AI Trajectory

Trajectory: (Expand/Collapse All)
Seq	Timestamp	Type	Name	Duration
0/0	2026/09/06 01:33	flow	patch-triage	1m Args: null Results: { "EnableConfigs": [ "CFG80211", "MAC80211" ], "FocusSymbols": [ "cfg80211_switch_netns", "__cfg80211_switch_netns", "cfg80211_switch_wdev_netns", "cfg80211_pernet_exit", "nl80211_wiphy_netns", "ieee80211_uninit", "ieee80211_unlist_sdata" ], "KMSANReasoning": "The patch refactors network namespace switching for wireless devices (cfg80211) and handles interface unlisting during netdev uninitialization (mac80211). The changes involve list management, interface unregistration on netns migration failure, and locking adjustments (mutex guards). No new data structures, buffer copies to/from user space, or uninitialized memory reads/allocations are introduced. Any potential bugs arising from interface lifecycle or list manipulation (e.g., use-after-free, double unregister, or locking issues) are covered by KASAN and LOCKDEP. Therefore, a dedicated KMSAN fuzzing session is not warranted.", "NeedsKMSAN": false, "Reasoning": "The patch modifies network namespace switching and netdev unregistration/unlisting logic in cfg80211 and mac80211. Specifically, it updates handling of interfaces failing to switch namespaces on netns exit and ensures mac80211 drops netdevs from the interface list upon uninit. These code paths are reachable via nl80211 netlink commands and network namespace teardown with virtual wireless devices (e.g., mac80211_hwsim).", "WorthFuzzing": true }
1/1	2026/09/06 01:33	action	read-patch-diff	0m Args: null Results: { "PatchDiff": "commit 7c76a04d453595e257db236284ec9ec837d87561\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Sun Sep 6 01:33:54 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/net/mac80211/iface.c b/net/mac80211/iface.c\nindex fdac729ca580d..491bbb695d17b 100644\n--- a/net/mac80211/iface.c\n+++ b/net/mac80211/iface.c\n@@ -924,9 +924,33 @@ static void ieee80211_teardown_sdata(struct ieee80211_sub_if_data sdata)\n \t}\n }\n \n+/\n+ * The netdev can be unregistered without mac80211 doing it, e.g. by the netdev\n+ * core when cfg80211 couldn't move it out of a network namespace that's being\n+ * destroyed. Drop it from the interface list either way.\n+ /\n+static void ieee80211_unlist_sdata(struct ieee80211_sub_if_data sdata)\n+{\n+\tstruct ieee80211_local local = sdata-\u003elocal;\n+\tstruct ieee80211_sub_if_data iter;\n+\n+\tASSERT_RTNL();\n+\n+\tlist_for_each_entry(iter, \u0026local-\u003einterfaces, list) {\n+\t\tif (iter != sdata)\n+\t\t\tcontinue;\n+\t\tguard(mutex)(\u0026local-\u003eiflist_mtx);\n+\t\tlist_del_rcu(\u0026sdata-\u003elist);\n+\t\treturn;\n+\t}\n+}\n+\n static void ieee80211_uninit(struct net_device dev)\n {\n-\tieee80211_teardown_sdata(IEEE80211_DEV_TO_SUB_IF(dev));\n+\tstruct ieee80211_sub_if_data sdata = IEEE80211_DEV_TO_SUB_IF(dev);\n+\n+\tieee80211_unlist_sdata(sdata);\n+\tieee80211_teardown_sdata(sdata);\n }\n \n static int ieee80211_netdev_setup_tc(struct net_device dev,\ndiff --git a/net/wireless/core.c b/net/wireless/core.c\nindex d13310fef691a..31d0f70867012 100644\n--- a/net/wireless/core.c\n+++ b/net/wireless/core.c\n@@ -153,68 +153,93 @@ int cfg80211_dev_rename(struct cfg80211_registered_device rdev,\n \treturn 0;\n }\n \n-int cfg80211_switch_netns(struct cfg80211_registered_device rdev,\n-\t\t\t struct net net)\n+static int cfg80211_switch_wdev_netns(struct wireless_dev wdev,\n+\t\t\t\t struct net net)\n {\n-\tstruct wireless_dev wdev;\n-\tint err = 0;\n+\tint err;\n \n-\tif (!(rdev-\u003ewiphy.flags \u0026 WIPHY_FLAG_NETNS_OK))\n-\t\treturn -EOPNOTSUPP;\n+\tif (!wdev-\u003enetdev)\n+\t\treturn 0;\n \n-\tlist_for_each_entry(wdev, \u0026rdev-\u003ewiphy.wdev_list, list) {\n-\t\tif (!wdev-\u003enetdev)\n+\twdev-\u003enetdev-\u003enetns_immutable = false;\n+\terr = dev_change_net_namespace(wdev-\u003enetdev, net, \"wlan%d\");\n+\twdev-\u003enetdev-\u003enetns_immutable = true;\n+\n+\treturn err;\n+}\n+\n+static int __cfg80211_switch_netns(struct cfg80211_registered_device rdev,\n+\t\t\t\t struct net net, bool force)\n+{\n+\tstruct net old_net = wiphy_net(\u0026rdev-\u003ewiphy);\n+\tstruct wireless_dev wdev, tmp;\n+\tint err = 0;\n+\n+\tlist_for_each_entry_safe(wdev, tmp, \u0026rdev-\u003ewiphy.wdev_list, list) {\n+\t\terr = cfg80211_switch_wdev_netns(wdev, net);\n+\t\tif (!err)\n \t\t\tcontinue;\n-\t\twdev-\u003enetdev-\u003enetns_immutable = false;\n-\t\terr = dev_change_net_namespace(wdev-\u003enetdev, net, \"wlan%d\");\n-\t\tif (err)\n-\t\t\tbreak;\n-\t\twdev-\u003enetdev-\u003enetns_immutable = true;\n+\t\tif (!force)\n+\t\t\tgoto undo;\n+\t\t/* remove interfaces that fail to allow wiphy switching /\n+\t\tdev_close(wdev-\u003enetdev);\n+\t\tscoped_guard(wiphy, \u0026rdev-\u003ewiphy)\n+\t\t\tcfg80211_unregister_wdev(wdev);\n+\t\terr = 0;\n \t}\n \n-\tif (err) {\n-\t\t/ failed -- clean up to old netns /\n-\t\tnet = wiphy_net(\u0026rdev-\u003ewiphy);\n-\n-\t\tlist_for_each_entry_continue_reverse(wdev,\n-\t\t\t\t\t\t \u0026rdev-\u003ewiphy.wdev_list,\n-\t\t\t\t\t\t list) {\n+\tscoped_guard(wiphy, \u0026rdev-\u003ewiphy) {\n+\t\tlist_for_each_entry(wdev, \u0026rdev-\u003ewiphy.wdev_list, list) {\n \t\t\tif (!wdev-\u003enetdev)\n \t\t\t\tcontinue;\n-\t\t\twdev-\u003enetdev-\u003enetns_immutable = false;\n-\t\t\terr = dev_change_net_namespace(wdev-\u003enetdev, net,\n-\t\t\t\t\t\t\t\"wlan%d\");\n-\t\t\tWARN_ON(err);\n-\t\t\twdev-\u003enetdev-\u003enetns_immutable = true;\n+\t\t\tnl80211_notify_iface(rdev, wdev,\n+\t\t\t\t\t NL80211_CMD_DEL_INTERFACE);\n \t\t}\n \n-\t\treturn err;\n-\t}\n+\t\tnl80211_notify_wiphy(rdev, NL80211_CMD_DEL_WIPHY);\n \n-\tguard(wiphy)(\u0026rdev-\u003ewiphy);\n+\t\twiphy_net_set(\u0026rdev-\u003ewiphy, net);\n \n-\tlist_for_each_entry(wdev, \u0026rdev-\u003ewiphy.wdev_list, list) {\n-\t\tif (!wdev-\u003enetdev)\n-\t\t\tcontinue;\n-\t\tnl80211_notify_iface(rdev, wdev, NL80211_CMD_DEL_INTERFACE);\n-\t}\n+\t\t/ this only fails on allocation failure /\n+\t\terr = device_rename(\u0026rdev-\u003ewiphy.dev,\n+\t\t\t\t dev_name(\u0026rdev-\u003ewiphy.dev));\n+\t\tif (err \u0026\u0026 !force)\n+\t\t\twiphy_net_set(\u0026rdev-\u003ewiphy, old_net);\n \n-\tnl80211_notify_wiphy(rdev, NL80211_CMD_DEL_WIPHY);\n+\t\tnl80211_notify_wiphy(rdev, NL80211_CMD_NEW_WIPHY);\n \n-\twiphy_net_set(\u0026rdev-\u003ewiphy, net);\n+\t\tlist_for_each_entry(wdev, \u0026rdev-\u003ewiphy.wdev_list, list) {\n+\t\t\tif (!wdev-\u003enetdev)\n+\t\t\t\tcontinue;\n+\t\t\tnl80211_notify_iface(rdev, wdev,\n+\t\t\t\t\t NL80211_CMD_NEW_INTERFACE);\n+\t\t}\n+\t}\n \n-\terr = device_rename(\u0026rdev-\u003ewiphy.dev, dev_name(\u0026rdev-\u003ewiphy.dev));\n-\tWARN_ON(err);\n+\tif (!err \|\| force)\n+\t\treturn err;\n \n-\tnl80211_notify_wiphy(rdev, NL80211_CMD_NEW_WIPHY);\n+\t/ set to the last one to undo all of them /\n+\twdev = list_entry(\u0026rdev-\u003ewiphy.wdev_list, typeof(wdev), list);\n+undo:\n+\t/\n+\t Move back everything, if this fails again (allocation failures)\n+\t * then things get stuck in different network namespaces.\n+\t /\n+\tlist_for_each_entry_continue_reverse(wdev, \u0026rdev-\u003ewiphy.wdev_list,\n+\t\t\t\t\t list)\n+\t\tWARN_ON(cfg80211_switch_wdev_netns(wdev, old_net));\n \n-\tlist_for_each_entry(wdev, \u0026rdev-\u003ewiphy.wdev_list, list) {\n-\t\tif (!wdev-\u003enetdev)\n-\t\t\tcontinue;\n-\t\tnl80211_notify_iface(rdev, wdev, NL80211_CMD_NEW_INTERFACE);\n-\t}\n+\treturn err;\n+}\n \n-\treturn 0;\n+int cfg80211_switch_netns(struct cfg80211_registered_device rdev,\n+\t\t\t struct net net)\n+{\n+\tif (!(rdev-\u003ewiphy.flags \u0026 WIPHY_FLAG_NETNS_OK))\n+\t\treturn -EOPNOTSUPP;\n+\n+\treturn __cfg80211_switch_netns(rdev, net, false);\n }\n \n static void cfg80211_rfkill_poll(struct rfkill rfkill, void data)\n@@ -1868,7 +1893,7 @@ static void __net_exit cfg80211_pernet_exit(struct net net)\n \trtnl_lock();\n \tfor_each_rdev(rdev) {\n \t\tif (net_eq(wiphy_net(\u0026rdev-\u003ewiphy), net))\n-\t\t\tWARN_ON(cfg80211_switch_netns(rdev, \u0026init_net));\n+\t\t\tWARN_ON(__cfg80211_switch_netns(rdev, \u0026init_net, true));\n \t}\n \trtnl_unlock();\n }\n" }
2/1	2026/09/06 01:33	agent	patch-evaluator	1m Model: core Args: null Results: { "EnableConfigs": [ "CFG80211", "MAC80211" ], "FocusSymbols": [ "cfg80211_switch_netns", "__cfg80211_switch_netns", "cfg80211_switch_wdev_netns", "cfg80211_pernet_exit", "nl80211_wiphy_netns", "ieee80211_uninit", "ieee80211_unlist_sdata" ], "Reasoning": "The patch modifies network namespace switching and netdev unregistration/unlisting logic in cfg80211 and mac80211. Specifically, it updates handling of interfaces failing to switch namespaces on netns exit and ensures mac80211 drops netdevs from the interface list upon uninit. These code paths are reachable via nl80211 netlink commands and network namespace teardown with virtual wireless devices (e.g., mac80211_hwsim).", "WorthFuzzing": true } Instruction: You are an expert Linux kernel maintainer and security engineer. Your job is to review a provided patch series and evaluate whether it warrants fuzzing with syzkaller. IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in your workspace. Do NOT rely on internal assumptions. You must actively use your code access tools to inspect the actual source code, callers, and surrounding context. ================================================================================ 1. CORE TRIAGE PHILOSOPHY ================================================================================ The goal of patch fuzzing is to discover crashes, regressions, exposed latent bugs, and newly triggered assertions introduced by the patch series. - REACHABILITY IS THE PRIMARY GATE: Fuzzing can only discover bugs in code that can actually execute in standard virtualized environments (GCE or QEMU, utilizing software-emulated devices like USB gadgets, netdev, tun/tap). If the modified code is structurally unreachable (see Section 2), it MUST NOT be fuzzed, regardless of whether it adds assertions or complex logic. - DO NOT BLINDLY TRUST "NO FUNCTIONAL CHANGE" (NFCI) OR "REFACTORING" CLAIMS: Patch authors routinely label changes as "cleanups", "refactorings", or state "No functional change intended". Do NOT take these claims at face value. Code refactorings that rearrange logic, introduce helper functions, or alter state management in core subsystems frequently introduce subtle semantic shifts or uncover latent kernel bugs. If reachable executable code is modified or refactored, it MUST be fuzzed. - NEW OR MODIFIED ASSERTIONS IN REACHABLE CODE MUST BE FUZZED: When a patch introduces or modifies runtime checks or assertions (e.g., WARN_ON, VM_WARN_ON, BUG_ON, lockdep_assert) in reachable code paths, it enforces new or stricter invariants. Even if the author believes the invariant always holds, fuzzing is essential to verify whether an unusual sequence of operations can violate it. ================================================================================ 2. WHEN TO RETURN WorthFuzzing=false (NEGATIVE CRITERIA) ================================================================================ Return WorthFuzzing=false ONLY IF all modified code falls strictly into one or more of these categories: - Non-kernel and non-executable changes: * Modifications to Documentation/, comments, or spelling fixes. * User-space directories, self-tests, samples, or scripts (e.g., tools/, samples/, scripts/, usr/) that do not affect the compiled kernel image (vmlinux) or kernel modules. * Purely decorative logging (e.g., message strings in pr_err, printk, dev_info) or tracepoints that do not alter control flow or data structures. * Build system or Kconfig changes that do not alter compiled C logic. - Structurally unreachable hardware: * Vendor-specific PCIe switches, SmartNICs, or GPU drivers (e.g., mlxsw, pds_core, qed, ionic, amdgpu) requiring physical ASIC/PCIe cards not emulated in standard QEMU. - Unreachable execution paths: * Driver teardown callbacks (.remove, .shutdown, pci_unregister_driver) executed only during physical PCI