AI Trajectory

null

{
  "EnableConfigs": [
    "BRCMFMAC",
    "BRCMFMAC_USB"
  ],
  "FocusSymbols": [
    "brcmf_cfg80211_connect",
    "brcmf_cfg80211_start_ap",
    "brcmf_p2p_send_action_frame"
  ],
  "Reasoning": "This patch adds support for DPP (Device Provisioning Protocol) AKM and action frames in the Broadcom brcmfmac driver. It modifies connection logic, AP security configuration, and P2P action frame handling. The driver can be fuzzed via USB emulation, so it is worth fuzzing.",
  "WorthFuzzing": true
}

null

{
  "PatchDiff": "commit bf8d9c3de7fc85bec506904c51309a65e95e11d6\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Wed Jul 8 18:19:44 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c\nindex 4b70845e1a2643..d61c3e03a106a5 100644\n--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c\n+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c\n@@ -8,6 +8,7 @@\n #include \u003clinux/kernel.h\u003e\n #include \u003clinux/etherdevice.h\u003e\n #include \u003clinux/module.h\u003e\n+#include \u003clinux/unaligned.h\u003e\n #include \u003clinux/vmalloc.h\u003e\n #include \u003cnet/cfg80211.h\u003e\n #include \u003cnet/netlink.h\u003e\n@@ -2154,6 +2155,9 @@ brcmf_set_key_mgmt(struct net_device *ndev, struct cfg80211_connect_params *sme)\n \t\t\tval = WPA2_AUTH_PSK | WPA2_AUTH_FT;\n \t\t\tprofile-\u003eis_ft = true;\n \t\t\tbreak;\n+\t\tcase WLAN_AKM_SUITE_WFA_DPP:\n+\t\t\tval = WFA_AUTH_DPP;\n+\t\t\tbreak;\n \t\tdefault:\n \t\t\tbphy_err(drvr, \"invalid akm suite (%d)\\n\",\n \t\t\t\t sme-\u003ecrypto.akm_suites[0]);\n@@ -2466,43 +2470,50 @@ brcmf_cfg80211_connect(struct wiphy *wiphy, struct net_device *ndev,\n \t\tgoto done;\n \t}\n \n-\tif (sme-\u003ecrypto.psk \u0026\u0026\n-\t    profile-\u003euse_fwsup != BRCMF_PROFILE_FWSUP_SAE) {\n-\t\tif (WARN_ON(profile-\u003euse_fwsup != BRCMF_PROFILE_FWSUP_NONE)) {\n-\t\t\terr = -EINVAL;\n-\t\t\tgoto done;\n-\t\t}\n-\t\tbrcmf_dbg(INFO, \"using PSK offload\\n\");\n-\t\tprofile-\u003euse_fwsup = BRCMF_PROFILE_FWSUP_PSK;\n-\t}\n-\n-\tif (profile-\u003euse_fwsup != BRCMF_PROFILE_FWSUP_NONE) {\n-\t\t/* enable firmware supplicant for this interface */\n-\t\terr = brcmf_fil_iovar_int_set(ifp, \"sup_wpa\", 1);\n-\t\tif (err \u003c 0) {\n-\t\t\tbphy_err(drvr, \"failed to enable fw supplicant\\n\");\n-\t\t\tgoto done;\n+\tif (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_FWSUP)) {\n+\t\tu32 akm = sme-\u003ecrypto.n_akm_suites ? sme-\u003ecrypto.akm_suites[0] : 0;\n+\t\tbool is_sae_akm = akm == WLAN_AKM_SUITE_SAE ||\n+\t\t\takm == WLAN_AKM_SUITE_FT_OVER_SAE;\n+\n+\t\tif (sme-\u003ecrypto.psk \u0026\u0026 !is_sae_akm \u0026\u0026\n+\t\t    profile-\u003euse_fwsup != BRCMF_PROFILE_FWSUP_SAE) {\n+\t\t\tif (WARN_ON(profile-\u003euse_fwsup !=\n+\t\t\t\t    BRCMF_PROFILE_FWSUP_NONE)) {\n+\t\t\t\terr = -EINVAL;\n+\t\t\t\tgoto done;\n+\t\t\t}\n+\t\t\tbrcmf_dbg(INFO, \"using PSK offload\\n\");\n+\t\t\tprofile-\u003euse_fwsup = BRCMF_PROFILE_FWSUP_PSK;\n \t\t}\n-\t}\n-\n-\tif (profile-\u003euse_fwsup == BRCMF_PROFILE_FWSUP_PSK)\n-\t\terr = brcmf_set_pmk(ifp, sme-\u003ecrypto.psk,\n-\t\t\t\t    BRCMF_WSEC_MAX_PSK_LEN);\n-\telse if (profile-\u003euse_fwsup == BRCMF_PROFILE_FWSUP_SAE) {\n-\t\t/* clean up user-space RSNE */\n-\t\terr = brcmf_fil_iovar_data_set(ifp, \"wpaie\", NULL, 0);\n-\t\tif (err) {\n-\t\t\tbphy_err(drvr, \"failed to clean up user-space RSNE\\n\");\n-\t\t\tgoto done;\n+\t\tif (profile-\u003euse_fwsup != BRCMF_PROFILE_FWSUP_NONE) {\n+\t\t\t/* enable firmware supplicant for this interface */\n+\t\t\terr = brcmf_fil_iovar_int_set(ifp, \"sup_wpa\", 1);\n+\t\t\tif (err \u003c 0) {\n+\t\t\t\tbphy_err(drvr, \"failed to enable fw supplicant\\n\");\n+\t\t\t\tgoto done;\n+\t\t\t}\n+\t\t} else {\n+\t\t\terr = brcmf_fil_iovar_int_set(ifp, \"sup_wpa\", 0);\n \t\t}\n-\t\terr = brcmf_fwvid_set_sae_password(ifp, \u0026sme-\u003ecrypto);\n-\t\tif (!err \u0026\u0026 sme-\u003ecrypto.psk)\n+\t\tif (profile-\u003euse_fwsup == BRCMF_PROFILE_FWSUP_PSK)\n \t\t\terr = brcmf_set_pmk(ifp, sme-\u003ecrypto.psk,\n \t\t\t\t\t    BRCMF_WSEC_MAX_PSK_LEN);\n+\t\telse if (profile-\u003euse_fwsup == BRCMF_PROFILE_FWSUP_SAE \u0026\u0026\n+\t\t\t sme-\u003ecrypto.sae_pwd \u0026\u0026\n+\t\t\t brcmf_feat_is_enabled(ifp, BRCMF_FEAT_SAE)) {\n+\t\t\t/* clean up user-space RSNE */\n+\t\t\tif (brcmf_fil_iovar_data_set(ifp, \"wpaie\", NULL, 0)) {\n+\t\t\t\tbphy_err(drvr, \"failed to clean up user-space RSNE\\n\");\n+\t\t\t\tgoto done;\n+\t\t\t}\n+\t\t\terr = brcmf_fwvid_set_sae_password(ifp, \u0026sme-\u003ecrypto);\n+\t\t\tif (!err \u0026\u0026 sme-\u003ecrypto.psk)\n+\t\t\t\terr = brcmf_set_pmk(ifp, sme-\u003ecrypto.psk,\n+\t\t\t\t\t\t    BRCMF_WSEC_MAX_PSK_LEN);\n+\t\t}\n+\t\tif (err)\n+\t\t\tgoto done;\n \t}\n-\tif (err)\n-\t\tgoto done;\n-\n \t/* Join with specific BSSID and cached SSID\n \t * If SSID is zero join based on BSSID only\n \t */\n@@ -4519,6 +4530,11 @@ static bool brcmf_valid_wpa_oui(u8 *oui, bool is_rsn_ie)\n \treturn (memcmp(oui, WPA_OUI, TLV_OUI_LEN) == 0);\n }\n \n+static bool brcmf_valid_dpp_suite(u8 *oui)\n+{\n+\treturn get_unaligned_be32(oui) == WLAN_AKM_SUITE_WFA_DPP;\n+}\n+\n static s32\n brcmf_configure_wpaie(struct brcmf_if *ifp,\n \t\t      const struct brcmf_vs_tlv *wpa_ie,\n@@ -4632,42 +4648,47 @@ brcmf_configure_wpaie(struct brcmf_if *ifp,\n \t\tgoto exit;\n \t}\n \tfor (i = 0; i \u003c count; i++) {\n-\t\tif (!brcmf_valid_wpa_oui(\u0026data[offset], is_rsn_ie)) {\n+\t\tif (brcmf_valid_dpp_suite(\u0026data[offset])) {\n+\t\t\twpa_auth |= WFA_AUTH_DPP;\n+\t\t\toffset += TLV_OUI_LEN;\n+\t\t} else if (brcmf_valid_wpa_oui(\u0026data[offset], is_rsn_ie)) {\n+\t\t\toffset += TLV_OUI_LEN;\n+\t\t\tswitch (data[offset]) {\n+\t\t\tcase RSN_AKM_NONE:\n+\t\t\t\tbrcmf_dbg(TRACE, \"RSN_AKM_NONE\\n\");\n+\t\t\t\twpa_auth |= WPA_AUTH_NONE;\n+\t\t\t\tbreak;\n+\t\t\tcase RSN_AKM_UNSPECIFIED:\n+\t\t\t\tbrcmf_dbg(TRACE, \"RSN_AKM_UNSPECIFIED\\n\");\n+\t\t\t\tis_rsn_ie ?\n+\t\t\t\t\t(wpa_auth |= WPA2_AUTH_UNSPECIFIED) :\n+\t\t\t\t\t(wpa_auth |= WPA_AUTH_UNSPECIFIED);\n+\t\t\t\tbreak;\n+\t\t\tcase RSN_AKM_PSK:\n+\t\t\t\tbrcmf_dbg(TRACE, \"RSN_AKM_PSK\\n\");\n+\t\t\t\tis_rsn_ie ? (wpa_auth |= WPA2_AUTH_PSK) :\n+\t\t\t\t\t    (wpa_auth |= WPA_AUTH_PSK);\n+\t\t\t\tbreak;\n+\t\t\tcase RSN_AKM_SHA256_PSK:\n+\t\t\t\tbrcmf_dbg(TRACE, \"RSN_AKM_MFP_PSK\\n\");\n+\t\t\t\twpa_auth |= WPA2_AUTH_PSK_SHA256;\n+\t\t\t\tbreak;\n+\t\t\tcase RSN_AKM_SHA256_1X:\n+\t\t\t\tbrcmf_dbg(TRACE, \"RSN_AKM_MFP_1X\\n\");\n+\t\t\t\twpa_auth |= WPA2_AUTH_1X_SHA256;\n+\t\t\t\tbreak;\n+\t\t\tcase RSN_AKM_SAE:\n+\t\t\t\tbrcmf_dbg(TRACE, \"RSN_AKM_SAE\\n\");\n+\t\t\t\twpa_auth |= WPA3_AUTH_SAE_PSK;\n+\t\t\t\tbreak;\n+\t\t\tdefault:\n+\t\t\t\tbphy_err(drvr, \"Invalid key mgmt info\\n\");\n+\t\t\t}\n+\t\t} else {\n \t\t\terr = -EINVAL;\n \t\t\tbphy_err(drvr, \"invalid OUI\\n\");\n \t\t\tgoto exit;\n \t\t}\n-\t\toffset += TLV_OUI_LEN;\n-\t\tswitch (data[offset]) {\n-\t\tcase RSN_AKM_NONE:\n-\t\t\tbrcmf_dbg(TRACE, \"RSN_AKM_NONE\\n\");\n-\t\t\twpa_auth |= WPA_AUTH_NONE;\n-\t\t\tbreak;\n-\t\tcase RSN_AKM_UNSPECIFIED:\n-\t\t\tbrcmf_dbg(TRACE, \"RSN_AKM_UNSPECIFIED\\n\");\n-\t\t\tis_rsn_ie ? (wpa_auth |= WPA2_AUTH_UNSPECIFIED) :\n-\t\t\t\t    (wpa_auth |= WPA_AUTH_UNSPECIFIED);\n-\t\t\tbreak;\n-\t\tcase RSN_AKM_PSK:\n-\t\t\tbrcmf_dbg(TRACE, \"RSN_AKM_PSK\\n\");\n-\t\t\tis_rsn_ie ? (wpa_auth |= WPA2_AUTH_PSK) :\n-\t\t\t\t    (wpa_auth |= WPA_AUTH_PSK);\n-\t\t\tbreak;\n-\t\tcase RSN_AKM_SHA256_PSK:\n-\t\t\tbrcmf_dbg(TRACE, \"RSN_AKM_MFP_PSK\\n\");\n-\t\t\twpa_auth |= WPA2_AUTH_PSK_SHA256;\n-\t\t\tbreak;\n-\t\tcase RSN_AKM_SHA256_1X:\n-\t\t\tbrcmf_dbg(TRACE, \"RSN_AKM_MFP_1X\\n\");\n-\t\t\twpa_auth |= WPA2_AUTH_1X_SHA256;\n-\t\t\tbreak;\n-\t\tcase RSN_AKM_SAE:\n-\t\t\tbrcmf_dbg(TRACE, \"RSN_AKM_SAE\\n\");\n-\t\t\twpa_auth |= WPA3_AUTH_SAE_PSK;\n-\t\t\tbreak;\n-\t\tdefault:\n-\t\t\tbphy_err(drvr, \"Invalid key mgmt info\\n\");\n-\t\t}\n \t\toffset++;\n \t}\n \n@@ -4687,10 +4708,12 @@ brcmf_configure_wpaie(struct brcmf_if *ifp,\n \t\t\t\t */\n \t\t\t\tif (!(wpa_auth \u0026 (WPA2_AUTH_PSK_SHA256 |\n \t\t\t\t\t\t  WPA2_AUTH_1X_SHA256 |\n+\t\t\t\t\t\t  WFA_AUTH_DPP |\n \t\t\t\t\t\t  WPA3_AUTH_SAE_PSK))) {\n \t\t\t\t\terr = -EINVAL;\n \t\t\t\t\tgoto exit;\n \t\t\t\t}\n+\n \t\t\t\t/* Firmware has requirement that WPA2_AUTH_PSK/\n \t\t\t\t * WPA2_AUTH_UNSPECIFIED be set, if SHA256 OUI\n \t\t\t\t * is to be included in the rsn ie.\ndiff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c\nindex 6e0c90f4718b58..2c1f52ed513800 100644\n--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c\n+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c\n@@ -6,6 +6,7 @@\n #include \u003clinux/netdevice.h\u003e\n #include \u003clinux/etherdevice.h\u003e\n #include \u003clinux/rtnetlink.h\u003e\n+#include \u003clinux/unaligned.h\u003e\n #include \u003cnet/cfg80211.h\u003e\n \n #include \u003cbrcmu_wifi.h\u003e\n@@ -44,9 +45,6 @@\n \n #define BRCMF_SCB_TIMEOUT_VALUE\t20\n \n-#define P2P_VER\t\t\t9\t/* P2P version: 9=WiFi P2P v1.0 */\n-#define P2P_PUB_AF_CATEGORY\t0x04\n-#define P2P_PUB_AF_ACTION\t0x09\n #define P2P_AF_CATEGORY\t\t0x7f\n #define P2P_OUI\t\t\t\"\\x50\\x6F\\x9A\"\t/* P2P OUI */\n #define P2P_OUI_LEN\t\t3\t\t/* P2P OUI length */\n@@ -143,10 +141,10 @@ struct brcmf_p2p_scan_le {\n /**\n  * struct brcmf_p2p_pub_act_frame - WiFi P2P Public Action Frame\n  *\n- * @category: P2P_PUB_AF_CATEGORY\n- * @action: P2P_PUB_AF_ACTION\n+ * @category: WLAN_CATEGORY_PUBLIC\n+ * @action: WLAN_PUB_ACTION_VENDOR_SPECIFIC\n  * @oui: P2P_OUI\n- * @oui_type: OUI type - P2P_VER\n+ * @oui_type: OUI type - WLAN_OUI_TYPE_WFA_P2P\n  * @subtype: OUI subtype - P2P_TYPE_*\n  * @dialog_token: nonzero, identifies req/rsp transaction\n  * @elts: Variable length information elements.