately after manually executing:

sudo iw wlan0 interface add wlan0mon type monitor

[eboritzki-cloud]

No, only after executing ./fragattacks.py