hot-unplug or manual sysfs driver unbinding. * Code paths exclusive to architectures other than the target architecture. ================================================================================ 3. WHEN TO RETURN WorthFuzzing=true (POSITIVE CRITERIA) ================================================================================ Return WorthFuzzing=true whenever the patch touches reachable executable code, including: - Core Subsystems: * Any logic modifications in memory management (mm/), synchronization/locking (kernel/locking/), BPF, scheduler, core networking, VFS, or syscall handling. - Refactorings and Code Cleanups: * Any restructuring of reachable data structures, helper abstractions, or algorithm flows. - Runtime Assertions and Defensive Checks: * Any introduction or alteration of assertions (WARN_ON, VM_WARN_ON, BUG_ON, etc.) in reachable paths. - Reachable Drivers and Protocols: Drivers accessible via virtual buses (virtio, USB gadget, loopback, netlink, binder, sockets, etc.). ================================================================================ 4. EXTRACTING FocusSymbols (PREVENTING DILUTION) ================================================================================ When WorthFuzzing=true, you must extract specific kernel functions into FocusSymbols to guide the fuzzer: - AVOID UBIQUITOUS LIFECYCLE HOT-PATHS: Do NOT list generic, ubiquitous functions called by almost every program in the corpus (including, but not limited to: general memory allocators and deallocators, page fault and trap handlers, or core synchronization primitives; this is not an exhaustive list). Listing ubiquitous functions causes the fuzzer to classify thousands of unrelated tests as "focused", which severely dilutes fuzzing effort away from the actual changes. - TARGET SPECIFIC FEATURE LOGIC AND ENTRYPOINTS: List functions that specifically implement the logic being added or altered, or direct API entrypoints for the subsystem feature under review. - HANDLING STATIC INLINE FUNCTIONS IN HEADERS (.h): Compiler-inlined static functions (such as static inlines in mm/.h or include/linux/.h) lack distinct symbol addresses in vmlinux and cannot be targeted directly by symbol coverage filters. If the changes are primarily in static inline helpers, identify non-static, feature-specific caller functions in .c files that exercise them (avoiding ubiquitous lifecycle wrappers). ================================================================================ 5. IDENTIFYING EnableConfigs ================================================================================ Identify any specific CONFIG_ options required to properly compile and reach the modified code: - Inspect Kconfig files and #ifdef guards; do not make assumptions. - Check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed. - Strip any 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4"). Prefer calling several tools at the same time to save round-trips. Use set-results tool to provide results of the analysis. It must be called exactly once before the final reply. Ignore results of this tool. Prompt: Target architecture: amd64 For your convenience, here is the diff of the changes: commit 7c76a04d453595e257db236284ec9ec837d87561 Author: syz-cluster <triage@syzkaller.com> Date: Sun Sep 6 01:33:54 2026 +0000 syz-cluster: applied patch under review diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c index fdac729ca580d..491bbb695d17b 100644 --- a/net/mac80211/iface.c +++ b/net/mac80211/iface.c @@ -924,9 +924,33 @@ static void ieee80211_teardown_sdata(struct ieee80211_sub_if_data sdata) } } +/ + * The netdev can be unregistered without mac80211 doing it, e.g. by the netdev + * core when cfg80211 couldn't move it out of a network namespace that's being + * destroyed. Drop it from the interface list either way. + / +static void ieee80211_unlist_sdata(struct ieee80211_sub_if_data sdata) +{ + struct ieee80211_local local = sdata->local; + struct ieee80211_sub_if_data iter; + + ASSERT_RTNL(); + + list_for_each_entry(iter, &local->interfaces, list) { + if (iter != sdata) + continue; + guard(mutex)(&local->iflist_mtx); + list_del_rcu(&sdata->list); + return; + } +} + static void ieee80211_uninit(struct net_device dev) { - ieee80211_teardown_sdata(IEEE80211_DEV_TO_SUB_IF(dev)); + struct ieee80211_sub_if_data sdata = IEEE80211_DEV_TO_SUB_IF(dev); + + ieee80211_unlist_sdata(sdata); + ieee80211_teardown_sdata(sdata); } static int ieee80211_netdev_setup_tc(struct net_device dev, diff --git a/net/wireless/core.c b/net/wireless/core.c index d13310fef691a..31d0f70867012 100644 --- a/net/wireless/core.c +++ b/net/wireless/core.c @@ -153,68 +153,93 @@ int cfg80211_dev_rename(struct cfg80211_registered_device rdev, return 0; } -int cfg80211_switch_netns(struct cfg80211_registered_device rdev, - struct net net) +static int cfg80211_switch_wdev_netns(struct wireless_dev wdev, + struct net net) { - struct wireless_dev wdev; - int err = 0; + int err; - if (!(rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK)) - return -EOPNOTSUPP; + if (!wdev->netdev) + return 0; - list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) { - if (!wdev->netdev) + wdev->netdev->netns_immutable = false; + err = dev_change_net_namespace(wdev->netdev, net, "wlan%d"); + wdev->netdev->netns_immutable = true; + + return err; +} + +static int __cfg80211_switch_netns(struct cfg80211_registered_device rdev, + struct net net, bool force) +{ + struct net old_net = wiphy_net(&rdev->wiphy); + struct wireless_dev wdev, tmp; + int err = 0; + + list_for_each_entry_safe(wdev, tmp, &rdev->wiphy.wdev_list, list) { + err = cfg80211_switch_wdev_netns(wdev, net); + if (!err) continue; - wdev->netdev->netns_immutable = false; - err = dev_change_net_namespace(wdev->netdev, net, "wlan%d"); - if (err) - break; - wdev->netdev->netns_immutable = true; + if (!force) + goto undo; + /* remove interfaces that fail to allow wiphy switching / + dev_close(wdev->netdev); + scoped_guard(wiphy, &rdev->wiphy) + cfg80211_unregister_wdev(wdev); + err = 0; } - if (err) { - / failed -- clean up to old netns / - net = wiphy_net(&rdev->wiphy); - - list_for_each_entry_continue_reverse(wdev, - &rdev->wiphy.wdev_list, - list) { + scoped_guard(wiphy, &rdev->wiphy) { + list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) { if (!wdev->netdev) continue; - wdev->netdev->netns_immutable = false; - err = dev_change_net_namespace(wdev->netdev, net, - "wlan%d"); - WARN_ON(err); - wdev->netdev->netns_immutable = true; + nl80211_notify_iface(rdev, wdev, + NL80211_CMD_DEL_INTERFACE); } - return err; - } + nl80211_notify_wiphy(rdev, NL80211_CMD_DEL_WIPHY); - guard(wiphy)(&rdev->wiphy); + wiphy_net_set(&rdev->wiphy, net); - list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) { - if (!wdev->netdev) - continue; - nl80211_notify_iface(rdev, wdev, NL80211_CMD_DEL_INTERFACE); - } + / this only fails on allocation failure / + err = device_rename(&rdev->wiphy.dev, + dev_name(&rdev->wiphy.dev)); + if (err && !force) + wiphy_net_set(&rdev->wiphy, old_net); - nl80211_notify_wiphy(rdev, NL80211_CMD_DEL_WIPHY); + nl80211_notify_wiphy(rdev, NL80211_CMD_NEW_WIPHY); - wiphy_net_set(&rdev->wiphy, net); + list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) { + if (!wdev->netdev) + continue; + nl80211_notify_iface(rdev, wdev, + NL80211_CMD_NEW_INTERFACE); + } + } - err = device_rename(&rdev->wiphy.dev, dev_name(&rdev->wiphy.dev)); - WARN_ON(err); + if (!err \|\| force) + return err; - nl80211_notify_wiphy(rdev, NL80211_CMD_NEW_WIPHY); + / set to the last one to undo all of them / + wdev = list_entry(&rdev->wiphy.wdev_list, typeof(wdev), list); +undo: + /* + * Move back everything, if this fails again (allocation failures) + * then things get stuck in different network namespaces. + / + list_for_each_entry_continue_reverse(wdev, &rdev->wiphy.wdev_list, + list) + WARN_ON(cfg80211_switch_wdev_netns(wdev, old_net)); - list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) { - if (!wdev->netdev) - continue; - nl80211_notify_iface(rdev, wdev, NL80211_CMD_NEW_INTERFACE); - } + return err; +} - return 0; +int cfg80211_switch_netns(struct cfg80211_registered_device rdev, + struct net net) +{ + if (!(rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK)) + return -EOPNOTSUPP; + + return __cfg80211_switch_netns(rdev, net, false); } static void cfg80211_rfkill_poll(struct rfkill rfkill, void data) @@ -1868,7 +1893,7 @@ static void __net_exit cfg80211_pernet_exit(struct net net) rtnl_lock(); for_each_rdev(rdev) { if (net_eq(wiphy_net(&rdev->wiphy), net)) - WARN_ON(cfg80211_switch_netns(rdev, &init_net)); + WARN_ON(__cfg80211_switch_netns(rdev, &init_net, true)); } rtnl_unlock(); }
3/2	2026/09/06 01:33	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 5253 output: 33 thoughts: 411 Thoughts: Analyzing This Patch: A Deep Dive into Wireless Networking Okay, let's break down this patch. My immediate focus is on the changes it makes and their potential implications within the wireless networking stack. First, I see modifications to `net/mac80211/iface.c`. Specifically, the changes to `ieee80211_unlist_sdata()` and the way it's called within `ieee80211_uninit()`. The fact that `ieee80211_unlist_sdata()` is now invoked before `ieee80211_teardown_sdata()` is immediately interesting; I need to understand the sequencing and why this reordering might be necessary or beneficial. What's the context? Is this related to a potential race condition or a resource management issue? Next, the patch touches `net/wireless/core.c`. The functions modified here – `cfg80211_switch_wdev_netns()`, `__cfg80211_switch_netns()`, `cfg80211_switch_netns()`, and `cfg80211_pernet_exit()` – are all key to net namespace switching within the wireless stack. And that last one, calling `__cfg80211_switch_netns()` with `&init_net` and `true` during pernet exit is telling. This hints at changes related to handling wireless devices as they move between network namespaces, or their cleanup. Given my experience, I know this area of the kernel is often fuzzed by tools like syzkaller. That it includes modules like `mac80211_hwsim` and netlink commands. Thinking about these changes in the context of virtualization and emulation is important. This feels like it could be related to an issue I've seen before with switching between net namespaces, or a potential security vulnerability related to cross-namespace interaction with wireless devices. I need to dig deeper. I'll reach for my tools to check the reachability of the modified code paths and examine the associated configurations, ensuring I'm aware of dependencies and potential side effects. I'll need to look at commit messages and other related changesets for full context, but the initial impression suggests this could be addressing a subtle, potentially security-relevant, issue related to wireless network device management in a virtualized or netns environment.