\n@@ -166,7 +164,7 @@ struct brcmf_p2p_pub_act_frame {\n  *\n  * @category: P2P_AF_CATEGORY\n  * @oui: OUI - P2P_OUI\n- * @type: OUI Type - P2P_VER\n+ * @type: OUI Type - WLAN_OUI_TYPE_WFA_P2P\n  * @subtype: OUI Subtype - P2P_AF_*\n  * @dialog_token: nonzero, identifies req/resp tranaction\n  * @elts: Variable length information elements.\n@@ -228,10 +226,38 @@ static bool brcmf_p2p_is_pub_action(void *frame, u32 frame_len)\n \tif (frame_len \u003c sizeof(*pact_frm))\n \t\treturn false;\n \n-\tif (pact_frm-\u003ecategory == P2P_PUB_AF_CATEGORY \u0026\u0026\n-\t    pact_frm-\u003eaction == P2P_PUB_AF_ACTION \u0026\u0026\n-\t    pact_frm-\u003eoui_type == P2P_VER \u0026\u0026\n-\t    memcmp(pact_frm-\u003eoui, P2P_OUI, P2P_OUI_LEN) == 0)\n+\tif (pact_frm-\u003ecategory == WLAN_CATEGORY_PUBLIC \u0026\u0026\n+\t    pact_frm-\u003eaction == WLAN_PUB_ACTION_VENDOR_SPECIFIC \u0026\u0026\n+\t    pact_frm-\u003eoui_type == WLAN_OUI_TYPE_WFA_P2P \u0026\u0026\n+\t    get_unaligned_be24(pact_frm-\u003eoui) == WLAN_OUI_WFA)\n+\t\treturn true;\n+\n+\treturn false;\n+}\n+\n+/**\n+ * brcmf_p2p_is_dpp_pub_action() - true if dpp public type frame.\n+ *\n+ * @frame: action frame data.\n+ * @frame_len: length of action frame data.\n+ *\n+ * Determine if action frame is dpp public action type\n+ */\n+static bool brcmf_p2p_is_dpp_pub_action(void *frame, u32 frame_len)\n+{\n+\tstruct brcmf_p2p_pub_act_frame *pact_frm;\n+\n+\tif (!frame)\n+\t\treturn false;\n+\n+\tpact_frm = (struct brcmf_p2p_pub_act_frame *)frame;\n+\tif (frame_len \u003c sizeof(struct brcmf_p2p_pub_act_frame) - 1)\n+\t\treturn false;\n+\n+\tif (pact_frm-\u003ecategory == WLAN_CATEGORY_PUBLIC \u0026\u0026\n+\t    pact_frm-\u003eaction == WLAN_PUB_ACTION_VENDOR_SPECIFIC \u0026\u0026\n+\t    pact_frm-\u003eoui_type == WLAN_OUI_TYPE_WFA_DPP \u0026\u0026\n+\t    get_unaligned_be24(pact_frm-\u003eoui) == WLAN_OUI_WFA)\n \t\treturn true;\n \n \treturn false;\n@@ -257,7 +283,7 @@ static bool brcmf_p2p_is_p2p_action(void *frame, u32 frame_len)\n \t\treturn false;\n \n \tif (act_frm-\u003ecategory == P2P_AF_CATEGORY \u0026\u0026\n-\t    act_frm-\u003etype  == P2P_VER \u0026\u0026\n+\t    act_frm-\u003etype  == WLAN_OUI_TYPE_WFA_P2P \u0026\u0026\n \t    memcmp(act_frm-\u003eoui, P2P_OUI, P2P_OUI_LEN) == 0)\n \t\treturn true;\n \n@@ -1281,6 +1307,9 @@ static s32 brcmf_p2p_abort_action_frame(struct brcmf_cfg80211_info *cfg)\n \tbrcmf_dbg(TRACE, \"Enter\\n\");\n \n \tvif = p2p-\u003ebss_idx[P2PAPI_BSSCFG_DEVICE].vif;\n+\tif (!vif)\n+\t\tvif = p2p-\u003ebss_idx[P2PAPI_BSSCFG_PRIMARY].vif;\n+\n \terr = brcmf_fil_bsscfg_data_set(vif-\u003eifp, \"actframe_abort\", \u0026int_val,\n \t\t\t\t\tsizeof(s32));\n \tif (err)\n@@ -1789,7 +1818,9 @@ bool brcmf_p2p_send_action_frame(struct brcmf_cfg80211_info *cfg,\n \t\t\tgoto exit;\n \t\t}\n \t} else if (brcmf_p2p_is_p2p_action(action_frame-\u003edata,\n-\t\t\t\t\t   action_frame_len)) {\n+\t\t\t\t\t   action_frame_len) ||\n+\t\t   brcmf_p2p_is_dpp_pub_action(action_frame-\u003edata,\n+\t\t\t\t\t       action_frame_len)) {\n \t\t/* do not configure anything. it will be */\n \t\t/* sent with a default configuration     */\n \t} else {\n@@ -1826,6 +1857,7 @@ bool brcmf_p2p_send_action_frame(struct brcmf_cfg80211_info *cfg,\n \t/* validate channel and p2p ies */\n \tif (config_af_params.search_channel \u0026\u0026\n \t    IS_P2P_SOCIAL_CHANNEL(le32_to_cpu(af_params-\u003echannel)) \u0026\u0026\n+\t    p2p-\u003ebss_idx[P2PAPI_BSSCFG_DEVICE].vif \u0026\u0026\n \t    p2p-\u003ebss_idx[P2PAPI_BSSCFG_DEVICE].vif-\u003esaved_ie.probe_req_ie_len) {\n \t\tafx_hdl = \u0026p2p-\u003eafx_hdl;\n \t\tafx_hdl-\u003epeer_listen_chan = le32_to_cpu(af_params-\u003echannel);\n@@ -2543,4 +2575,3 @@ void brcmf_p2p_detach(struct brcmf_p2p_info *p2p)\n \t/* just set it all to zero */\n \tmemset(p2p, 0, sizeof(*p2p));\n }\n-\ndiff --git a/drivers/net/wireless/broadcom/brcm80211/include/brcmu_wifi.h b/drivers/net/wireless/broadcom/brcm80211/include/brcmu_wifi.h\nindex 7552bdb91991ce..c465208c433182 100644\n--- a/drivers/net/wireless/broadcom/brcm80211/include/brcmu_wifi.h\n+++ b/drivers/net/wireless/broadcom/brcm80211/include/brcmu_wifi.h\n@@ -233,6 +233,8 @@ static inline bool ac_bitmap_tst(u8 bitmap, int prec)\n \n #define WPA3_AUTH_SAE_PSK\t0x40000\t/* SAE with 4-way handshake */\n \n+#define WFA_AUTH_DPP\t\t0x200000 /* WFA DPP AUTH */\n+\n #define DOT11_DEFAULT_RTS_LEN\t\t2347\n #define DOT11_DEFAULT_FRAG_LEN\t\t2346\n \n"
}