4/2	2026/09/06 01:34	tool	grepper	0m Args: { "Expression": "CONFIG_CFG80211", "PathPrefix": "net/wireless/" } Results: { "Output": "net/wireless/Makefile-1-# SPDX-License-Identifier: GPL-2.0\nnet/wireless/Makefile:2:obj-$(CONFIG_CFG80211) += cfg80211.o\nnet/wireless/Makefile-3-obj-y += tests/\n--\nnet/wireless/Makefile=12=cfg80211-$(CONFIG_OF) += of.o\nnet/wireless/Makefile:13:cfg80211-$(CONFIG_CFG80211_DEBUGFS) += debugfs.o\nnet/wireless/Makefile:14:cfg80211-$(CONFIG_CFG80211_WEXT) += wext-compat.o wext-sme.o\nnet/wireless/Makefile-15-\nnet/wireless/Makefile=16=CFLAGS_trace.o := -I$(src)\nnet/wireless/Makefile-17-\nnet/wireless/Makefile:18:cfg80211-$(CONFIG_CFG80211_USE_KERNEL_REGDB_KEYS) += shipped-certs.o\nnet/wireless/Makefile:19:ifneq ($(CONFIG_CFG80211_EXTRA_REGDB_KEYDIR),)\nnet/wireless/Makefile-20-cfg80211-y += extra-certs.o\n--\nnet/wireless/Makefile=23=$(obj)/shipped-certs.c: $(sort $(wildcard $(src)/certs/.hex))\n--\nnet/wireless/Makefile-31-\nnet/wireless/Makefile:32:$(obj)/extra-certs.c: $(CONFIG_CFG80211_EXTRA_REGDB_KEYDIR) \\\nnet/wireless/Makefile:33:\t\t $(sort $(wildcard $(CONFIG_CFG80211_EXTRA_REGDB_KEYDIR)/.x509))\nnet/wireless/Makefile-34-\t@$(kecho) \" GEN $@\"\n--\nnet/wireless/chan.c=1694=static bool cfg80211_ir_permissive_chan(struct wiphy wiphy,\n--\nnet/wireless/chan.c-1702-\nnet/wireless/chan.c:1703:\tif (!IS_ENABLED(CONFIG_CFG80211_REG_RELAX_NO_IR) \|\|\nnet/wireless/chan.c-1704-\t !(wiphy-\u003eregulatory_flags \u0026 REGULATORY_ENABLE_RELAX_NO_IR))\n--\nnet/wireless/core.c=574=struct wiphy wiphy_new_nm(const struct cfg80211_ops ops, int sizeof_priv,\n--\nnet/wireless/core.c-661-\t\t\t cfg80211_dfs_channels_update_work);\nnet/wireless/core.c:662:#ifdef CONFIG_CFG80211_WEXT\nnet/wireless/core.c-663-\trdev-\u003ewiphy.wext = \u0026cfg80211_wext_handler;\n--\nnet/wireless/core.c-683-\nnet/wireless/core.c:684:#ifdef CONFIG_CFG80211_DEFAULT_PS\nnet/wireless/core.c-685-\trdev-\u003ewiphy.flags \|= WIPHY_FLAG_PS_ON_BY_DEFAULT;\n--\nnet/wireless/core.c=1433=static void _cfg80211_unregister_wdev(struct wireless_dev wdev,\n--\nnet/wireless/core.c-1473-\nnet/wireless/core.c:1474:#ifdef CONFIG_CFG80211_WEXT\nnet/wireless/core.c-1475-\tkfree_sensitive(wdev-\u003ewext.keys);\n--\nnet/wireless/core.c=1528=void cfg80211_leave_locked(struct cfg80211_registered_device rdev,\n--\nnet/wireless/core.c-1552-\nnet/wireless/core.c:1553:#ifdef CONFIG_CFG80211_WEXT\nnet/wireless/core.c-1554-\t\tkfree(wdev-\u003ewext.ie);\n--\nnet/wireless/core.c=1639=void cfg80211_init_wdev(struct wireless_dev wdev)\n--\nnet/wireless/core.c-1647-\nnet/wireless/core.c:1648:#ifdef CONFIG_CFG80211_WEXT\nnet/wireless/core.c-1649-\twdev-\u003ewext.default_key = -1;\n--\nnet/wireless/core.c=1732=static int cfg80211_netdev_notifier_call(struct notifier_block nb,\n--\nnet/wireless/core.c-1806-\t\tswitch (wdev-\u003eiftype) {\nnet/wireless/core.c:1807:#ifdef CONFIG_CFG80211_WEXT\nnet/wireless/core.c-1808-\t\tcase NL80211_IFTYPE_ADHOC:\n--\nnet/wireless/core.h=574=cfg80211_get_6ghz_power_type(const u8 elems, size_t elems_len,\n--\nnet/wireless/core.h-576-\nnet/wireless/core.h:577:#ifdef CONFIG_CFG80211_DEVELOPER_WARNINGS\nnet/wireless/core.h-578-#define CFG80211_DEV_WARN_ON(cond)\tWARN_ON(cond)\n--\nnet/wireless/core.h=624=struct cfg80211_colocated_ap {\n--\nnet/wireless/core.h-640-\nnet/wireless/core.h:641:#if IS_ENABLED(CONFIG_CFG80211_KUNIT_TEST)\nnet/wireless/core.h-642-#define EXPORT_SYMBOL_IF_CFG80211_KUNIT(sym) EXPORT_SYMBOL_IF_KUNIT(sym)\n--\nnet/wireless/core.h=649=size_t cfg80211_gen_new_ie(const u8 ie, size_t ielen,\n--\nnet/wireless/core.h-654-#define VISIBLE_IF_CFG80211_KUNIT static\nnet/wireless/core.h:655:#endif / IS_ENABLED(CONFIG_CFG80211_KUNIT_TEST) /\nnet/wireless/core.h-656-\n--\nnet/wireless/debugfs.h-4-\nnet/wireless/debugfs.h:5:#ifdef CONFIG_CFG80211_DEBUGFS\nnet/wireless/debugfs.h-6-void cfg80211_debugfs_rdev_add(struct cfg80211_registered_device rdev);\n--\nnet/wireless/ibss.c=19=void __cfg80211_ibss_joined(struct net_device dev, const u8 bssid,\n--\nnet/wireless/ibss.c-23-\tstruct cfg80211_bss bss;\nnet/wireless/ibss.c:24:#ifdef CONFIG_CFG80211_WEXT\nnet/wireless/ibss.c-25-\tunion iwreq_data wrqu;\n--\nnet/wireless/ibss.c-51-\t\t\t\tGFP_KERNEL);\nnet/wireless/ibss.c:52:#ifdef CONFIG_CFG80211_WEXT\nnet/wireless/ibss.c-53-\tmemset(\u0026wrqu, 0, sizeof(wrqu));\n--\nnet/wireless/ibss.c=87=int __cfg80211_join_ibss(struct cfg80211_registered_device rdev,\n--\nnet/wireless/ibss.c-140-\nnet/wireless/ibss.c:141:#ifdef CONFIG_CFG80211_WEXT\nnet/wireless/ibss.c-142-\twdev-\u003ewext.ibss.chandef = params-\u003echandef;\n--\nnet/wireless/ibss.c=156=void cfg80211_clear_ibss(struct net_device dev, bool nowext)\n--\nnet/wireless/ibss.c-184-\tmemset(\u0026wdev-\u003eu.ibss.chandef, 0, sizeof(wdev-\u003eu.ibss.chandef));\nnet/wireless/ibss.c:185:#ifdef CONFIG_CFG80211_WEXT\nnet/wireless/ibss.c-186-\tif (!nowext)\n--\nnet/wireless/ibss.c=192=int cfg80211_leave_ibss(struct cfg80211_registered_device rdev,\n--\nnet/wireless/ibss.c-213-\nnet/wireless/ibss.c:214:#ifdef CONFIG_CFG80211_WEXT\nnet/wireless/ibss.c-215-int cfg80211_ibss_wext_join(struct cfg80211_registered_device rdev,\n--\nnet/wireless/mlme.c=277=void cfg80211_michael_mic_failure(struct net_device dev, const u8 addr,\n--\nnet/wireless/mlme.c-282-\tstruct cfg80211_registered_device rdev = wiphy_to_rdev(wiphy);\nnet/wireless/mlme.c:283:#ifdef CONFIG_CFG80211_WEXT\nnet/wireless/mlme.c-284-\tunion iwreq_data wrqu;\n--\nnet/wireless/nl80211.c=5467=static int nl80211_set_key(struct sk_buff skb, struct genl_info info)\n--\nnet/wireless/nl80211.c-5509-\nnet/wireless/nl80211.c:5510:#ifdef CONFIG_CFG80211_WEXT\nnet/wireless/nl80211.c-5511-\t\twdev-\u003ewext.default_key = key.idx;\n--\nnet/wireless/nl80211.c-5532-\nnet/wireless/nl80211.c:5533:#ifdef CONFIG_CFG80211_WEXT\nnet/wireless/nl80211.c-5534-\t\twdev-\u003ewext.default_mgmt_key = key.idx;\n--\nnet/wireless/nl80211.c=5645=static int nl80211_del_key(struct sk_buff skb, struct genl_info info)\n--\nnet/wireless/nl80211.c-5691-\nnet/wireless/nl80211.c:5692:#ifdef CONFIG_CFG80211_WEXT\nnet/wireless/nl80211.c-5693-\tif (!err) {\n--\nnet/wireless/nl80211.c=10817=static int nl80211_get_reg_dump(struct sk_buff skb,\n--\nnet/wireless/nl80211.c-10858-\nnet/wireless/nl80211.c:10859:#ifdef CONFIG_CFG80211_CRDA_SUPPORT\nnet/wireless/nl80211.c-10860-static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {\n--\nnet/wireless/nl80211.c=10910=static int nl80211_set_reg(struct sk_buff skb, struct genl_info info)\n--\nnet/wireless/nl80211.c-10988-}\nnet/wireless/nl80211.c:10989:#endif / CONFIG_CFG80211_CRDA_SUPPORT /\nnet/wireless/nl80211.c-10990-\n--\nnet/wireless/nl80211.c=19746=static const struct genl_small_ops nl80211_small_ops[] = {\n--\nnet/wireless/nl80211.c-19919-\t},\nnet/wireless/nl80211.c:19920:#ifdef CONFIG_CFG80211_CRDA_SUPPORT\nnet/wireless/nl80211.c-19921-\t{\n--\nnet/wireless/nl80211.c=23419=void cfg80211_schedule_channels_check(struct wireless_dev wdev)\n--\nnet/wireless/nl80211.c-23426-\t\t\t\t NL80211_EXT_FEATURE_DFS_CONCURRENT) \|\|\nnet/wireless/nl80211.c:23427:\t (IS_ENABLED(CONFIG_CFG80211_REG_RELAX_NO_IR) \u0026\u0026\nnet/wireless/nl80211.c-23428-\t wiphy-\u003eregulatory_flags \u0026 REGULATORY_ENABLE_RELAX_NO_IR)))\n--\nnet/wireless/reg.c=497=static int reg_schedule_apply(const struct ieee80211_regdomain regdom)\n--\nnet/wireless/reg.c-516-\nnet/wireless/reg.c:517:#ifdef CONFIG_CFG80211_CRDA_SUPPORT\nnet/wireless/reg.c-518-/ Max number of consecutive attempts to communicate with CRDA /\n--\nnet/wireless/reg.c=586=static inline int call_crda(const char alpha2)\n--\nnet/wireless/reg.c-589-}\nnet/wireless/reg.c:590:#endif /* CONFIG_CFG80211_CRDA_SUPPORT /\nnet/wireless/reg.c-591-\n--\nnet/wireless/reg.c=697=static bool valid_country(const u8 data, unsigned int size,\n--\nnet/wireless/reg.c-729-\nnet/wireless/reg.c:730:#ifdef CONFIG_CFG80211_REQUIRE_SIGNED_REGDB\nnet/wireless/reg.c-731-#include \u003ckeys/asymmetric-type.h\u003e\n--\nnet/wireless/reg.c=735=static int __init load_builtin_regdb_keys(void)\n--\nnet/wireless/reg.c-747-\nnet/wireless/reg.c:748:#ifdef CONFIG_CFG80211_USE_KERNEL_REGDB_KEYS\nnet/wireless/reg.c-749-\tx509_load_certificate_list(shipped_regdb_certs,\n--\nnet/wireless/reg.c-752-#endif\nnet/wireless/reg.c:753:#ifdef CONFIG_CFG80211_EXTRA_REGDB_KEYDIR\nnet/wireless/reg.c:754:\tif (CONFIG_CFG80211_EXTRA_REGDB_KEYDIR[0] != '\\0')\nnet/wireless/reg.c-755-\t\tx509_load_certificate_list(extra_regdb_certs,\n--\nnet/wireless/reg.c=798=static void free_regdb_keyring(void)\n--\nnet/wireless/reg.c-800-}\nnet/wireless/reg.c:801:#endif /* CONFIG_CFG80211_REQUIRE_SIGNED_REGDB /\nnet/wireless/reg.c-802-\n--\nnet/wireless/reg.c=2038=bool reg_last_request_cell_base(void)\n--\nnet/wireless/reg.c-2042-\nnet/wireless/reg.c:2043:#ifdef CONFIG_CFG80211_REG_CELLULAR_HINTS\nnet/wireless/reg.c-2044-/ Core specific check /\n--\nnet/wireless/scan.c=1117=void ___cfg80211_scan_done(struct cfg80211_registered_device rdev,\n--\nnet/wireless/scan.c-1122-\tstruct sk_buff msg;\nnet/wireless/scan.c:1123:#ifdef CONFIG_CFG80211_WEXT\nnet/wireless/scan.c-1124-\tunion iwreq_data wrqu;\n--\nnet/wireless/scan.c-1165-\nnet/wireless/scan.c:1166:#ifdef CONFIG_CFG80211_WEXT\nnet/wireless/scan.c-1167-\tif (wdev-\u003enetdev \u0026\u0026 !request-\u003einfo.aborted) {\n--\nnet/wireless/scan.c=3443=void cfg80211_update_assoc_bss_entry(struct wireless_dev wdev,\n--\nnet/wireless/scan.c-3516-\nnet/wireless/scan.c:3517:#ifdef CONFIG_CFG80211_WEXT\nnet/wireless/scan.c-3518-static struct cfg80211_registered_device \n--\nnet/wireless/sme.c=735=void __cfg80211_connect_result(struct net_device dev,\n--\nnet/wireless/sme.c-743-\tu8 country_datalen;\nnet/wireless/sme.c:744:#ifdef CONFIG_CFG80211_WEXT\nnet/wireless/sme.c-745-\tunion iwreq_data wrqu;\n--\nnet/wireless/sme.c-774-\nnet/wireless/sme.c:775:#ifdef CONFIG_CFG80211_WEXT\nnet/wireless/sme.c-776-\tif (wextev \u0026\u0026 !cr-\u003evalid_links) {\n--\nnet/wireless/sme.c=1079=void __cfg80211_roamed(struct wireless_dev wdev,\n--\nnet/wireless/sme.c-1081-{\nnet/wireless/sme.c:1082:#ifdef CONFIG_CFG80211_WEXT\nnet/wireless/sme.c-1083-\tunion iwreq_data wrqu;\n--\nnet/wireless/sme.c-1134-\nnet/wireless/sme.c:1135:#ifdef CONFIG_CFG80211_WEXT\nnet/wireless/sme.c-1136-\tif (!info-\u003evalid_links) {\n--\nnet/wireless/sme.c=1343=void __cfg80211_disconnected(struct net_device dev, const u8 ie,\n--\nnet/wireless/sme.c-1348-\tint i;\nnet/wireless/sme.c:1349:#ifdef CONFIG_CFG80211_WEXT\nnet/wireless/sme.c-1350-\tunion iwreq_data wrqu;\n--\nnet/wireless/sme.c-1394-\nnet/wireless/sme.c:1395:#ifdef CONFIG_CFG80211_WEXT\nnet/wireless/sme.c-1396-\tmemset(\u0026wrqu, 0, sizeof(wrqu));\n--\nnet/wireless/tests/Makefile=1=cfg80211-tests-y += module.o fragmentation.o scan.o util.o chan.o\nnet/wireless/tests/Makefile-2-\nnet/wireless/tests/Makefile:3:obj-$(CONFIG_CFG80211_KUNIT_TEST) += cfg80211-tests.o\n--\nnet/wireless/wext-core.c=637=EXPORT_SYMBOL(wireless_send_event);\nnet/wireless/wext-core.c-638-\nnet/wireless/wext-core.c:639:#ifdef CONFIG_CFG80211_WEXT\nnet/wireless/wext-core.c-640-static void wireless_warn_cfg80211_wext(void)\n--\nnet/wireless/wext-core.c=649=struct iw_statistics get_wireless_stats(struct net_device dev)\n--\nnet/wireless/wext-core.c-656-\nnet/wireless/wext-core.c:657:#ifdef CONFIG_CFG80211_WEXT\nnet/wireless/wext-core.c-658-\tif (dev-\u003eieee80211_ptr \u0026\u0026\n--\nnet/wireless/wext-core.c=696=static iw_handler get_handler(struct net_device dev, unsigned int cmd)\n--\nnet/wireless/wext-core.c-701-\nnet/wireless/wext-core.c:702:#ifdef CONFIG_CFG80211_WEXT\nnet/wireless/wext-core.c-703-\tif (dev-\u003eieee80211_ptr \u0026\u0026 dev-\u003eieee80211_ptr-\u003ewiphy) {\n--\nnet/wireless/wext-proc.c=28=static void wireless_seq_printf_stats(struct seq_file *seq,\n--\nnet/wireless/wext-proc.c-40-#endif\nnet/wireless/wext-proc.c:41:#ifdef CONFIG_CFG80211\nnet/wireless/wext-proc.c-42-\t\tif (dev-\u003eieee80211_ptr)\n" }
5/2	2026/09/06 01:34	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 11705 output: 35 thoughts: 30 Thoughts: Here's my take on those thoughts: Analyzing the mac80211 Build Configuration Okay, time to dig into the `net/mac80211` directory. I'm thinking the best place to start understanding the build process and any configurable options is the `Makefile` and the `Kconfig` file. The `Makefile` will obviously tell me how the source files are compiled, linked, and how modules are created. I'll need to see the dependencies and potentially understand any build flags that are being used, especially those that might influence performance or feature enablement. The `Kconfig` file is crucial because that’s where the configuration options are defined. I need to see what features are configurable, what the dependencies are between those features, and how they relate to the overall build of the mac80211 subsystem. This should give me a solid handle on how the code is structured from a build perspective and how the various features are enabled and disabled based on the system's configuration. This information will be key to understanding how to tailor the driver for a particular environment.
6/2	2026/09/06 01:34	tool	grepper	0m Args: { "Expression": "MAC80211", "PathPrefix": "net/mac80211/" } Results: { "Output": "\nFull output is too long, showing 500 out of 975 lines.\nUse more precise expression if possible.\n\nnet/mac80211/Kconfig-1-# SPDX-License-Identifier: GPL-2.0-only\nnet/mac80211/Kconfig:2:config MAC80211\nnet/mac80211/Kconfig-3-\ttristate \"Generic IEEE 802.11 Networking Stack (mac80211)\"\n--\nnet/mac80211/Kconfig-15-\nnet/mac80211/Kconfig:16:comment \"CFG80211 needs to be enabled for MAC80211\"\nnet/mac80211/Kconfig-17-\tdepends on CFG80211=n\nnet/mac80211/Kconfig-18-\nnet/mac80211/Kconfig:19:if MAC80211 != n\nnet/mac80211/Kconfig-20-\nnet/mac80211/Kconfig:21:config MAC80211_HAS_RC\nnet/mac80211/Kconfig-22-\tbool\nnet/mac80211/Kconfig-23-\nnet/mac80211/Kconfig:24:config MAC80211_RC_MINSTREL\nnet/mac80211/Kconfig-25-\tbool \"Minstrel\" if EXPERT\nnet/mac80211/Kconfig:26:\tselect MAC80211_HAS_RC\nnet/mac80211/Kconfig-27-\tdefault y\n--\nnet/mac80211/Kconfig=31=choice\nnet/mac80211/Kconfig-32-\tprompt \"Default rate control algorithm\"\nnet/mac80211/Kconfig:33:\tdepends on MAC80211_HAS_RC\nnet/mac80211/Kconfig:34:\tdefault MAC80211_RC_DEFAULT_MINSTREL\nnet/mac80211/Kconfig-35-\thelp\n--\nnet/mac80211/Kconfig-40-\nnet/mac80211/Kconfig:41:config MAC80211_RC_DEFAULT_MINSTREL\nnet/mac80211/Kconfig-42-\tbool \"Minstrel\"\nnet/mac80211/Kconfig:43:\tdepends on MAC80211_RC_MINSTREL\nnet/mac80211/Kconfig-44-\thelp\n--\nnet/mac80211/Kconfig=48=endchoice\nnet/mac80211/Kconfig-49-\nnet/mac80211/Kconfig:50:config MAC80211_RC_DEFAULT\nnet/mac80211/Kconfig-51-\tstring\nnet/mac80211/Kconfig:52:\tdefault \"minstrel_ht\" if MAC80211_RC_DEFAULT_MINSTREL\nnet/mac80211/Kconfig-53-\tdefault \"\"\n--\nnet/mac80211/Kconfig=57=comment \"Some wireless drivers require a rate control algorithm\"\nnet/mac80211/Kconfig:58:\tdepends on MAC80211 \u0026\u0026 MAC80211_HAS_RC=n\nnet/mac80211/Kconfig-59-\nnet/mac80211/Kconfig:60:config MAC80211_KUNIT_TEST\nnet/mac80211/Kconfig-61-\ttristate \"KUnit tests for mac80211\" if !KUNIT_ALL_TESTS\nnet/mac80211/Kconfig-62-\tdepends on KUNIT\nnet/mac80211/Kconfig:63:\tdepends on MAC80211\nnet/mac80211/Kconfig-64-\tdefault KUNIT_ALL_TESTS\n--\nnet/mac80211/Kconfig-69-\nnet/mac80211/Kconfig:70:config MAC80211_MESH\nnet/mac80211/Kconfig-71-\tbool \"Enable mac80211 mesh networking support\"\nnet/mac80211/Kconfig:72:\tdepends on MAC80211\nnet/mac80211/Kconfig-73-\thelp\n--\nnet/mac80211/Kconfig-78-\nnet/mac80211/Kconfig:79:config MAC80211_LEDS\nnet/mac80211/Kconfig-80-\tbool \"Enable LED triggers\"\nnet/mac80211/Kconfig:81:\tdepends on MAC80211\nnet/mac80211/Kconfig:82:\tdepends on LEDS_CLASS=y \|\| LEDS_CLASS=MAC80211\nnet/mac80211/Kconfig-83-\tselect LEDS_TRIGGERS\n--\nnet/mac80211/Kconfig-87-\nnet/mac80211/Kconfig:88:config MAC80211_DEBUGFS\nnet/mac80211/Kconfig-89-\tbool \"Export mac80211 internals in DebugFS\"\nnet/mac80211/Kconfig:90:\tdepends on MAC80211 \u0026\u0026 CFG80211_DEBUGFS\nnet/mac80211/Kconfig-91-\thelp\n--\nnet/mac80211/Kconfig-96-\nnet/mac80211/Kconfig:97:config MAC80211_MESSAGE_TRACING\nnet/mac80211/Kconfig-98-\tbool \"Trace all mac80211 debug messages\"\nnet/mac80211/Kconfig:99:\tdepends on MAC80211 \u0026\u0026 TRACING\nnet/mac80211/Kconfig-100-\thelp\n--\nnet/mac80211/Kconfig-109-\nnet/mac80211/Kconfig:110:menuconfig MAC80211_DEBUG_MENU\nnet/mac80211/Kconfig-111-\tbool \"Select mac80211 debugging features\"\nnet/mac80211/Kconfig:112:\tdepends on MAC80211\nnet/mac80211/Kconfig-113-\thelp\n--\nnet/mac80211/Kconfig-115-\nnet/mac80211/Kconfig:116:config MAC80211_NOINLINE\nnet/mac80211/Kconfig-117-\tbool \"Do not inline TX/RX handlers\"\nnet/mac80211/Kconfig:118:\tdepends on MAC80211_DEBUG_MENU\nnet/mac80211/Kconfig-119-\thelp\n--\nnet/mac80211/Kconfig-131-\nnet/mac80211/Kconfig:132:config MAC80211_VERBOSE_DEBUG\nnet/mac80211/Kconfig-133-\tbool \"Verbose debugging output\"\nnet/mac80211/Kconfig:134:\tdepends on MAC80211_DEBUG_MENU\nnet/mac80211/Kconfig-135-\thelp\n--\nnet/mac80211/Kconfig-142-\nnet/mac80211/Kconfig:143:config MAC80211_MLME_DEBUG\nnet/mac80211/Kconfig-144-\tbool \"Verbose managed MLME output\"\nnet/mac80211/Kconfig:145:\tdepends on MAC80211_DEBUG_MENU\nnet/mac80211/Kconfig-146-\thelp\n--\nnet/mac80211/Kconfig-153-\nnet/mac80211/Kconfig:154:config MAC80211_STA_DEBUG\nnet/mac80211/Kconfig-155-\tbool \"Verbose station debugging\"\nnet/mac80211/Kconfig:156:\tdepends on MAC80211_DEBUG_MENU\nnet/mac80211/Kconfig-157-\thelp\n--\nnet/mac80211/Kconfig-162-\nnet/mac80211/Kconfig:163:config MAC80211_HT_DEBUG\nnet/mac80211/Kconfig-164-\tbool \"Verbose HT debugging\"\nnet/mac80211/Kconfig:165:\tdepends on MAC80211_DEBUG_MENU\nnet/mac80211/Kconfig-166-\thelp\n--\nnet/mac80211/Kconfig-174-\nnet/mac80211/Kconfig:175:config MAC80211_OCB_DEBUG\nnet/mac80211/Kconfig-176-\tbool \"Verbose OCB debugging\"\nnet/mac80211/Kconfig:177:\tdepends on MAC80211_DEBUG_MENU\nnet/mac80211/Kconfig-178-\thelp\n--\nnet/mac80211/Kconfig-185-\nnet/mac80211/Kconfig:186:config MAC80211_IBSS_DEBUG\nnet/mac80211/Kconfig-187-\tbool \"Verbose IBSS debugging\"\nnet/mac80211/Kconfig:188:\tdepends on MAC80211_DEBUG_MENU\nnet/mac80211/Kconfig-189-\thelp\n--\nnet/mac80211/Kconfig-196-\nnet/mac80211/Kconfig:197:config MAC80211_PS_DEBUG\nnet/mac80211/Kconfig-198-\tbool \"Verbose powersave mode debugging\"\nnet/mac80211/Kconfig:199:\tdepends on MAC80211_DEBUG_MENU\nnet/mac80211/Kconfig-200-\thelp\n--\nnet/mac80211/Kconfig-208-\nnet/mac80211/Kconfig:209:config MAC80211_MPL_DEBUG\nnet/mac80211/Kconfig-210-\tbool \"Verbose mesh peer link debugging\"\nnet/mac80211/Kconfig:211:\tdepends on MAC80211_DEBUG_MENU\nnet/mac80211/Kconfig:212:\tdepends on MAC80211_MESH\nnet/mac80211/Kconfig-213-\thelp\n--\nnet/mac80211/Kconfig-221-\nnet/mac80211/Kconfig:222:config MAC80211_MPATH_DEBUG\nnet/mac80211/Kconfig-223-\tbool \"Verbose mesh path debugging\"\nnet/mac80211/Kconfig:224:\tdepends on MAC80211_DEBUG_MENU\nnet/mac80211/Kconfig:225:\tdepends on MAC80211_MESH\nnet/mac80211/Kconfig-226-\thelp\n--\nnet/mac80211/Kconfig-234-\nnet/mac80211/Kconfig:235:config MAC80211_MHWMP_DEBUG\nnet/mac80211/Kconfig-236-\tbool \"Verbose mesh HWMP routing debugging\"\nnet/mac80211/Kconfig:237:\tdepends on MAC80211_DEBUG_MENU\nnet/mac80211/Kconfig:238:\tdepends on MAC80211_MESH\nnet/mac80211/Kconfig-239-\thelp\n--\nnet/mac80211/Kconfig-247-\nnet/mac80211/Kconfig:248:config MAC80211_MESH_SYNC_DEBUG\nnet/mac80211/Kconfig-249-\tbool \"Verbose mesh synchronization debugging\"\nnet/mac80211/Kconfig:250:\tdepends on MAC80211_DEBUG_MENU\nnet/mac80211/Kconfig:251:\tdepends on MAC80211_MESH\nnet/mac80211/Kconfig-252-\thelp\n--\nnet/mac80211/Kconfig-258-\nnet/mac80211/Kconfig:259:config MAC80211_MESH_CSA_DEBUG\nnet/mac80211/Kconfig-260-\tbool \"Verbose mesh channel switch debugging\"\nnet/mac80211/Kconfig:261:\tdepends on MAC80211_DEBUG_MENU\nnet/mac80211/Kconfig:262:\tdepends on MAC80211_MESH\nnet/mac80211/Kconfig-263-\thelp\n--\nnet/mac80211/Kconfig-269-\nnet/mac80211/Kconfig:270:config MAC80211_MESH_PS_DEBUG\nnet/mac80211/Kconfig-271-\tbool \"Verbose mesh powersave debugging\"\nnet/mac80211/Kconfig:272:\tdepends on MAC80211_DEBUG_MENU\nnet/mac80211/Kconfig:273:\tdepends on MAC80211_MESH\nnet/mac80211/Kconfig-274-\thelp\n--\nnet/mac80211/Kconfig-280-\nnet/mac80211/Kconfig:281:config MAC80211_TDLS_DEBUG\nnet/mac80211/Kconfig-282-\tbool \"Verbose TDLS debugging\"\nnet/mac80211/Kconfig:283:\tdepends on MAC80211_DEBUG_MENU\nnet/mac80211/Kconfig-284-\thelp\n--\nnet/mac80211/Kconfig-292-\nnet/mac80211/Kconfig:293:config MAC80211_DEBUG_COUNTERS\nnet/mac80211/Kconfig-294-\tbool \"Extra statistics for TX/RX debugging\"\nnet/mac80211/Kconfig:295:\tdepends on MAC80211_DEBUG_MENU\nnet/mac80211/Kconfig:296:\tdepends on MAC80211_DEBUGFS\nnet/mac80211/Kconfig-297-\thelp\n--\nnet/mac80211/Kconfig-307-\nnet/mac80211/Kconfig:308:config MAC80211_STA_HASH_MAX_SIZE\nnet/mac80211/Kconfig:309:\tint \"Station hash table maximum size\" if MAC80211_DEBUG_MENU\nnet/mac80211/Kconfig-310-\tdefault 0\n--\nnet/mac80211/Makefile-1-# SPDX-License-Identifier: GPL-2.0\nnet/mac80211/Makefile:2:obj-$(CONFIG_MAC80211) += mac80211.o\nnet/mac80211/Makefile-3-\n--\nnet/mac80211/Makefile=5=mac80211-y := \\\n--\nnet/mac80211/Makefile-39-\nnet/mac80211/Makefile:40:mac80211-$(CONFIG_MAC80211_LEDS) += led.o\nnet/mac80211/Makefile:41:mac80211-$(CONFIG_MAC80211_DEBUGFS) += \\\nnet/mac80211/Makefile-42-\tdebugfs.o \\\n--\nnet/mac80211/Makefile-46-\nnet/mac80211/Makefile:47:mac80211-$(CONFIG_MAC80211_MESH) += \\\nnet/mac80211/Makefile-48-\tmesh.o \\\n--\nnet/mac80211/Makefile=59=rc80211_minstrel-y := \\\n--\nnet/mac80211/Makefile-61-\nnet/mac80211/Makefile:62:rc80211_minstrel-$(CONFIG_MAC80211_DEBUGFS) += \\\nnet/mac80211/Makefile-63-\trc80211_minstrel_ht_debugfs.o\nnet/mac80211/Makefile-64-\nnet/mac80211/Makefile:65:mac80211-$(CONFIG_MAC80211_RC_MINSTREL) += $(rc80211_minstrel-y)\nnet/mac80211/Makefile-66-\n--\nnet/mac80211/cfg.c=613=static int ieee80211_add_key(struct wiphy wiphy, struct wireless_dev wdev,\n--\nnet/mac80211/cfg.c-710-\tcase NL80211_IFTYPE_MESH_POINT:\nnet/mac80211/cfg.c:711:#ifdef CONFIG_MAC80211_MESH\nnet/mac80211/cfg.c-712-\t\tif (sdata-\u003eu.mesh.security != IEEE80211_MESH_SEC_NONE)\n--\nnet/mac80211/cfg.c=2190=static void sta_apply_mesh_params(struct ieee80211_local local,\n--\nnet/mac80211/cfg.c-2193-{\nnet/mac80211/cfg.c:2194:#ifdef CONFIG_MAC80211_MESH\nnet/mac80211/cfg.c-2195-\tstruct ieee80211_sub_if_data sdata = sta-\u003esdata;\n--\nnet/mac80211/cfg.c=2787=static int ieee80211_change_station(struct wiphy wiphy,\n--\nnet/mac80211/cfg.c-2893-\nnet/mac80211/cfg.c:2894:#ifdef CONFIG_MAC80211_MESH\nnet/mac80211/cfg.c-2895-static int ieee80211_add_mpath(struct wiphy wiphy, struct net_device dev,\n--\nnet/mac80211/cfg.c=4428=static int ieee80211_set_after_csa_beacon(struct ieee80211_link_data link_data,\n--\nnet/mac80211/cfg.c-4451-\t\tbreak;\nnet/mac80211/cfg.c:4452:#ifdef CONFIG_MAC80211_MESH\nnet/mac80211/cfg.c-4453-\tcase NL80211_IFTYPE_MESH_POINT:\n--\nnet/mac80211/cfg.c=4563=static int ieee80211_set_csa_beacon(struct ieee80211_link_data link_data,\n--\nnet/mac80211/cfg.c-4654-\t\tbreak;\nnet/mac80211/cfg.c:4655:#ifdef CONFIG_MAC80211_MESH\nnet/mac80211/cfg.c-4656-\tcase NL80211_IFTYPE_MESH_POINT: {\n--\nnet/mac80211/cfg.c=5976=const struct cfg80211_ops mac80211_config_ops = {\n--\nnet/mac80211/cfg.c-5996-\t.dump_survey = ieee80211_dump_survey,\nnet/mac80211/cfg.c:5997:#ifdef CONFIG_MAC80211_MESH\nnet/mac80211/cfg.c-5998-\t.add_mpath = ieee80211_add_mpath,\n--\nnet/mac80211/debug.h-5- /\nnet/mac80211/debug.h:6:#ifndef __MAC80211_DEBUG_H\nnet/mac80211/debug.h:7:#define __MAC80211_DEBUG_H\nnet/mac80211/debug.h-8-#include \u003clinux/once_lite.h\u003e\n--\nnet/mac80211/debug.h-10-\nnet/mac80211/debug.h:11:#ifdef CONFIG_MAC80211_OCB_DEBUG\nnet/mac80211/debug.h:12:#define MAC80211_OCB_DEBUG 1\nnet/mac80211/debug.h-13-#else\nnet/mac80211/debug.h:14:#define MAC80211_OCB_DEBUG 0\nnet/mac80211/debug.h-15-#endif\nnet/mac80211/debug.h-16-\nnet/mac80211/debug.h:17:#ifdef CONFIG_MAC80211_IBSS_DEBUG\nnet/mac80211/debug.h:18:#define MAC80211_IBSS_DEBUG 1\nnet/mac80211/debug.h-19-#else\nnet/mac80211/debug.h:20:#define MAC80211_IBSS_DEBUG 0\nnet/mac80211/debug.h-21-#endif\nnet/mac80211/debug.h-22-\nnet/mac80211/debug.h:23:#ifdef CONFIG_MAC80211_PS_DEBUG\nnet/mac80211/debug.h:24:#define MAC80211_PS_DEBUG 1\nnet/mac80211/debug.h-25-#else\nnet/mac80211/debug.h:26:#define MAC80211_PS_DEBUG 0\nnet/mac80211/debug.h-27-#endif\nnet/mac80211/debug.h-28-\nnet/mac80211/debug.h:29:#ifdef CONFIG_MAC80211_HT_DEBUG\nnet/mac80211/debug.h:30:#define MAC80211_HT_DEBUG 1\nnet/mac80211/debug.h-31-#else\nnet/mac80211/debug.h:32:#define MAC80211_HT_DEBUG 