gemini-3.1-pro-preview

null

{
  "EnableConfigs": [
    "BRCMFMAC",
    "BRCMFMAC_USB"
  ],
  "FocusSymbols": [
    "brcmf_cfg80211_connect",
    "brcmf_cfg80211_start_ap",
    "brcmf_p2p_send_action_frame"
  ],
  "Reasoning": "This patch adds support for DPP (Device Provisioning Protocol) AKM and action frames in the Broadcom brcmfmac driver. It modifies connection logic, AP security configuration, and P2P action frame handling. The driver can be fuzzed via USB emulation, so it is worth fuzzing.",
  "WorthFuzzing": true
}

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Do not list too generic configs (we already have them enabled). Only list those that
   specifically cover the modified code. List them in the EnableConfigs output array,
   and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit bf8d9c3de7fc85bec506904c51309a65e95e11d6
Author: syz-cluster <triage@syzkaller.com>
Date:   Wed Jul 8 18:19:44 2026 +0000

    syz-cluster: applied patch under review

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
index 4b70845e1a2643..d61c3e03a106a5 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
@@ -8,6 +8,7 @@
 #include <linux/kernel.h>
 #include <linux/etherdevice.h>
 #include <linux/module.h>
+#include <linux/unaligned.h>
 #include <linux/vmalloc.h>
 #include <net/cfg80211.h>
 #include <net/netlink.h>
@@ -2154,6 +2155,9 @@ brcmf_set_key_mgmt(struct net_device *ndev, struct cfg80211_connect_params *sme)
 			val = WPA2_AUTH_PSK | WPA2_AUTH_FT;
 			profile->is_ft = true;
 			break;
+		case WLAN_AKM_SUITE_WFA_DPP:
+			val = WFA_AUTH_DPP;
+			break;
 		default:
 			bphy_err(drvr, "invalid akm suite (%d)\n",
 				 sme->crypto.akm_suites[0]);
@@ -2466,43 +2470,50 @@ brcmf_cfg80211_connect(struct wiphy *wiphy, struct net_device *ndev,
 		goto done;
 	}
 
-	if (sme->crypto.psk &&
-	    profile->use_fwsup != BRCMF_PROFILE_FWSUP_SAE) {
-		if (WARN_ON(profile->use_fwsup != BRCMF_PROFILE_FWSUP_NONE)) {
-			err = -EINVAL;
-			goto done;
-		}
-		brcmf_dbg(INFO, "using PSK offload\n");
-		profile->use_fwsup = BRCMF_PROFILE_FWSUP_PSK;
-	}
-
-	if (profile->use_fwsup != BRCMF_PROFILE_FWSUP_NONE) {
-		/* enable firmware supplicant for this interface */
-		err = brcmf_fil_iovar_int_set(ifp, "sup_wpa", 1);
-		if (err < 0) {
-			bphy_err(drvr, "failed to enable fw supplicant\n");
-			goto done;
+	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_FWSUP)) {
+		u32 akm = sme->crypto.n_akm_suites ? sme->crypto.akm_suites[0] : 0;
+		bool is_sae_akm = akm == WLAN_AKM_SUITE_SAE ||
+			akm == WLAN_AKM_SUITE_FT_OVER_SAE;
+
+		if (sme->crypto.psk && !is_sae_akm &&
+		    profile->use_fwsup != BRCMF_PROFILE_FWSUP_SAE) {
+			if (WARN_ON(profile->use_fwsup !=
+				    BRCMF_PROFILE_FWSUP_NONE)) {
+				err = -EINVAL;
+				goto done;
+			}
+			brcmf_dbg(INFO, "using PSK offload\n");
+			profile->use_fwsup = BRCMF_PROFILE_FWSUP_PSK;
 		}
-	}
-
-	if (profile->use_fwsup == BRCMF_PROFILE_FWSUP_PSK)
-		err = brcmf_set_pmk(ifp, sme->crypto.psk,
-				    BRCMF_WSEC_MAX_PSK_LEN);
-	else if (profile->use_fwsup == BRCMF_PROFILE_FWSUP_SAE) {
-		/* clean up user-space RSNE */
-		err = brcmf_fil_iovar_data_set(ifp, "wpaie", NULL, 0);
-		if (err) {
-			bphy_err(drvr, "failed to clean up user-space RSNE\n");
-			goto done;
+		if (profile->use_fwsup != BRCMF_PROFILE_FWSUP_NONE) {
+			/* enable firmware supplicant for this interface */
+			err = brcmf_fil_iovar_int_set(ifp, "sup_wpa", 1);
+			if (err < 0) {
+				bphy_err(drvr, "failed to enable fw supplicant\n");
+				goto done;
+			}
+		} else {
+			err = brcmf_fil_iovar_int_set(ifp, "sup_wpa", 0);
 		}
-		err = brcmf_fwvid_set_sae_password(ifp, &sme->crypto);
-		if (!err && sme->crypto.psk)
+		if (profile->use_fwsup == BRCMF_PROFILE_FWSUP_PSK)
 			err = brcmf_set_pmk(ifp, sme->crypto.psk,
 					    BRCMF_WSEC_MAX_PSK_LEN);
+		else if (profile->use_fwsup == BRCMF_PROFILE_FWSUP_SAE &&
+			 sme->crypto.sae_pwd &&
+			 brcmf_feat_is_enabled(ifp, BRCMF_FEAT_SAE)) {
+			/* clean up user-space RSNE */
+			if (brcmf_fil_iovar_data_set(ifp, "wpaie", NULL, 0)) {
+				bphy_err(drvr, "failed to clean up user-space RSNE\n");
+				goto done;
+			}
+			err = brcmf_fwvid_set_sae_password(ifp, &sme->crypto);
+			if (!err && sme->crypto.psk)
+				err = brcmf_set_pmk(ifp, sme->crypto.psk,
+						    BRCMF_WSEC_MAX_PSK_LEN);
+		}
+		if (err)
+			goto done;
 	}
-	if (err)
-		goto done;
-
 	/* Join with specific BSSID and cached SSID
 	 * If SSID is zero join based on BSSID only
 	 */
@@ -4519,6 +4530,11 @@ static bool brcmf_valid_wpa_oui(u8 *oui, bool is_rsn_ie)
 	return (memcmp(oui, WPA_OUI, TLV_OUI_LEN) == 0);
 }
 