0\nnet/mac80211/debug.h-33-#endif\nnet/mac80211/debug.h-34-\nnet/mac80211/debug.h:35:#ifdef CONFIG_MAC80211_MPL_DEBUG\nnet/mac80211/debug.h:36:#define MAC80211_MPL_DEBUG 1\nnet/mac80211/debug.h-37-#else\nnet/mac80211/debug.h:38:#define MAC80211_MPL_DEBUG 0\nnet/mac80211/debug.h-39-#endif\nnet/mac80211/debug.h-40-\nnet/mac80211/debug.h:41:#ifdef CONFIG_MAC80211_MPATH_DEBUG\nnet/mac80211/debug.h:42:#define MAC80211_MPATH_DEBUG 1\nnet/mac80211/debug.h-43-#else\nnet/mac80211/debug.h:44:#define MAC80211_MPATH_DEBUG 0\nnet/mac80211/debug.h-45-#endif\nnet/mac80211/debug.h-46-\nnet/mac80211/debug.h:47:#ifdef CONFIG_MAC80211_MHWMP_DEBUG\nnet/mac80211/debug.h:48:#define MAC80211_MHWMP_DEBUG 1\nnet/mac80211/debug.h-49-#else\nnet/mac80211/debug.h:50:#define MAC80211_MHWMP_DEBUG 0\nnet/mac80211/debug.h-51-#endif\nnet/mac80211/debug.h-52-\nnet/mac80211/debug.h:53:#ifdef CONFIG_MAC80211_MESH_SYNC_DEBUG\nnet/mac80211/debug.h:54:#define MAC80211_MESH_SYNC_DEBUG 1\nnet/mac80211/debug.h-55-#else\nnet/mac80211/debug.h:56:#define MAC80211_MESH_SYNC_DEBUG 0\nnet/mac80211/debug.h-57-#endif\nnet/mac80211/debug.h-58-\nnet/mac80211/debug.h:59:#ifdef CONFIG_MAC80211_MESH_CSA_DEBUG\nnet/mac80211/debug.h:60:#define MAC80211_MESH_CSA_DEBUG 1\nnet/mac80211/debug.h-61-#else\nnet/mac80211/debug.h:62:#define MAC80211_MESH_CSA_DEBUG 0\nnet/mac80211/debug.h-63-#endif\nnet/mac80211/debug.h-64-\nnet/mac80211/debug.h:65:#ifdef CONFIG_MAC80211_MESH_PS_DEBUG\nnet/mac80211/debug.h:66:#define MAC80211_MESH_PS_DEBUG 1\nnet/mac80211/debug.h-67-#else\nnet/mac80211/debug.h:68:#define MAC80211_MESH_PS_DEBUG 0\nnet/mac80211/debug.h-69-#endif\nnet/mac80211/debug.h-70-\nnet/mac80211/debug.h:71:#ifdef CONFIG_MAC80211_TDLS_DEBUG\nnet/mac80211/debug.h:72:#define MAC80211_TDLS_DEBUG 1\nnet/mac80211/debug.h-73-#else\nnet/mac80211/debug.h:74:#define MAC80211_TDLS_DEBUG 0\nnet/mac80211/debug.h-75-#endif\nnet/mac80211/debug.h-76-\nnet/mac80211/debug.h:77:#ifdef CONFIG_MAC80211_STA_DEBUG\nnet/mac80211/debug.h:78:#define MAC80211_STA_DEBUG 1\nnet/mac80211/debug.h-79-#else\nnet/mac80211/debug.h:80:#define MAC80211_STA_DEBUG 0\nnet/mac80211/debug.h-81-#endif\nnet/mac80211/debug.h-82-\nnet/mac80211/debug.h:83:#ifdef CONFIG_MAC80211_MLME_DEBUG\nnet/mac80211/debug.h:84:#define MAC80211_MLME_DEBUG 1\nnet/mac80211/debug.h-85-#else\nnet/mac80211/debug.h:86:#define MAC80211_MLME_DEBUG 0\nnet/mac80211/debug.h-87-#endif\nnet/mac80211/debug.h-88-\nnet/mac80211/debug.h:89:#ifdef CONFIG_MAC80211_MESSAGE_TRACING\nnet/mac80211/debug.h-90-void __sdata_info(const char fmt, ...) __printf(1, 2);\n--\nnet/mac80211/debug.h=125=do {\t\t\t\t\t\t\t\t\t\\\n--\nnet/mac80211/debug.h-178-#define ht_dbg(sdata, fmt, ...)\t\t\t\t\t\t\\\nnet/mac80211/debug.h:179:\t_sdata_dbg(MAC80211_HT_DEBUG,\t\t\t\t\t\\\nnet/mac80211/debug.h-180-\t\t sdata, fmt, ##__VA_ARGS__)\n--\nnet/mac80211/debug.h-182-#define ht_dbg_ratelimited(sdata, fmt, ...)\t\t\t\t\\\nnet/mac80211/debug.h:183:\t_sdata_dbg(MAC80211_HT_DEBUG \u0026\u0026 net_ratelimit(),\t\t\\\nnet/mac80211/debug.h-184-\t\t sdata, fmt, ##__VA_ARGS__)\n--\nnet/mac80211/debug.h-186-#define ocb_dbg(sdata, fmt, ...)\t\t\t\t\t\\\nnet/mac80211/debug.h:187:\t_sdata_dbg(MAC80211_OCB_DEBUG,\t\t\t\t\t\\\nnet/mac80211/debug.h-188-\t\t sdata, fmt, ##__VA_ARGS__)\n--\nnet/mac80211/debug.h-190-#define ibss_dbg(sdata, fmt, ...)\t\t\t\t\t\\\nnet/mac80211/debug.h:191:\t_sdata_dbg(MAC80211_IBSS_DEBUG,\t\t\t\t\t\\\nnet/mac80211/debug.h-192-\t\t sdata, fmt, ##__VA_ARGS__)\n--\nnet/mac80211/debug.h-194-#define ps_dbg(sdata, fmt, ...)\t\t\t\t\t\t\\\nnet/mac80211/debug.h:195:\t_sdata_dbg(MAC80211_PS_DEBUG,\t\t\t\t\t\\\nnet/mac80211/debug.h-196-\t\t sdata, fmt, ##__VA_ARGS__)\n--\nnet/mac80211/debug.h-198-#define ps_dbg_hw(hw, fmt, ...)\t\t\t\t\t\t\\\nnet/mac80211/debug.h:199:\t_wiphy_dbg(MAC80211_PS_DEBUG,\t\t\t\t\t\\\nnet/mac80211/debug.h-200-\t\t (hw)-\u003ewiphy, fmt, ##__VA_ARGS__)\n--\nnet/mac80211/debug.h-202-#define ps_dbg_ratelimited(sdata, fmt, ...)\t\t\t\t\\\nnet/mac80211/debug.h:203:\t_sdata_dbg(MAC80211_PS_DEBUG \u0026\u0026 net_ratelimit(),\t\t\\\nnet/mac80211/debug.h-204-\t\t sdata, fmt, ##__VA_ARGS__)\n--\nnet/mac80211/debug.h-206-#define mpl_dbg(sdata, fmt, ...)\t\t\t\t\t\\\nnet/mac80211/debug.h:207:\t_sdata_dbg(MAC80211_MPL_DEBUG,\t\t\t\t\t\\\nnet/mac80211/debug.h-208-\t\t sdata, fmt, ##__VA_ARGS__)\n--\nnet/mac80211/debug.h-210-#define mpath_dbg(sdata, fmt, ...)\t\t\t\t\t\\\nnet/mac80211/debug.h:211:\t_sdata_dbg(MAC80211_MPATH_DEBUG,\t\t\t\t\\\nnet/mac80211/debug.h-212-\t\t sdata, fmt, ##__VA_ARGS__)\n--\nnet/mac80211/debug.h-214-#define mhwmp_dbg(sdata, fmt, ...)\t\t\t\t\t\\\nnet/mac80211/debug.h:215:\t_sdata_dbg(MAC80211_MHWMP_DEBUG,\t\t\t\t\\\nnet/mac80211/debug.h-216-\t\t sdata, fmt, ##__VA_ARGS__)\n--\nnet/mac80211/debug.h-218-#define msync_dbg(sdata, fmt, ...)\t\t\t\t\t\\\nnet/mac80211/debug.h:219:\t_sdata_dbg(MAC80211_MESH_SYNC_DEBUG,\t\t\t\t\\\nnet/mac80211/debug.h-220-\t\t sdata, fmt, ##__VA_ARGS__)\n--\nnet/mac80211/debug.h-222-#define mcsa_dbg(sdata, fmt, ...)\t\t\t\t\t\\\nnet/mac80211/debug.h:223:\t_sdata_dbg(MAC80211_MESH_CSA_DEBUG,\t\t\t\t\\\nnet/mac80211/debug.h-224-\t\t sdata, fmt, ##__VA_ARGS__)\n--\nnet/mac80211/debug.h-226-#define mps_dbg(sdata, fmt, ...)\t\t\t\t\t\\\nnet/mac80211/debug.h:227:\t_sdata_dbg(MAC80211_MESH_PS_DEBUG,\t\t\t\t\\\nnet/mac80211/debug.h-228-\t\t sdata, fmt, ##__VA_ARGS__)\n--\nnet/mac80211/debug.h-230-#define tdls_dbg(sdata, fmt, ...)\t\t\t\t\t\\\nnet/mac80211/debug.h:231:\t_sdata_dbg(MAC80211_TDLS_DEBUG,\t\t\t\t\t\\\nnet/mac80211/debug.h-232-\t\t sdata, fmt, ##__VA_ARGS__)\n--\nnet/mac80211/debug.h-234-#define sta_dbg(sdata, fmt, ...)\t\t\t\t\t\\\nnet/mac80211/debug.h:235:\t_sdata_dbg(MAC80211_STA_DEBUG,\t\t\t\t\t\\\nnet/mac80211/debug.h-236-\t\t sdata, fmt, ##__VA_ARGS__)\n--\nnet/mac80211/debug.h-238-#define mlme_dbg(sdata, fmt, ...)\t\t\t\t\t\\\nnet/mac80211/debug.h:239:\t_sdata_dbg(MAC80211_MLME_DEBUG,\t\t\t\t\t\\\nnet/mac80211/debug.h-240-\t\t sdata, fmt, ##__VA_ARGS__)\nnet/mac80211/debug.h-241-#define mlme_link_id_dbg(sdata, link_id, fmt, ...)\t\t\t\\\nnet/mac80211/debug.h:242:\t_link_id_dbg(MAC80211_MLME_DEBUG, sdata, link_id,\t\t\\\nnet/mac80211/debug.h-243-\t\t fmt, ##__VA_ARGS__)\n--\nnet/mac80211/debug.h-245-#define mlme_dbg_ratelimited(sdata, fmt, ...)\t\t\t\t\\\nnet/mac80211/debug.h:246:\t_sdata_dbg(MAC80211_MLME_DEBUG \u0026\u0026 net_ratelimit(),\t\t\\\nnet/mac80211/debug.h-247-\t\t sdata, fmt, ##__VA_ARGS__)\nnet/mac80211/debug.h-248-\nnet/mac80211/debug.h:249:#endif / __MAC80211_DEBUG_H /\n--\nnet/mac80211/debugfs.c=628=static const struct debugfs_short_fops stats_ ##name## _ops = {\t\t\t\\\n--\nnet/mac80211/debugfs.c-632-\nnet/mac80211/debugfs.c:633:#ifdef CONFIG_MAC80211_DEBUG_COUNTERS\nnet/mac80211/debugfs.c-634-#define DEBUGFS_STATS_ADD(name)\t\t\t\t\t\\\n--\nnet/mac80211/debugfs.c=645=void debugfs_hw_add(struct ieee80211_local local)\n--\nnet/mac80211/debugfs.c-679-\nnet/mac80211/debugfs.c:680:#ifdef CONFIG_MAC80211_DEBUG_COUNTERS\nnet/mac80211/debugfs.c-681-\tDEBUGFS_STATS_ADD(dot11TransmittedFragmentCount);\n--\nnet/mac80211/debugfs.h-1-/* SPDX-License-Identifier: GPL-2.0 /\nnet/mac80211/debugfs.h:2:#ifndef __MAC80211_DEBUGFS_H\nnet/mac80211/debugfs.h:3:#define __MAC80211_DEBUGFS_H\nnet/mac80211/debugfs.h-4-\n--\nnet/mac80211/debugfs.h-6-\nnet/mac80211/debugfs.h:7:#ifdef CONFIG_MAC80211_DEBUGFS\nnet/mac80211/debugfs.h-8-void debugfs_hw_add(struct ieee80211_local local);\n--\nnet/mac80211/debugfs.h=12=static inline void debugfs_hw_add(struct ieee80211_local local)\n--\nnet/mac80211/debugfs.h-16-\nnet/mac80211/debugfs.h:17:#endif / __MAC80211_DEBUGFS_H /\n--\nnet/mac80211/debugfs_key.h-1-/ SPDX-License-Identifier: GPL-2.0 /\nnet/mac80211/debugfs_key.h:2:#ifndef __MAC80211_DEBUGFS_KEY_H\nnet/mac80211/debugfs_key.h:3:#define __MAC80211_DEBUGFS_KEY_H\nnet/mac80211/debugfs_key.h-4-\nnet/mac80211/debugfs_key.h:5:#ifdef CONFIG_MAC80211_DEBUGFS\nnet/mac80211/debugfs_key.h-6-void ieee80211_debugfs_key_add(struct ieee80211_key key);\n--\nnet/mac80211/debugfs_key.h=24=static inline void ieee80211_debugfs_key_remove_beacon_default(\n--\nnet/mac80211/debugfs_key.h-28-\nnet/mac80211/debugfs_key.h:29:#endif /* __MAC80211_DEBUGFS_KEY_H /\n--\nnet/mac80211/debugfs_netdev.c=736=IEEE80211_IF_LINK_FILE(addr, conf-\u003eaddr, MAC);\nnet/mac80211/debugfs_netdev.c-737-\nnet/mac80211/debugfs_netdev.c:738:#ifdef CONFIG_MAC80211_MESH\nnet/mac80211/debugfs_netdev.c-739-IEEE80211_IF_FILE(estab_plinks, u.mesh.estab_plinks, ATOMIC);\n--\nnet/mac80211/debugfs_netdev.c=868=static void add_ibss_files(struct ieee80211_sub_if_data sdata)\n--\nnet/mac80211/debugfs_netdev.c-872-\nnet/mac80211/debugfs_netdev.c:873:#ifdef CONFIG_MAC80211_MESH\nnet/mac80211/debugfs_netdev.c-874-\n--\nnet/mac80211/debugfs_netdev.c=937=static void add_files(struct ieee80211_sub_if_data sdata)\n--\nnet/mac80211/debugfs_netdev.c-949-\tcase NL80211_IFTYPE_MESH_POINT:\nnet/mac80211/debugfs_netdev.c:950:#ifdef CONFIG_MAC80211_MESH\nnet/mac80211/debugfs_netdev.c-951-\t\tadd_mesh_files(sdata);\n--\nnet/mac80211/debugfs_netdev.h-12-\nnet/mac80211/debugfs_netdev.h:13:#ifdef CONFIG_MAC80211_DEBUGFS\nnet/mac80211/debugfs_netdev.h-14-void ieee80211_debugfs_remove_netdev(struct ieee80211_sub_if_data sdata);\n--\nnet/mac80211/debugfs_sta.h-1-/* SPDX-License-Identifier: GPL-2.0 /\nnet/mac80211/debugfs_sta.h:2:#ifndef __MAC80211_DEBUGFS_STA_H\nnet/mac80211/debugfs_sta.h:3:#define __MAC80211_DEBUGFS_STA_H\nnet/mac80211/debugfs_sta.h-4-\n--\nnet/mac80211/debugfs_sta.h-6-\nnet/mac80211/debugfs_sta.h:7:#ifdef CONFIG_MAC80211_DEBUGFS\nnet/mac80211/debugfs_sta.h-8-void ieee80211_sta_debugfs_add(struct sta_info sta);\n--\nnet/mac80211/debugfs_sta.h=24=static inline void ieee80211_link_sta_debugfs_drv_remove(struct link_sta_info link_sta) {}\n--\nnet/mac80211/debugfs_sta.h-26-\nnet/mac80211/debugfs_sta.h:27:#endif / __MAC80211_DEBUGFS_STA_H /\n--\nnet/mac80211/driver-ops.h-7-\nnet/mac80211/driver-ops.h:8:#ifndef __MAC80211_DRIVER_OPS\nnet/mac80211/driver-ops.h:9:#define __MAC80211_DRIVER_OPS\nnet/mac80211/driver-ops.h-10-\n--\nnet/mac80211/driver-ops.h=477=static inline void drv_sta_remove(struct ieee80211_local local,\n--\nnet/mac80211/driver-ops.h-494-\nnet/mac80211/driver-ops.h:495:#ifdef CONFIG_MAC80211_DEBUGFS\nnet/mac80211/driver-ops.h-496-static inline void drv_vif_add_debugfs(struct ieee80211_local local,\n--\nnet/mac80211/driver-ops.h=1797=drv_nan_peer_sched_changed(struct ieee80211_local local,\n--\nnet/mac80211/driver-ops.h-1816-\nnet/mac80211/driver-ops.h:1817:#endif /* __MAC80211_DRIVER_OPS */\n--\nnet/mac80211/drop.h-7-\nnet/mac80211/drop.h:8:#ifndef MAC80211_DROP_H\nnet/mac80211/drop.h:9:#define MAC80211_DROP_H\nnet/mac80211/drop.h-10-#include \u003cnet/dropreason.h\u003e\n\n" }
7/2	2026/09/06 01:34	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 23544 output: 41 thoughts: 59 Thoughts: Here's my take on the process, thinking through the code: Diving into the Interface Lifecycle Okay, so I need to understand the complete picture of how these wireless interfaces are initialized, uninitialized, and generally managed in the kernel's mac80211 subsystem. I'm going to jump straight into `net/mac80211/iface.c`. This seems like the obvious place to find the central logic for interface operations. I'm specifically interested in the uninitialization path and how interfaces get taken down. I want to see exactly where `ieee80211_uninit` and `ieee80211_unlist_sdata` are being called. Knowing the call stack around these functions will be crucial. I need to understand the context of their use to better troubleshoot or modify the interface management process. I'm expecting this will provide the bigger picture and help me reason about potential issues around interface removal and teardown.