+static bool brcmf_valid_dpp_suite(u8 *oui)
+{
+	return get_unaligned_be32(oui) == WLAN_AKM_SUITE_WFA_DPP;
+}
+
 static s32
 brcmf_configure_wpaie(struct brcmf_if *ifp,
 		      const struct brcmf_vs_tlv *wpa_ie,
@@ -4632,42 +4648,47 @@ brcmf_configure_wpaie(struct brcmf_if *ifp,
 		goto exit;
 	}
 	for (i = 0; i < count; i++) {
-		if (!brcmf_valid_wpa_oui(&data[offset], is_rsn_ie)) {
+		if (brcmf_valid_dpp_suite(&data[offset])) {
+			wpa_auth |= WFA_AUTH_DPP;
+			offset += TLV_OUI_LEN;
+		} else if (brcmf_valid_wpa_oui(&data[offset], is_rsn_ie)) {
+			offset += TLV_OUI_LEN;
+			switch (data[offset]) {
+			case RSN_AKM_NONE:
+				brcmf_dbg(TRACE, "RSN_AKM_NONE\n");
+				wpa_auth |= WPA_AUTH_NONE;
+				break;
+			case RSN_AKM_UNSPECIFIED:
+				brcmf_dbg(TRACE, "RSN_AKM_UNSPECIFIED\n");
+				is_rsn_ie ?
+					(wpa_auth |= WPA2_AUTH_UNSPECIFIED) :
+					(wpa_auth |= WPA_AUTH_UNSPECIFIED);
+				break;
+			case RSN_AKM_PSK:
+				brcmf_dbg(TRACE, "RSN_AKM_PSK\n");
+				is_rsn_ie ? (wpa_auth |= WPA2_AUTH_PSK) :
+					    (wpa_auth |= WPA_AUTH_PSK);
+				break;
+			case RSN_AKM_SHA256_PSK:
+				brcmf_dbg(TRACE, "RSN_AKM_MFP_PSK\n");
+				wpa_auth |= WPA2_AUTH_PSK_SHA256;
+				break;
+			case RSN_AKM_SHA256_1X:
+				brcmf_dbg(TRACE, "RSN_AKM_MFP_1X\n");
+				wpa_auth |= WPA2_AUTH_1X_SHA256;
+				break;
+			case RSN_AKM_SAE:
+				brcmf_dbg(TRACE, "RSN_AKM_SAE\n");
+				wpa_auth |= WPA3_AUTH_SAE_PSK;
+				break;
+			default:
+				bphy_err(drvr, "Invalid key mgmt info\n");
+			}
+		} else {
 			err = -EINVAL;
 			bphy_err(drvr, "invalid OUI\n");
 			goto exit;
 		}
-		offset += TLV_OUI_LEN;
-		switch (data[offset]) {
-		case RSN_AKM_NONE:
-			brcmf_dbg(TRACE, "RSN_AKM_NONE\n");
-			wpa_auth |= WPA_AUTH_NONE;
-			break;
-		case RSN_AKM_UNSPECIFIED:
-			brcmf_dbg(TRACE, "RSN_AKM_UNSPECIFIED\n");
-			is_rsn_ie ? (wpa_auth |= WPA2_AUTH_UNSPECIFIED) :
-				    (wpa_auth |= WPA_AUTH_UNSPECIFIED);
-			break;
-		case RSN_AKM_PSK:
-			brcmf_dbg(TRACE, "RSN_AKM_PSK\n");
-			is_rsn_ie ? (wpa_auth |= WPA2_AUTH_PSK) :
-				    (wpa_auth |= WPA_AUTH_PSK);
-			break;
-		case RSN_AKM_SHA256_PSK:
-			brcmf_dbg(TRACE, "RSN_AKM_MFP_PSK\n");
-			wpa_auth |= WPA2_AUTH_PSK_SHA256;
-			break;
-		case RSN_AKM_SHA256_1X:
-			brcmf_dbg(TRACE, "RSN_AKM_MFP_1X\n");
-			wpa_auth |= WPA2_AUTH_1X_SHA256;
-			break;
-		case RSN_AKM_SAE:
-			brcmf_dbg(TRACE, "RSN_AKM_SAE\n");
-			wpa_auth |= WPA3_AUTH_SAE_PSK;
-			break;
-		default:
-			bphy_err(drvr, "Invalid key mgmt info\n");
-		}
 		offset++;
 	}
 
@@ -4687,10 +4708,12 @@ brcmf_configure_wpaie(struct brcmf_if *ifp,
 				 */
 				if (!(wpa_auth & (WPA2_AUTH_PSK_SHA256 |
 						  WPA2_AUTH_1X_SHA256 |
+						  WFA_AUTH_DPP |
 						  WPA3_AUTH_SAE_PSK))) {
 					err = -EINVAL;
 					goto exit;
 				}
+
 				/* Firmware has requirement that WPA2_AUTH_PSK/
 				 * WPA2_AUTH_UNSPECIFIED be set, if SHA256 OUI
 				 * is to be included in the rsn ie.
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
index 6e0c90f4718b58..2c1f52ed513800 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
@@ -6,6 +6,7 @@
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
 #include <linux/rtnetlink.h>
+#include <linux/unaligned.h>
 #include <net/cfg80211.h>
 
 #include <brcmu_wifi.h>
@@ -44,9 +45,6 @@
 
 #define BRCMF_SCB_TIMEOUT_VALUE	20
 
-#define P2P_VER			9	/* P2P version: 9=WiFi P2P v1.0 */
-#define P2P_PUB_AF_CATEGORY	0x04
-#define P2P_PUB_AF_ACTION	0x09
 #define P2P_AF_CATEGORY		0x7f
 #define P2P_OUI			"\x50\x6F\x9A"	/* P2P OUI */
 #define P2P_OUI_LEN		3		/* P2P OUI length */
@@ -143,10 +141,10 @@ struct brcmf_p2p_scan_le {
 /**
  * struct brcmf_p2p_pub_act_frame - WiFi P2P Public Action Frame
  *
- * @category: P2P_PUB_AF_CATEGORY
- * @action: P2P_PUB_AF_ACTION
+ * @category: WLAN_CATEGORY_PUBLIC
+ * @action: WLAN_PUB_ACTION_VENDOR_SPECIFIC
  * @oui: P2P_OUI
- * @oui_type: OUI type - P2P_VER
+ * @oui_type: OUI type - WLAN_OUI_TYPE_WFA_P2P
  * @subtype: OUI subtype - P2P_TYPE_*
  * @dialog_token: nonzero, identifies req/rsp transaction
  * @elts: Variable length information elements.
@@ -166,7 +164,7 @@ struct brcmf_p2p_pub_act_frame {
  *
  * @category: P2P_AF_CATEGORY
  * @oui: OUI - P2P_OUI
- * @type: OUI Type - P2P_VER
+ * @type: OUI Type - WLAN_OUI_TYPE_WFA_P2P
  * @subtype: OUI Subtype - P2P_AF_*
  * @dialog_token: nonzero, identifies req/resp tranaction
  * @elts: Variable length information elements.
@@ -228,10 +226,38 @@ static bool brcmf_p2p_is_pub_action(void *frame, u32 frame_len)
 	if (frame_len < sizeof(*pact_frm))
 		return false;
 
-	if (pact_frm->category == P2P_PUB_AF_CATEGORY &&
-	    pact_frm->action == P2P_PUB_AF_ACTION &&
-	    pact_frm->oui_type == P2P_VER &&
-	    memcmp(pact_frm->oui, P2P_OUI, P2P_OUI_LEN) == 0)
+	if (pact_frm->category == WLAN_CATEGORY_PUBLIC &&
+	    pact_frm->action == WLAN_PUB_ACTION_VENDOR_SPECIFIC &&
+	    pact_frm->oui_type == WLAN_OUI_TYPE_WFA_P2P &&
+	    get_unaligned_be24(pact_frm->oui) == WLAN_OUI_WFA)
+		return true;
+
+	return false;
+}
+
+/**
+ * brcmf_p2p_is_dpp_pub_action() - true if dpp public type frame.
+ *
+ * @frame: action frame data.
+ * @frame_len: length of action frame data.
+ *
+ * Determine if action frame is dpp public action type
+ */
+static bool brcmf_p2p_is_dpp_pub_action(void *frame, u32 frame_len)
+{
+	struct brcmf_p2p_pub_act_frame *pact_frm;
+
+	if (!frame)
+		return false;
+
+	pact_frm = (struct brcmf_p2p_pub_act_frame *)frame;
+	if (frame_len < sizeof(struct brcmf_p2p_pub_act_frame) - 1)
+		return false;
+
+	if (pact_frm->category == WLAN_CATEGORY_PUBLIC &&
+	    pact_frm->action == WLAN_PUB_ACTION_VENDOR_SPECIFIC &&
+	    pact_frm->oui_type == WLAN_OUI_TYPE_WFA_DPP &&
+	    get_unaligned_be24(pact_frm->oui) == WLAN_OUI_WFA)
 		return true;
 
 	return false;
@@ -257,7 +283,7 @@ static bool brcmf_p2p_is_p2p_action(void *frame, u32 frame_len)
 		return false;
 
 	if (act_frm->category == P2P_AF_CATEGORY &&
-	    act_frm->type  == P2P_VER &&
+	    act_frm->type  == WLAN_OUI_TYPE_WFA_P2P &&
 	    memcmp(act_frm->oui, P2P_OUI, P2P_OUI_LEN) == 0)
 		return true;
 
@@ -1281,6 +1307,9 @@ static s32 brcmf_p2p_abort_action_frame(struct brcmf_cfg80211_info *cfg)
 	brcmf_dbg(TRACE, "Enter\n");
 
 	vif = p2p->bss_idx[P2PAPI_BSSCFG_DEVICE].vif;
+	if (!vif)
+		vif = p2p->bss_idx[P2PAPI_BSSCFG_PRIMARY].vif;
+
 	err = brcmf_fil_bsscfg_data_set(vif->ifp, "actframe_abort", &int_val,
 					sizeof(s32));
 	if (err)
@@ -1789,7 +1818,9 @@ bool brcmf_p2p_send_action_frame(struct brcmf_cfg80211_info *cfg,
 			goto exit;
 		}
 	} else if (brcmf_p2p_is_p2p_action(action_frame->data,
-					   action_frame_len)) {
+					   action_frame_len) ||
+		   brcmf_p2p_is_dpp_pub_action(action_frame->data,
+					       action_frame_len)) {
 		/* do not configure anything. it will be */
 		/* sent with a default configuration     */
 	} else {
@@ -1826,6 +1857,7 @@ bool brcmf_p2p_send_action_frame(struct brcmf_cfg80211_info *cfg,
 	/* validate channel and p2p ies */
 	if (config_af_params.search_channel &&
 	    IS_P2P_SOCIAL_CHANNEL(le32_to_cpu(af_params->channel)) &&
+	    p2p->bss_idx[P2PAPI_BSSCFG_DEVICE].vif &&
 	    p2p->bss_idx[P2PAPI_BSSCFG_DEVICE].vif->saved_ie.probe_req_ie_len) {
 		afx_hdl = &p2p->afx_hdl;
 		afx_hdl->peer_listen_chan = le32_to_cpu(af_params->channel);
@@ -2543,4 +2575,3 @@ void brcmf_p2p_detach(struct brcmf_p2p_info *p2p)
 	/* just set it all to zero */
 	memset(p2p, 0, sizeof(*p2p));
 }
-
diff --git a/drivers/net/wireless/broadcom/brcm80211/include/brcmu_wifi.h b/drivers/net/wireless/broadcom/brcm80211/include/brcmu_wifi.h
index 7552bdb91991ce..c465208c433182 100644
--- a/drivers/net/wireless/broadcom/brcm80211/include/brcmu_wifi.h
+++ b/drivers/net/wireless/broadcom/brcm80211/include/brcmu_wifi.h
@@ -233,6 +233,8 @@ static inline bool ac_bitmap_tst(u8 bitmap, int prec)
 
 #define WPA3_AUTH_SAE_PSK	0x40000	/* SAE with 4-way handshake */
 
+#define WFA_AUTH_DPP		0x200000 /* WFA DPP AUTH */
+
 #define DOT11_DEFAULT_RTS_LEN		2347
 #define DOT11_DEFAULT_FRAG_LEN		2346
 

gemini-3.1-pro-preview

null

null

							input: 7368
							output: 19
							thoughts: 531
						

**Fuzzing Plan for a DPP/SAE Enhancement in brcmfmac**

Okay, so we have a patch that introduces DPP (Device Provisioning Protocol) AKM and action frame support within the Broadcom `brcmfmac` driver. This patch specifically touches `cfg80211.c` and `p2p.c`, and it looks like `brcmf_cfg80211_connect` has been modified to handle SAE/DPP and PSK offload logic. This is a *functional* change to a wireless driver, so it warrants serious fuzzing.

My first thought is, can we even reach this driver in a virtualized environment? `brcmfmac` is Broadcom's IEEE802.11n/ac driver for PCIe/SDIO/USB. Luckily, USB is often emulatable. We could use `dummy_hcd` or, even better, I remember syzkaller has a USB fuzzer specifically for this kind of thing. SDIO might be trickier, but PCIe can be emulated as well. The USB fuzzer is key here. It can emulate wireless dongles. This is fullMAC, so it interfaces directly with cfg80211. We can fuzz brcmfmac through USB, which syzkaller supports. It's definitely worth the effort.

Let's nail down the critical functions that this patch affects. I need to focus the fuzzing efforts on these:

*   `brcmf_set_key_mgmt`
*   `brcmf_cfg80211_connect`
*   `brcmf_valid_dpp_suite`
*   `brcmf_configure_wpaie`
*   `brcmf_p2p_is_pub_action`
*   `brcmf_p2p_is_dpp_pub_action`
*   `brcmf_p2p_is_p2p_action`
*   `brcmf_p2p_abort_action_frame`
*   `brcmf_p2p_send_action_frame`

For enabling the driver, I'll need to make sure we have these configs set: `BRCMFMAC`, `BRCMFMAC_USB` for the USB fuzzing, and `CFG80211`, of course. Time to dive into the Kconfig files and confirm how those are set up.