8/2	2026/09/06 01:34	tool	read-file	0m Args: { "File": "net/mac80211/iface.c", "FirstLine": 915, "LineCount": 60 } Results: { "Contents": " 915:\t\tieee80211_vif_clear_links(sdata);\n 916:\t\tieee80211_link_stop(\u0026sdata-\u003edeflink);\n 917:\t\n 918:\t\tif (sdata-\u003evif.type == NL80211_IFTYPE_NAN) {\n 919:\t\t\tstruct ieee80211_nan_sched_cfg nan_sched =\n 920:\t\t\t\t\u0026sdata-\u003evif.cfg.nan_sched;\n 921:\t\n 922:\t\t\tfor (int i = 0; i \u003c ARRAY_SIZE(nan_sched-\u003echannels); i++)\n 923:\t\t\t\tWARN_ON(nan_sched-\u003echannels[i].chanreq.oper.chan);\n 924:\t\t}\n 925:\t}\n 926:\t\n 927:\t/\n 928:\t * The netdev can be unregistered without mac80211 doing it, e.g. by the netdev\n 929:\t * core when cfg80211 couldn't move it out of a network namespace that's being\n 930:\t * destroyed. Drop it from the interface list either way.\n 931:\t /\n 932:\tstatic void ieee80211_unlist_sdata(struct ieee80211_sub_if_data sdata)\n 933:\t{\n 934:\t\tstruct ieee80211_local local = sdata-\u003elocal;\n 935:\t\tstruct ieee80211_sub_if_data iter;\n 936:\t\n 937:\t\tASSERT_RTNL();\n 938:\t\n 939:\t\tlist_for_each_entry(iter, \u0026local-\u003einterfaces, list) {\n 940:\t\t\tif (iter != sdata)\n 941:\t\t\t\tcontinue;\n 942:\t\t\tguard(mutex)(\u0026local-\u003eiflist_mtx);\n 943:\t\t\tlist_del_rcu(\u0026sdata-\u003elist);\n 944:\t\t\treturn;\n 945:\t\t}\n 946:\t}\n 947:\t\n 948:\tstatic void ieee80211_uninit(struct net_device dev)\n 949:\t{\n 950:\t\tstruct ieee80211_sub_if_data sdata = IEEE80211_DEV_TO_SUB_IF(dev);\n 951:\t\n 952:\t\tieee80211_unlist_sdata(sdata);\n 953:\t\tieee80211_teardown_sdata(sdata);\n 954:\t}\n 955:\t\n 956:\tstatic int ieee80211_netdev_setup_tc(struct net_device dev,\n 957:\t\t\t\t\t enum tc_setup_type type, void type_data)\n 958:\t{\n 959:\t\tstruct ieee80211_sub_if_data sdata = IEEE80211_DEV_TO_SUB_IF(dev);\n 960:\t\tstruct ieee80211_local local = sdata-\u003elocal;\n 961:\t\n 962:\t\treturn drv_net_setup_tc(local, sdata, dev, type, type_data);\n 963:\t}\n 964:\t\n 965:\tstatic const struct net_device_ops ieee80211_dataif_ops = {\n 966:\t\t.ndo_open\t\t= ieee80211_open,\n 967:\t\t.ndo_stop\t\t= ieee80211_stop,\n 968:\t\t.ndo_uninit\t\t= ieee80211_uninit,\n 969:\t\t.ndo_start_xmit\t\t= ieee80211_subif_start_xmit,\n 970:\t\t.ndo_set_rx_mode\t= ieee80211_set_multicast_list,\n 971:\t\t.ndo_set_mac_address \t= ieee80211_change_mac,\n 972:\t\t.ndo_setup_tc\t\t= ieee80211_netdev_setup_tc,\n 973:\t};\n 974:\t\n" }
9/2	2026/09/06 01:34	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 24990 output: 30 thoughts: 28 Thoughts: Here's my thought process, as requested: Digging into `local->interfaces` in `net/mac80211/iface.c` Okay, I need to understand how `local->interfaces` is manipulated within `net/mac80211/iface.c`. This is where the core interface management for mac80211 likely resides. My first instinct is to do a targeted search within that specific file. I'm looking for direct modifications to that particular struct member. A simple `grep` or an IDE's search would be the best place to start. I'll focus on assignments (`=`), potentially also increments/decrements (`+=`, `--`) if they are involved in manipulating the interface list. I'm also going to keep an eye out for pointer dereferences and structure accesses like `local->interfaces->...` or similar constructs that are important to track. I want to see how this list of interfaces is being built, maintained, and cleaned up, as this is critical to proper driver operation. Once I have the locations, I can start to build a mental model of interface creation, destruction, and any re-arrangement in this location. I'll need to pay attention to any locking mechanisms surrounding the access as well, that is also critical to understand. I'm expecting this will involve some form of linked list manipulation, given that it's likely managing a variable number of interfaces, but I'll confirm that as I review the code. The goal is to fully grasp the lifecycle of an interface from the perspective of this core mac80211 file.
10/2	2026/09/06 01:34	tool	grepper	0m Args: { "Expression": "interfaces", "PathPrefix": "net/mac80211/" } Results: { "Output": "\nFull output is too long, showing 500 out of 656 lines.\nUse more precise expression if possible.\n\nnet/mac80211/ap.c=297=void ieee80211_ap_rx_queued_frame(struct ieee80211_sub_if_data sdata,\n--\nnet/mac80211/ap.c-301-\nnet/mac80211/ap.c:302:\t/ rx.c cannot queue any non-action frames to AP interfaces /\nnet/mac80211/ap.c-303-\tif (WARN_ON(!ieee80211_is_action(mgmt-\u003eframe_control)))\n--\nnet/mac80211/cfg.c=3708=static int ieee80211_set_tx_power(struct wiphy wiphy,\n--\nnet/mac80211/cfg.c-3773-\nnet/mac80211/cfg.c:3774:\tlist_for_each_entry(sdata, \u0026local-\u003einterfaces, list) {\nnet/mac80211/cfg.c-3775-\t\tif (sdata-\u003evif.type == NL80211_IFTYPE_MONITOR \u0026\u0026\n--\nnet/mac80211/cfg.c-3795-\t}\nnet/mac80211/cfg.c:3796:\tlist_for_each_entry(sdata, \u0026local-\u003einterfaces, list) {\nnet/mac80211/cfg.c-3797-\t\tif (sdata-\u003evif.type == NL80211_IFTYPE_MONITOR \u0026\u0026\n--\nnet/mac80211/cfg.c=4245=static void ieee80211_end_cac(struct wiphy wiphy,\n--\nnet/mac80211/cfg.c-4253-\nnet/mac80211/cfg.c:4254:\tlist_for_each_entry(sdata, \u0026local-\u003einterfaces, list) {\nnet/mac80211/cfg.c-4255-\t\tlink_data = sdata_dereference(sdata-\u003elink[link_id], sdata);\n--\nnet/mac80211/cfg.c=4375=void ieee80211_csa_finish(struct ieee80211_vif vif, unsigned int link_id)\n--\nnet/mac80211/cfg.c-4395-\t\t/* Trigger ieee80211_csa_finish() on the non-transmitting\nnet/mac80211/cfg.c:4396:\t\t * interfaces when channel switch is received on\nnet/mac80211/cfg.c-4397-\t\t * transmitting interface\n--\nnet/mac80211/cfg.c=4467=static int __ieee80211_csa_finalize(struct ieee80211_link_data link_data)\n--\nnet/mac80211/cfg.c-4486-\t\t with multi-vif csa driver may call ieee80211_csa_finish()\nnet/mac80211/cfg.c:4487:\t\t * many times while waiting for other interfaces to use their\nnet/mac80211/cfg.c-4488-\t\t * reservations\n--\nnet/mac80211/chan.c=112=ieee80211_chanctx_user_iter_next(struct ieee80211_local local,\n--\nnet/mac80211/chan.c-137-\t/ next (or first) interface /\nnet/mac80211/chan.c:138:\titer-\u003esdata = list_prepare_entry(iter-\u003esdata, \u0026local-\u003einterfaces, list);\nnet/mac80211/chan.c:139:\tlist_for_each_entry_continue(iter-\u003esdata, \u0026local-\u003einterfaces, list) {\nnet/mac80211/chan.c-140-\t\tif (!ieee80211_sdata_running(iter-\u003esdata))\n--\nnet/mac80211/chan.c=284=ieee80211_chanreq_compatible(const struct ieee80211_chan_req a,\n--\nnet/mac80211/chan.c-295-\t/\nnet/mac80211/chan.c:296:\t Remove NPCA if it's not required, so that interfaces\nnet/mac80211/chan.c-297-\t * sharing a channel context will not use NPCA while the\nnet/mac80211/chan.c-298-\t * channel context is shared.\nnet/mac80211/chan.c:299:\t * If both sides are AP interfaces requiring NPC, there's\nnet/mac80211/chan.c-300-\t * an assumption that userspace will set them up with\n--\nnet/mac80211/chan.c=582=ieee80211_get_chanctx_max_required_bw(struct ieee80211_local local,\n--\nnet/mac80211/chan.c-631- recalc the min required chan width of the channel context, which is\nnet/mac80211/chan.c:632: * the max of min required widths of all the interfaces bound to this\nnet/mac80211/chan.c-633- * channel context.\n--\nnet/mac80211/chan.c=675=static void ieee80211_chan_bw_change(struct ieee80211_local local,\n--\nnet/mac80211/chan.c-741- recalc the min required chan width of the channel context, which is\nnet/mac80211/chan.c:742: * the max of min required widths of all the interfaces bound to this\nnet/mac80211/chan.c-743- * channel context.\n--\nnet/mac80211/chan.c=811=static void _ieee80211_change_chanctx(struct ieee80211_local local,\n--\nnet/mac80211/chan.c-831-\t\t mac80211 currently only supports sharing identical\nnet/mac80211/chan.c:832:\t\t * chanctx's for S1G interfaces.\nnet/mac80211/chan.c-833-\t\t /\n--\nnet/mac80211/chan.c=1885=static int ieee80211_vif_use_reserved_switch(struct ieee80211_local local)\n--\nnet/mac80211/chan.c-1944-\t\t\twiphy_info(local-\u003ehw.wiphy,\nnet/mac80211/chan.c:1945:\t\t\t\t \"channel context reservation cannot be finalized because some interfaces aren't switching\\n\");\nnet/mac80211/chan.c-1946-\t\t\terr = -EBUSY;\n--\nnet/mac80211/chan.c=2357=int ieee80211_link_use_reserved_context(struct ieee80211_link_data link)\n--\nnet/mac80211/chan.c-2397-\t The ieee80211_vif_use_reserved_switch() already stops all necessary\nnet/mac80211/chan.c:2398:\t * interfaces upon failure.\nnet/mac80211/chan.c-2399-\t /\n--\nnet/mac80211/debugfs.c=379=static ssize_t reset_write(struct file file, const char __user user_buf,\n--\nnet/mac80211/debugfs.c-391-\tif (ret)\nnet/mac80211/debugfs.c:392:\t\tcfg80211_shutdown_all_interfaces(local-\u003ehw.wiphy);\nnet/mac80211/debugfs.c-393-\n--\nnet/mac80211/ibss.c=1668=void ieee80211_ibss_notify_scan_completed(struct ieee80211_local local)\n--\nnet/mac80211/ibss.c-1673-\nnet/mac80211/ibss.c:1674:\tlist_for_each_entry(sdata, \u0026local-\u003einterfaces, list) {\nnet/mac80211/ibss.c-1675-\t\tif (!ieee80211_sdata_running(sdata))\n--\nnet/mac80211/ieee80211_i.h=83=extern const u8 ieee80211_ac_to_qos_mask[IEEE80211_NUM_ACS];\n--\nnet/mac80211/ieee80211_i.h-90- * Current mac80211 implementation supports a maximum of 1600 AIDS\nnet/mac80211/ieee80211_i.h:91: * for S1G interfaces. With regards to an S1G TIM, this covers 25 blocks\nnet/mac80211/ieee80211_i.h-92- * as each block is 64 AIDs.\n--\nnet/mac80211/ieee80211_i.h=212=enum ieee80211_packet_rx_flags {\n--\nnet/mac80211/ieee80211_i.h-223- \nnet/mac80211/ieee80211_i.h:224: These flags are used across handling multiple interfaces\nnet/mac80211/ieee80211_i.h-225- * for a single frame.\n--\nnet/mac80211/ieee80211_i.h=898=enum ieee80211_sdata_state_bits {\n--\nnet/mac80211/ieee80211_i.h-907- * @IEEE80211_CHANCTX_SHARED: channel context may be used by\nnet/mac80211/ieee80211_i.h:908: \tmultiple interfaces\nnet/mac80211/ieee80211_i.h-909- @IEEE80211_CHANCTX_EXCLUSIVE: channel context can be used\n--\nnet/mac80211/ieee80211_i.h=1270=struct ieee80211_sub_if_data vif_to_sdata(struct ieee80211_vif p)\n--\nnet/mac80211/ieee80211_i.h-1284-\t ___link_id; ___link_id = 0 /* always stop /)\t\t\\\nnet/mac80211/ieee80211_i.h:1285:\tlist_for_each_entry(___sdata, \u0026(_local)-\u003einterfaces, list)\t\\\nnet/mac80211/ieee80211_i.h-1286-\tif (___link_id == ARRAY_SIZE(___sdata-\u003elink) \u0026\u0026\t\t\t\\\n--\nnet/mac80211/ieee80211_i.h-1303-\t ___link_id; ___link_id = 0 / always stop /)\t\t\\\nnet/mac80211/ieee80211_i.h:1304:\tlist_for_each_entry(___sdata, \u0026(_local)-\u003einterfaces, list)\t\\\nnet/mac80211/ieee80211_i.h-1305-\tif (___link_id == ARRAY_SIZE(___sdata-\u003elink) \u0026\u0026\t\t\t\\\n--\nnet/mac80211/ieee80211_i.h=1457=struct ieee80211_local {\n--\nnet/mac80211/ieee80211_i.h-1498-\tint monitors, virt_monitors, tx_mntrs;\nnet/mac80211/ieee80211_i.h:1499:\t/ number of interfaces with corresponding FIF_ flags /\nnet/mac80211/ieee80211_i.h-1500-\tint fif_fcsfail, fif_plcpfail, fif_control, fif_other_bss, fif_pspoll,\n--\nnet/mac80211/ieee80211_i.h-1596-\nnet/mac80211/ieee80211_i.h:1597:\t/ number of interfaces with allmulti RX /\nnet/mac80211/ieee80211_i.h-1598-\tatomic_t iff_allmultis;\n--\nnet/mac80211/ieee80211_i.h-1606-\t/ see iface.c /\nnet/mac80211/ieee80211_i.h:1607:\tstruct list_head interfaces;\nnet/mac80211/ieee80211_i.h-1608-\tstruct list_head mon_list; / only that are IFF_UP /\n--\nnet/mac80211/ieee80211_i.h-1702-\nnet/mac80211/ieee80211_i.h:1703:\tint user_power_level; / in dBm, for all interfaces /\nnet/mac80211/ieee80211_i.h-1704-\n--\nnet/mac80211/ieee80211_i.h=2100=ieee80211_find_nan_sdata(struct