{
  "Expression": "config BRCMFMAC"
}

{
  "Output": "drivers/net/wireless/broadcom/brcm80211/brcmfmac/Kconfig:1:config BRCMFMAC\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/Kconfig-2-\ttristate \"Broadcom FullMAC WLAN driver\"\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/Kconfig-10-\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/Kconfig:11:config BRCMFMAC_PROTO_BCDC\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/Kconfig-12-\tbool\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/Kconfig-13-\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/Kconfig:14:config BRCMFMAC_PROTO_MSGBUF\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/Kconfig-15-\tbool\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/Kconfig-16-\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/Kconfig:17:config BRCMFMAC_SDIO\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/Kconfig-18-\tbool \"SDIO bus interface support for FullMAC driver\"\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/Kconfig-28-\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/Kconfig:29:config BRCMFMAC_USB\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/Kconfig-30-\tbool \"USB bus interface support for FullMAC driver\"\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/Kconfig-39-\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/Kconfig:40:config BRCMFMAC_PCIE\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/Kconfig-41-\tbool \"PCIE bus interface support for FullMAC driver\"\n"
}

gemini-3.1-pro-preview

null

null

							input: 9069
							output: 26
							thoughts: 197
						

**My Configuration Focus**

Okay, so I'm homing in on the configuration options related to Broadcom's firmware drivers. Specifically, I need to add `BRCMFMAC` and `BRCMFMAC_USB` to `EnableConfigs`. That covers the core MAC and the USB-specific interface. I'm assuming the other PCIe and SDIO variants, `BRCMFMAC_SDIO` and `BRCMFMAC_PCIE`, are handled elsewhere or are less relevant for the current task. I'm noting these as this information may become important later, as context.

Now, I need to dig into the relevant functions within these configurations. The ones that are standing out right now are: `brcmf_set_key_mgmt`, `brcmf_cfg80211_connect`, `brcmf_configure_wpaie`, `brcmf_p2p_is_dpp_pub_action`, and `brcmf_p2p_send_action_frame`. These all seem directly related to key management, connection handling, and potentially P2P with DPP (Device Provisioning Protocol).

Just a quick sanity check: since `BRCMFMAC` is what I'm dealing with, it implicitly brings in `CFG80211` as a dependency. No need to explicitly list it. That saves a step. I'm going to verify these functions in the next phase.

{
  "Expression": "brcmf_cfg80211_connect"
}

{
  "Output": "drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c=2363=static s32\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:2364:brcmf_cfg80211_connect(struct wiphy *wiphy, struct net_device *ndev,\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c-2365-\t\t       struct cfg80211_connect_params *sme)\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c=5957=static struct cfg80211_ops brcmf_cfg80211_ops = {\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c-5974-\t.set_power_mgmt = brcmf_cfg80211_set_power_mgmt,\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:5975:\t.connect = brcmf_cfg80211_connect,\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c-5976-\t.disconnect = brcmf_cfg80211_disconnect,\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c=6146=static void brcmf_clear_assoc_ies(struct brcmf_cfg80211_info *cfg)\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c-6147-{\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:6148:\tstruct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c-6149-\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c=6296=static s32 brcmf_get_assoc_ies(struct brcmf_cfg80211_info *cfg,\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c-6300-\tstruct brcmf_cfg80211_assoc_ielen_le *assoc_info;\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:6301:\tstruct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c-6302-\tstruct brcmf_cfg80211_edcf_acparam edcf_acparam_info[EDCF_AC_COUNT];\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c=6378=brcmf_bss_roaming_done(struct brcmf_cfg80211_info *cfg,\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c-6383-\tstruct brcmf_cfg80211_profile *profile = \u0026ifp-\u003evif-\u003eprofile;\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:6384:\tstruct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c-6385-\tstruct wiphy *wiphy = cfg_to_wiphy(cfg);\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c=6451=brcmf_bss_connect_done(struct brcmf_cfg80211_info *cfg,\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c-6456-\tstruct brcmf_cfg80211_profile *profile = \u0026ifp-\u003evif-\u003eprofile;\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:6457:\tstruct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c-6458-\tstruct cfg80211_connect_resp_params conn_params;\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h=220=struct brcmf_cfg80211_vif {\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h-235-/* association inform */\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h:236:struct brcmf_cfg80211_connect_info {\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h-237-\tu8 *req_ie;\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h=342=struct brcmf_cfg80211_info {\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h-349-\tstruct wl_cfg80211_bss_info *bss_info;\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h:350:\tstruct brcmf_cfg80211_connect_info conn_info;\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h-351-\tstruct brcmf_pmk_list_le pmk_list;\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h=433=static inline struct\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h:434:brcmf_cfg80211_connect_info *cfg_to_conn(struct brcmf_cfg80211_info *cfg)\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h-435-{\n"
}

gemini-3.1-pro-preview

null

null

							input: 11544
							output: 27
							thoughts: 175
						

**Analyzing the Wi-Fi Driver Functions**

Okay, let's break down this set of functions. I see we're dealing with a Broadcom Wi-Fi driver, likely CFG80211-related, given the naming convention. My immediate focus, as an expert, is on how these functions interact within a specific control flow, especially regarding security and peer-to-peer (P2P) connections.

First, we have the connection setup (`brcmf_cfg80211_connect`), key management (`brcmf_set_key_mgmt`), and WPA information element configuration (`brcmf_configure_wpaie`). Standard stuff, but we need to see how they're used. Then, we have `brcmf_p2p_is_dpp_pub_action` and `brcmf_p2p_send_action_frame`. The DPP (Device Provisioning Protocol) aspect is interesting.

Right, so `brcmf_p2p_is_dpp_pub_action` is static. That's a bit of a roadblock for direct analysis, assuming it's inlined. This means we should concentrate on the call sites of `brcmf_p2p_send_action_frame`, which should give me insight into how DPP actions are initiated and handled within the driver, and thus expose the usage of that `static` function in context. Let's dig into that function now.

{
  "Expression": "brcmf_p2p_send_action_frame"
}

{
  "Output": "drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c=5536=brcmf_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c-5627-\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:5628:\t\tack = brcmf_p2p_send_action_frame(cfg, cfg_to_ndev(cfg),\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c-5629-\t\t\t\t\t\t  af_params);\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c=1729=static bool brcmf_p2p_check_dwell_overflow(u32 requested_dwell,\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c-1740-/**\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c:1741: * brcmf_p2p_send_action_frame() - send action frame .\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c-1742- *\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c-1746- */\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c:1747:bool brcmf_p2p_send_action_frame(struct brcmf_cfg80211_info *cfg,\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c-1748-\t\t\t\t struct net_device *ndev,\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h=168=int brcmf_p2p_notify_action_tx_complete(struct brcmf_if *ifp,\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h-170-\t\t\t\t\tvoid *data);\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h:171:bool brcmf_p2p_send_action_frame(struct brcmf_cfg80211_info *cfg,\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h-172-\t\t\t\t struct net_device *ndev,\n"
}

gemini-3.1-pro-preview

null

null

							input: 12825
							output: 23
							thoughts: 61
						

Okay, let's see what I'm thinking here, from a technical perspective...