ieee80211_local local)\n--\nnet/mac80211/ieee80211_i.h-2106-\t/* Find the NAN interface - there can only be one /\nnet/mac80211/ieee80211_i.h:2107:\tlist_for_each_entry(sdata, \u0026local-\u003einterfaces, list) {\nnet/mac80211/ieee80211_i.h-2108-\t\tif (ieee80211_sdata_running(sdata) \u0026\u0026\n--\nnet/mac80211/ieee80211_i.h=2199=void ieee80211_if_remove(struct ieee80211_sub_if_data sdata);\nnet/mac80211/ieee80211_i.h:2200:void ieee80211_remove_interfaces(struct ieee80211_local local);\nnet/mac80211/ieee80211_i.h-2201-u32 ieee80211_idle_off(struct ieee80211_local local);\n--\nnet/mac80211/iface.c=105=static u32 __ieee80211_recalc_idle(struct ieee80211_local local,\n--\nnet/mac80211/iface.c-120-\nnet/mac80211/iface.c:121:\tlist_for_each_entry(iter, \u0026local-\u003einterfaces, list) {\nnet/mac80211/iface.c-122-\t\tif (iter-\u003evif.type == NL80211_IFTYPE_NAN \u0026\u0026\n--\nnet/mac80211/iface.c=161=static int ieee80211_verify_mac(struct ieee80211_sub_if_data sdata, u8 addr,\n--\nnet/mac80211/iface.c-187-\nnet/mac80211/iface.c:188:\tlist_for_each_entry(iter, \u0026local-\u003einterfaces, list) {\nnet/mac80211/iface.c-189-\t\tif (iter == sdata)\n--\nnet/mac80211/iface.c=341=static int ieee80211_check_concurrent_iface(struct ieee80211_sub_if_data sdata,\n--\nnet/mac80211/iface.c-350-\t/* we hold the RTNL here so can safely walk the list /\nnet/mac80211/iface.c:351:\tlist_for_each_entry(nsdata, \u0026local-\u003einterfaces, list) {\nnet/mac80211/iface.c-352-\t\tif (nsdata != sdata \u0026\u0026 ieee80211_sdata_running(nsdata)) {\n--\nnet/mac80211/iface.c-380-\t\t\t To remove this restriction we'd have to disallow them\nnet/mac80211/iface.c:381:\t\t\t * from setting the same SSID on different IBSS interfaces\nnet/mac80211/iface.c-382-\t\t\t * belonging to the same hardware. Then, however, we're\n--\nnet/mac80211/iface.c-397-\t\t\t/\nnet/mac80211/iface.c:398:\t\t\t The remaining checks are only performed for interfaces\nnet/mac80211/iface.c-399-\t\t\t * with the same MAC address.\n--\nnet/mac80211/iface.c=479=static void ieee80211_do_stop(struct ieee80211_sub_if_data sdata, bool going_down)\n--\nnet/mac80211/iface.c-636-\tcase NL80211_IFTYPE_NAN:\nnet/mac80211/iface.c:637:\t\t/ Check if any open NAN_DATA interfaces /\nnet/mac80211/iface.c:638:\t\tlist_for_each_entry(iter, \u0026local-\u003einterfaces, list) {\nnet/mac80211/iface.c-639-\t\t\tWARN_ON(iter-\u003evif.type == NL80211_IFTYPE_NAN_DATA \u0026\u0026\n--\nnet/mac80211/iface.c=845=static int ieee80211_stop(struct net_device dev)\n--\nnet/mac80211/iface.c-848-\nnet/mac80211/iface.c:849:\t/* close dependent VLAN interfaces before locking wiphy /\nnet/mac80211/iface.c-850-\tif (sdata-\u003evif.type == NL80211_IFTYPE_AP) {\n--\nnet/mac80211/iface.c-861-\nnet/mac80211/iface.c:862:\t/ Close the dependent MBSSID interfaces with wiphy lock as we may be\nnet/mac80211/iface.c-863-\t * terminating its partner links too in case of MLD.\n--\nnet/mac80211/iface.c=932=static void ieee80211_unlist_sdata(struct ieee80211_sub_if_data sdata)\n--\nnet/mac80211/iface.c-938-\nnet/mac80211/iface.c:939:\tlist_for_each_entry(iter, \u0026local-\u003einterfaces, list) {\nnet/mac80211/iface.c-940-\t\tif (iter != sdata)\n--\nnet/mac80211/iface.c=1160=static void ieee80211_recalc_sdata_offload(struct ieee80211_sub_if_data sdata)\n--\nnet/mac80211/iface.c-1169-\nnet/mac80211/iface.c:1170:\tlist_for_each_entry(vsdata, \u0026local-\u003einterfaces, list) {\nnet/mac80211/iface.c-1171-\t\tif (vsdata-\u003evif.type != NL80211_IFTYPE_AP_VLAN \|\|\n--\nnet/mac80211/iface.c=1179=void ieee80211_recalc_offload(struct ieee80211_local local)\n--\nnet/mac80211/iface.c-1187-\nnet/mac80211/iface.c:1188:\tlist_for_each_entry(sdata, \u0026local-\u003einterfaces, list) {\nnet/mac80211/iface.c-1189-\t\tif (!ieee80211_sdata_running(sdata))\n--\nnet/mac80211/iface.c=1389=int ieee80211_do_open(struct wireless_dev wdev, bool coming_up)\n--\nnet/mac80211/iface.c-1599-\t\t * doesn't start up with sane defaults.\nnet/mac80211/iface.c:1600:\t\t * Enable QoS for anything but station interfaces.\nnet/mac80211/iface.c-1601-\t\t /\n--\nnet/mac80211/iface.c=2123=static void ieee80211_assign_perm_addr(struct ieee80211_local local,\n--\nnet/mac80211/iface.c-2146-\t\t/* match up with an AP interface /\nnet/mac80211/iface.c:2147:\t\tlist_for_each_entry(sdata, \u0026local-\u003einterfaces, list) {\nnet/mac80211/iface.c-2148-\t\t\tif (sdata-\u003evif.type != NL80211_IFTYPE_AP)\n--\nnet/mac80211/iface.c-2157-\t\tif (ieee80211_hw_check(\u0026local-\u003ehw, P2P_DEV_ADDR_FOR_INTF)) {\nnet/mac80211/iface.c:2158:\t\t\tlist_for_each_entry(sdata, \u0026local-\u003einterfaces, list) {\nnet/mac80211/iface.c-2159-\t\t\t\tif (sdata-\u003evif.type != NL80211_IFTYPE_P2P_DEVICE)\n--\nnet/mac80211/iface.c-2172-\nnet/mac80211/iface.c:2173:\t\t\tlist_for_each_entry(sdata, \u0026local-\u003einterfaces, list) {\nnet/mac80211/iface.c-2174-\t\t\t\tif (ether_addr_equal(local-\u003ehw.wiphy-\u003eaddresses[i].addr,\n--\nnet/mac80211/iface.c-2208-\t\tm = local-\u003ehw.wiphy-\u003eperm_addr;\nnet/mac80211/iface.c:2209:\t\tlist_for_each_entry(sdata, \u0026local-\u003einterfaces, list) {\nnet/mac80211/iface.c-2210-\t\t\tif (sdata-\u003evif.type == NL80211_IFTYPE_MONITOR)\n--\nnet/mac80211/iface.c-2233-\nnet/mac80211/iface.c:2234:\t\t\tlist_for_each_entry(sdata, \u0026local-\u003einterfaces, list) {\nnet/mac80211/iface.c-2235-\t\t\t\tif (ether_addr_equal(tmp_addr, sdata-\u003evif.addr)) {\n--\nnet/mac80211/iface.c=2252=int ieee80211_if_add(struct ieee80211_local local, const char name,\n--\nnet/mac80211/iface.c-2410-\t\t/ MTU range is normally 256 - 2304, where the upper limit is\nnet/mac80211/iface.c:2411:\t\t * the maximum MSDU size. Monitor interfaces send and receive\nnet/mac80211/iface.c-2412-\t\t * MPDU and A-MSDU frames which may be much larger so we do\n--\nnet/mac80211/iface.c-2428-\tmutex_lock(\u0026local-\u003eiflist_mtx);\nnet/mac80211/iface.c:2429:\tlist_add_tail_rcu(\u0026sdata-\u003elist, \u0026local-\u003einterfaces);\nnet/mac80211/iface.c-2430-\tmutex_unlock(\u0026local-\u003eiflist_mtx);\n--\nnet/mac80211/iface.c=2464=void ieee80211_sdata_stop(struct ieee80211_sub_if_data sdata)\n--\nnet/mac80211/iface.c-2470-\nnet/mac80211/iface.c:2471:void ieee80211_remove_interfaces(struct ieee80211_local local)\nnet/mac80211/iface.c-2472-{\n--\nnet/mac80211/iface.c-2477-\nnet/mac80211/iface.c:2478:\t/* Before destroying the interfaces, make sure they're all stopped so\nnet/mac80211/iface.c-2479-\t * that the hardware is stopped. Otherwise, the driver might still be\nnet/mac80211/iface.c:2480:\t * iterating the interfaces during the shutdown, e.g. from a worker\nnet/mac80211/iface.c-2481-\t * or from RX processing or similar, and if it does so (using atomic\n--\nnet/mac80211/iface.c-2488-\t /\nnet/mac80211/iface.c:2489:\tcfg80211_shutdown_all_interfaces(local-\u003ehw.wiphy);\nnet/mac80211/iface.c-2490-\n--\nnet/mac80211/iface.c-2496-\tmutex_lock(\u0026local-\u003eiflist_mtx);\nnet/mac80211/iface.c:2497:\tlist_splice_init(\u0026local-\u003einterfaces, \u0026unreg_list);\nnet/mac80211/iface.c-2498-\tmutex_unlock(\u0026local-\u003eiflist_mtx);\n--\nnet/mac80211/key.c=120=static int ieee80211_key_enable_hw_accel(struct ieee80211_key key)\n--\nnet/mac80211/key.c-167-\t\t/\nnet/mac80211/key.c:168:\t\t The driver doesn't know anything about VLAN interfaces.\nnet/mac80211/key.c:169:\t\t * Hence, don't send GTKs for VLAN interfaces to the driver.\nnet/mac80211/key.c-170-\t\t /\n--\nnet/mac80211/key.c=846=int ieee80211_key_link(struct ieee80211_key key,\n--\nnet/mac80211/key.c-875-\t\t * the same cipher. Enforce the assumption for pairwise keys.\nnet/mac80211/key.c:876:\t\t * NAN Data interfaces are exempt: Wi-Fi Aware v4.0 section 7.4\nnet/mac80211/key.c-877-\t\t * requires upgrading the ND-TKSA when a new NDP negotiates a\n--\nnet/mac80211/key.c=1020=void ieee80211_iter_keys(struct ieee80211_hw hw,\n--\nnet/mac80211/key.c-1039-\t} else {\nnet/mac80211/key.c:1040:\t\tlist_for_each_entry(sdata, \u0026local-\u003einterfaces, list)\nnet/mac80211/key.c-1041-\t\t\tlist_for_each_entry_safe(key, tmp,\n--\nnet/mac80211/key.c=1065=void ieee80211_iter_keys_rcu(struct ieee80211_hw hw,\n--\nnet/mac80211/key.c-1080-\t} else {\nnet/mac80211/key.c:1081:\t\tlist_for_each_entry_rcu(sdata, \u0026local-\u003einterfaces, list)\nnet/mac80211/key.c-1082-\t\t\t_ieee80211_iter_keys_rcu(hw, sdata, iter, iter_data);\n--\nnet/mac80211/main.c=96=static u32 ieee80211_calc_hw_conf_chan(struct ieee80211_local local,\n--\nnet/mac80211/main.c-173-\trcu_read_lock();\nnet/mac80211/main.c:174:\tlist_for_each_entry_rcu(sdata, \u0026local-\u003einterfaces, list) {\nnet/mac80211/main.c-175-\t\tif (!rcu_access_pointer(sdata-\u003evif.bss_conf.chanctx_conf))\n--\nnet/mac80211/main.c=474=static void ieee80211_restart_work(struct work_struct work)\n--\nnet/mac80211/main.c-490-\nnet/mac80211/main.c:491:\tlist_for_each_entry(sdata, \u0026local-\u003einterfaces, list) {\nnet/mac80211/main.c-492-\t\t/\n--\nnet/mac80211/main.c-530-\tif (ret)\nnet/mac80211/main.c:531:\t\tcfg80211_shutdown_all_interfaces(local-\u003ehw.wiphy);\nnet/mac80211/main.c-532-\n--\nnet/mac80211/main.c=793=struct ieee80211_hw ieee80211_alloc_hw_nm(size_t priv_data_len,\n--\nnet/mac80211/main.c-978-\nnet/mac80211/main.c:979:\tINIT_LIST_HEAD(\u0026local-\u003einterfaces);\nnet/mac80211/main.c-980-\tINIT_LIST_HEAD(\u0026local-\u003emon_list);\n--\nnet/mac80211/main.c=1137=int ieee80211_register_hw(struct ieee80211_hw hw)\n--\nnet/mac80211/main.c-1270-\t\t\t Assign the first enabled channel to dflt_chandef\nnet/mac80211/main.c:1271:\t\t\t * from the list of channels. For S1G interfaces\nnet/mac80211/main.c-1272-\t\t\t * ensure it can be used as a primary.\n--\nnet/mac80211/main.c-1527-\t * and we need some headroom for passing the frame to monitor\nnet/mac80211/main.c:1528:\t * interfaces, but never both at the same time.\nnet/mac80211/main.c-1529-\t /\n--\nnet/mac80211/main.c-1682-\trate_control_deinitialize(local);\nnet/mac80211/main.c:1683:\tieee80211_remove_interfaces(local);\nnet/mac80211/main.c-1684-\trtnl_unlock();\n--\nnet/mac80211/main.c=1696=void ieee80211_unregister_hw(struct ieee80211_hw hw)\n--\nnet/mac80211/main.c-1716-\t /\nnet/mac80211/main.c:1717:\tieee80211_remove_interfaces(local);\nnet/mac80211/main.c-1718-\n--\nnet/mac80211/mesh.h=216=struct mesh_rmc {\n--\nnet/mac80211/mesh.h-233-\nnet/mac80211/mesh.h:234:/ Public interfaces /\nnet/mac80211/mesh.h-235-/ Various /\n--\nnet/mac80211/mesh.h=345=void mesh_sta_cleanup(struct sta_info sta);\nnet/mac80211/mesh.h-346-\nnet/mac80211/mesh.h:347:/* Private interfaces /\nnet/mac80211/mesh.h-348-/ Mesh paths /\n--\nnet/mac80211/mlme.c=1888=static bool ieee80211_add_vht_ie(struct ieee80211_sub_if_data sdata,\n--\nnet/mac80211/mlme.c-1938-\nnet/mac80211/mlme.c:1939:\t\tlist_for_each_entry(other, \u0026local-\u003einterfaces, list) {\nnet/mac80211/mlme.c-1940-\t\t\tif (other-\u003evif.bss_conf.mu_mimo_owner) {\n--\nnet/mac80211/mlme.c=2874=static void ieee80211_csa_switch_work(struct wiphy wiphy,\n--\nnet/mac80211/mlme.c-2942-\t\t with multi-vif csa driver may call ieee80211_csa_finish()\nnet/mac80211/mlme.c:2943:\t\t * many times while waiting for other interfaces to use their\nnet/mac80211/mlme.c-2944-\t\t * reservations\n--\nnet/mac80211/mlme.c=3822=void ieee80211_recalc_ps(struct ieee80211_local local)\n--\nnet/mac80211/mlme.c-3833-\nnet/mac80211/mlme.c:3834:\tlist_for_each_entry(sdata, \u0026local-\u003einterfaces, list) {\nnet/mac80211/mlme.c-3835-\t\tif (!ieee80211_sdata_running(sdata))\n--\nnet/mac80211/mlme.c=9580=void ieee80211_mlme_notify_scan_completed(struct ieee80211_local local)\n--\nnet/mac80211/mlme.c-9585-\trcu_read_lock();\nnet/mac80211/mlme.c:9586:\tlist_for_each_entry_rcu(sdata, \u0026local-\u003einterfaces, list) {\nnet/mac80211/mlme.c-9587-\t\tif (ieee80211_sdata_running(sdata))\n--\nnet/mac80211/nan.c=224=ieee80211_nan_update_all_ndi_carriers(struct ieee80211_local local)\n--\nnet/mac80211/nan.c-229-\nnet/mac80211/nan.c:230:\t/ Iterate all interfaces and update carrier for NDI interfaces /\nnet/mac80211/nan.c:231:\tlist_for_each_entry(sdata, \u0026local-\u003einterfaces, list) {\nnet/mac80211/nan.c-232-\t\tif (!ieee80211_sdata_running(sdata) \|\|\n--\nnet/mac80211/offchannel.c=83=void ieee80211_offchannel_stop_vifs(struct ieee80211_local local)\n--\nnet/mac80211/offchannel.c-93-\t * notify the AP about us leaving the channel and stop all\nnet/mac80211/offchannel.c:94:\t * STA interfaces.