**Exploring the WLAN Driver's Control Plane**

Right, so I'm currently mapping out the control plane functionality in this Broadcom WiFi driver. I've noted that `brcmf_p2p_send_action_frame` is exported, meaning it's accessible from other parts of the system. Good to know. And the connection setup routine, `brcmf_cfg80211_connect`, that's accessible too. Now, the `brcmf_set_key_mgmt` function, that's static, which is interesting. I should investigate that, if it is static, then only the code in this source file can call it. Best check where it's being used within the file, to understand its role. I need to trace back from that function and see what's invoking it. Understanding its callers will shed light on the key management flow.

{
  "Expression": "brcmf_set_key_mgmt"
}

{
  "Output": "drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c=2087=static s32\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:2088:brcmf_set_key_mgmt(struct net_device *ndev, struct cfg80211_connect_params *sme)\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c-2089-{\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c=2364=brcmf_cfg80211_connect(struct wiphy *wiphy, struct net_device *ndev,\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c-2460-\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:2461:\terr = brcmf_set_key_mgmt(ndev, sme);\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c-2462-\tif (err) {\n"
}

gemini-3.1-pro-preview

null

null

							input: 13481
							output: 23
							thoughts: 50
						

Here's my summary, as though I'm thinking through this process:

**Diving into the WPA Key Management**

Okay, I'm digging into how the Broadcom driver handles key management, specifically with WPA. I see that the `brcmf_set_key_mgmt` function is getting called, and a quick look shows me that it's being triggered by `brcmf_cfg80211_connect`. That makes sense; connection establishment is where you'd expect key configuration to happen. Now, `brcmf_configure_wpaie`...that's static, so it’s likely internal to a module. Let's see who's calling *it*. I need to trace this back to understand how the WPA Information Element (IE) is being constructed and set. Understanding the calling context of `brcmf_configure_wpaie` will give me critical insights into the overall WPA setup flow.

{
  "Expression": "brcmf_configure_wpaie"
}

{
  "Output": "drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c=4538=static s32\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:4539:brcmf_configure_wpaie(struct brcmf_if *ifp,\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c-4540-\t\t      const struct brcmf_vs_tlv *wpa_ie,\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c=5084=brcmf_parse_configure_security(struct brcmf_if *ifp,\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c-5103-\t\t\t/* WPA IE */\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:5104:\t\t\terr = brcmf_configure_wpaie(ifp, wpa_ie, false);\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c-5105-\t\t\tif (err \u003c 0)\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c-5112-\t\t\t/* RSN IE */\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:5113:\t\t\terr = brcmf_configure_wpaie(ifp, tmp_ie, true);\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c-5114-\t\t\tif (err \u003c 0)\n"
}

gemini-3.1-pro-preview

null

null

							input: 14283
							output: 23
							thoughts: 41
						

Here's my take on the thought process, as requested:

**Diving into Security Configuration**

Okay, so `brcmf_parse_configure_security` is responsible for handling security configuration. And it looks like it calls `brcmf_configure_wpaie`. That's interesting, I need to understand this better. My next logical step is to trace back the calls to `brcmf_parse_configure_security`. Knowing where this function is called from will give me the necessary context to understand its purpose and how it integrates into the overall security framework. Let's see what the call graph reveals. This could be a critical point of entry for security-related parameters, and potentially an area for vulnerabilities to investigate further.

{
  "Expression": "brcmf_parse_configure_security"
}

{
  "Output": "drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c=5083=static s32\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:5084:brcmf_parse_configure_security(struct brcmf_if *ifp,\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c-5085-\t\t\t       struct cfg80211_ap_settings *settings,\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c=5126=brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c-5292-\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:5293:\t\terr = brcmf_parse_configure_security(ifp, settings,\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c-5294-\t\t\t\t\t\t     NL80211_IFTYPE_AP);\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c-5295-\t\tif (err \u003c 0) {\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:5296:\t\t\tbphy_err(drvr, \"brcmf_parse_configure_security error\\n\");\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c-5297-\t\t\tgoto exit;\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c-5334-\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:5335:\t\terr = brcmf_parse_configure_security(ifp, settings,\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c-5336-\t\t\t\t\t\t     NL80211_IFTYPE_P2P_GO);\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c-5337-\t\tif (err \u003c 0) {\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:5338:\t\t\tbrcmf_err(\"brcmf_parse_configure_security error\\n\");\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c-5339-\t\t\tgoto exit;\n"
}

gemini-3.1-pro-preview

null

null

							input: 15320
							output: 155
							thoughts: 368
						

**My Fuzzing Strategy for the brcmfmac Driver**

Okay, here's the plan. I've been looking at this brcmfmac driver code and I've got a few key entry points for fuzzing. I see that `brcmf_cfg80211_start_ap` is calling `brcmf_parse_configure_security`, which looks interesting. Additionally, `brcmf_cfg80211_connect` and `brcmf_p2p_send_action_frame` are also prime targets. These seem to be the core functions related to the new DPP and action frame functionality.

Now, let's see about getting this set up for effective fuzzing. I need to figure out the right build configurations. I've noted `BRCMFMAC` and `BRCMFMAC_USB`. Good. The `BRCMFMAC_USB` config looks particularly promising since it enables the USB driver, meaning I can leverage syzkaller's USB fuzzer. It should simplify the fuzzing process since the target is connected to the host via USB emulation.

Since `CFG80211` is already implied, I don't need to worry about that explicitly. And `WLAN_AKM_SUITE_WFA_DPP` is a constant so no need to worry about that at the moment.

So, here's my summarized plan:

*   **WorthFuzzing:** Yes, definitely.
*   **Focus Symbols:**
    *   `brcmf_cfg80211_connect`
    *   `brcmf_cfg80211_start_ap`
    *   `brcmf_p2p_send_action_frame`
*   **Enable Configurations:**
    *   `BRCMFMAC`
    *   `BRCMFMAC_USB`

The reason I'm doing this is because this patch introduces DPP support and action frame handling. This alters connection logic, AP security, and P2P action frames. Given that, and the ease of using USB emulation for fuzzing this driver, it's absolutely worth the effort. It should be a good target for vulnerability discovery.

{
  "EnableConfigs": [
    "BRCMFMAC",
    "BRCMFMAC_USB"
  ],
  "FocusSymbols": [
    "brcmf_cfg80211_connect",
    "brcmf_cfg80211_start_ap",
    "brcmf_p2p_send_action_frame"
  ],
  "Reasoning": "This patch adds support for DPP (Device Provisioning Protocol) AKM and action frames in the Broadcom brcmfmac driver. It modifies connection logic, AP security configuration, and P2P action frame handling. The driver can be fuzzed via USB emulation, so it is worth fuzzing.",
  "WorthFuzzing": true
}

{
  "EnableConfigs": [
    "BRCMFMAC",
    "BRCMFMAC_USB"
  ],
  "FocusSymbols": [
    "brcmf_cfg80211_connect",
    "brcmf_cfg80211_start_ap",
    "brcmf_p2p_send_action_frame"
  ],
  "Reasoning": "This patch adds support for DPP (Device Provisioning Protocol) AKM and action frames in the Broadcom brcmfmac driver. It modifies connection logic, AP security configuration, and P2P action frame handling. The driver can be fuzzed via USB emulation, so it is worth fuzzing.",
  "WorthFuzzing": true
}