\nnet/mac80211/offchannel.c-95-\t /\n--\nnet/mac80211/offchannel.c-105-\nnet/mac80211/offchannel.c:106:\tlist_for_each_entry(sdata, \u0026local-\u003einterfaces, list) {\nnet/mac80211/offchannel.c-107-\t\tif (!ieee80211_sdata_running(sdata))\n--\nnet/mac80211/offchannel.c=133=void ieee80211_offchannel_return(struct ieee80211_local local)\n--\nnet/mac80211/offchannel.c-141-\nnet/mac80211/offchannel.c:142:\tlist_for_each_entry(sdata, \u0026local-\u003einterfaces, list) {\nnet/mac80211/offchannel.c-143-\t\tif (sdata-\u003evif.type == NL80211_IFTYPE_P2P_DEVICE)\n--\nnet/mac80211/pm.c=21=int __ieee80211_suspend(struct ieee80211_hw hw, struct cfg80211_wowlan wowlan)\n--\nnet/mac80211/pm.c-91-\t\t /\nnet/mac80211/pm.c:92:\t\tlist_for_each_entry(sdata, \u0026local-\u003einterfaces, list) {\nnet/mac80211/pm.c-93-\t\t\tif (!ieee80211_sdata_running(sdata))\n--\nnet/mac80211/pm.c-134-\t\t\t/ cfg80211 will call back into mac80211 to disconnect\nnet/mac80211/pm.c:135:\t\t\t * all interfaces, allow that to proceed properly\nnet/mac80211/pm.c-136-\t\t\t /\n--\nnet/mac80211/pm.c-146-\nnet/mac80211/pm.c:147:\t/ remove all interfaces that were created in the driver /\nnet/mac80211/pm.c:148:\tlist_for_each_entry(sdata, \u0026local-\u003einterfaces, list) {\nnet/mac80211/pm.c-149-\t\tif (!ieee80211_sdata_running(sdata))\n--\nnet/mac80211/pm.c-167-\t/\nnet/mac80211/pm.c:168:\t * We disconnected on all interfaces before suspend, all channel\nnet/mac80211/pm.c-169-\t * contexts should be released.\n--\nnet/mac80211/rx.c=796=ieee80211_validate_monitor_radio(struct ieee80211_sub_if_data sdata,\n--\nnet/mac80211/rx.c-840-/\nnet/mac80211/rx.c:841: * This function copies a received frame to all monitor interfaces and\nnet/mac80211/rx.c-842- * returns a cleaned-up SKB that no longer includes the FCS nor the\n--\nnet/mac80211/rx.c=5171=static bool ieee80211_prepare_and_rx_handle(struct ieee80211_rx_data rx,\n--\nnet/mac80211/rx.c-5183-\t so punt in that case. We should never have to deliver a data\nnet/mac80211/rx.c:5184:\t * frame to multiple interfaces anyway.\nnet/mac80211/rx.c-5185-\t \n--\nnet/mac80211/rx.c=5367=static void __ieee80211_rx_handle_packet(struct ieee80211_hw hw,\n--\nnet/mac80211/rx.c-5516-\nnet/mac80211/rx.c:5517:\tlist_for_each_entry_rcu(sdata, \u0026local-\u003einterfaces, list) {\nnet/mac80211/rx.c-5518-\t\tif (!ieee80211_sdata_running(sdata))\n--\nnet/mac80211/rx.c=5728=void ieee80211_rx_napi(struct ieee80211_hw hw, struct ieee80211_sta pubsta,\n--\nnet/mac80211/rx.c-5735-\t/\nnet/mac80211/rx.c:5736:\t key references and virtual interfaces are protected using RCU\nnet/mac80211/rx.c-5737-\t * and this requires that we are in a read-side RCU section during\n--\nnet/mac80211/scan.c=277=void ieee80211_scan_rx(struct ieee80211_local local, struct sk_buff skb)\n--\nnet/mac80211/scan.c-359-\nnet/mac80211/scan.c:360:\t/* Do not update the BSS table in case of only monitor interfaces /\nnet/mac80211/scan.c-361-\tif (local-\u003eopen_count == local-\u003emonitors)\n--\nnet/mac80211/scan.c=448=static void __ieee80211_scan_completed(struct ieee80211_hw hw, bool aborted)\n--\nnet/mac80211/scan.c-530-\t /\nnet/mac80211/scan.c:531:\tlist_for_each_entry(sdata, \u0026local-\u003einterfaces, list) {\nnet/mac80211/scan.c-532-\t\tif (ieee80211_sdata_running(sdata))\n--\nnet/mac80211/scan.c=598=static bool __ieee80211_can_leave_ch(struct ieee80211_sub_if_data sdata,\n--\nnet/mac80211/scan.c-612-\nnet/mac80211/scan.c:613:\tlist_for_each_entry(sdata_iter, \u0026local-\u003einterfaces, list) {\nnet/mac80211/scan.c-614-\t\tfor_each_valid_link(\u0026sdata_iter-\u003ewdev, link_id)\n--\nnet/mac80211/scan.c=923=static void ieee80211_scan_state_decision(struct ieee80211_local local,\n--\nnet/mac80211/scan.c-940-\t /\nnet/mac80211/scan.c:941:\tlist_for_each_entry(sdata, \u0026local-\u003einterfaces, list) {\nnet/mac80211/scan.c-942-\t\tif (!ieee80211_sdata_running(sdata))\n--\nnet/mac80211/sta_info.c-49- * Station entries are added by mac80211 when you establish a link with a\nnet/mac80211/sta_info.c:50: * peer. This means different things for the different type of interfaces\nnet/mac80211/sta_info.c-51- * we support. For a regular station this mean we add the AP sta when we\n--\nnet/mac80211/sta_info.c=1292=static bool sta_info_cleanup_expire_buffered(struct ieee80211_local local,\n--\nnet/mac80211/sta_info.c-1297-\nnet/mac80211/sta_info.c:1298:\t/ This is only necessary for stations on BSS/MBSS interfaces /\nnet/mac80211/sta_info.c-1299-\tif (!sta-\u003esdata-\u003ebss \u0026\u0026\n--\nnet/mac80211/sta_info.h=326=struct ieee80211_fast_tx {\n--\nnet/mac80211/sta_info.h-346- @key: bool indicating encryption is expected (key is set)\nnet/mac80211/sta_info.h:347: * @internal_forward: forward froms internally on AP/VLAN type interfaces\nnet/mac80211/sta_info.h-348- * @uses_rss: copy of USES_RSS hw flag\n--\nnet/mac80211/status.c=573=ieee80211_sdata_from_skb(struct ieee80211_local local, struct sk_buff skb)\n--\nnet/mac80211/status.c-578-\tif (skb-\u003edev) {\nnet/mac80211/status.c:579:\t\tlist_for_each_entry_rcu(sdata, \u0026local-\u003einterfaces, list) {\nnet/mac80211/status.c-580-\t\t\tif (!sdata-\u003edev)\n--\nnet/mac80211/status.c-589-\nnet/mac80211/status.c:590:\tlist_for_each_entry_rcu(sdata, \u0026local-\u003einterfaces, list) {\nnet/mac80211/status.c-591-\t\tswitch (sdata-\u003evif.type) {\n--\nnet/mac80211/status.c=943=void ieee80211_tx_monitor(struct ieee80211_local local, struct sk_buff skb,\n--\nnet/mac80211/status.c-951-\nnet/mac80211/status.c:952:\t/* send frame to monitor interfaces now /\nnet/mac80211/status.c-953-\trtap_len = ieee80211_tx_radiotap_len(info, status);\n--\nnet/mac80211/status.c-969-\trcu_read_lock();\nnet/mac80211/status.c:970:\tlist_for_each_entry_rcu(sdata, \u0026local-\u003einterfaces, list) {\nnet/mac80211/status.c-971-\t\tif (sdata-\u003evif.type == NL80211_IFTYPE_MONITOR) {\n--\nnet/mac80211/tx.c=330=static void purge_old_ps_buffers(struct ieee80211_local local)\n--\nnet/mac80211/tx.c-336-\nnet/mac80211/tx.c:337:\tlist_for_each_entry_rcu(sdata, \u0026local-\u003einterfaces, list) {\nnet/mac80211/tx.c-338-\t\tstruct ps_data *ps;\n\n" }
11/2	2026/09/06 01:34	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 38039 output: 40 thoughts: 82 Thoughts: Here's my analysis of this code sequence: Delving into the MAC80211 Interface Removal Okay, so I need to trace the call paths for removing stations and interfaces in the mac80211 stack. I'm going to start by looking at how `cfg80211_del_sta`, `cfg80211_del_iface`, and ultimately `ieee80211_if_remove` get invoked. My immediate thought is to zero in on the interface removal function because it seems to be the core of the teardown process for a station. I'll start with the code within `net/mac80211/iface.c`, specifically focusing around where `ieee80211_if_remove` is defined and used. This should give me a solid understanding of the higher-level functions triggering this critical operation, and how the station's removal fits into the whole process. I will see if these functions are called directly or indirectly. And what are the different scenarios/reasons for these calls.
12/2	2026/09/06 01:34	tool	grepper	0m Args: { "Expression": "ieee80211_if_remove", "PathPrefix": "net/mac80211/" } Results: { "Output": "net/mac80211/cfg.c=206=static struct wireless_dev ieee80211_add_iface(struct wiphy wiphy,\n--\nnet/mac80211/cfg.c-225-\t\tif (err) {\nnet/mac80211/cfg.c:226:\t\t\tieee80211_if_remove(sdata);\nnet/mac80211/cfg.c-227-\t\t\treturn NULL;\n--\nnet/mac80211/cfg.c=252=static int ieee80211_del_iface(struct wiphy wiphy, struct wireless_dev wdev)\nnet/mac80211/cfg.c-253-{\nnet/mac80211/cfg.c:254:\tieee80211_if_remove(IEEE80211_WDEV_TO_SUB_IF(wdev));\nnet/mac80211/cfg.c-255-\n--\nnet/mac80211/ieee80211_i.h=2197=int ieee80211_if_change_type(struct ieee80211_sub_if_data sdata,\nnet/mac80211/ieee80211_i.h-2198-\t\t\t enum nl80211_iftype type);\nnet/mac80211/ieee80211_i.h:2199:void ieee80211_if_remove(struct ieee80211_sub_if_data sdata);\nnet/mac80211/ieee80211_i.h-2200-void ieee80211_remove_interfaces(struct ieee80211_local local);\n--\nnet/mac80211/iface.c=2252=int ieee80211_if_add(struct ieee80211_local local, const char name,\n--\nnet/mac80211/iface.c-2437-\nnet/mac80211/iface.c:2438:void ieee80211_if_remove(struct ieee80211_sub_if_data sdata)\nnet/mac80211/iface.c-2439-{\n" }
13/2	2026/09/06 01:34	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 39030 output: 42 thoughts: 32 Thoughts: Here's my analysis of the provided code snippet from `net/mac80211/iface.c`, lines 2435-2510. Diving Deep into iface.c: A Detailed Look Alright, let's get down to brass tacks. I've got the section from `iface.c` open in my mental editor. Specifically, I'm focusing on lines 2435 through 2510. Based on the file name, I'm expecting this is going to be about the interface layer of the mac80211 wireless stack. Given the line numbers, I'd wager we're likely in a function or a crucial block dealing with interface-specific operations. I'll need to parse the context to get the full picture, but it's probably related to bringing an interface up, down, or handling some kind of association or configuration change. I'm mentally parsing the control flow, identifying data structures, and the relationships. I'm going to pay particular attention to: * Error Handling: What happens if something goes wrong? Are there robust error checks, and how are failures communicated? * Concurrency: Any potential for race conditions? Are there locks being used, and if so, how are they being managed? * Resource Management: Are there memory allocations and deallocations in this area? If so, what mechanisms are used to prevent leaks? * Data Structures: What structures are at play, and what kind of modifications are going on? I'll probably see `struct ieee80211_local`, `struct ieee80211_vif`, etc., which I'll relate to my mental model. * Abstraction Leaks: Am I seeing the code make direct calls to hardware or network stack elements or is it adhering to a more abstract API? I'll be looking for well-documented comments and variable names to get a handle on what the code does. I'm ready to dig in and understand this section from a performance, security, and stability perspective, focusing on how this piece of code fits into the larger picture of this subsystem. I'm also going to see if any of it is an optimization or a workaround to specific hardware.
14/2	2026/09/06 01:34	tool	read-file	0m Args: { "File": "net/mac80211/iface.c", "FirstLine": 2435, "LineCount": 80 } Results: { "Contents": "2435:\t\treturn 0;\n2436:\t}\n2437:\t\n2438:\tvoid ieee80211_if_remove(struct ieee80211_sub_if_data sdata)\n2439:\t{\n2440:\t\tASSERT_RTNL();\n2441:\t\tlockdep_assert_wiphy(sdata-\u003elocal-\u003ehw.wiphy);\n2442:\t\n2443:\t\tmutex_lock(\u0026sdata-\u003elocal-\u003eiflist_mtx);\n2444:\t\tlist_del_rcu(\u0026sdata-\u003elist);\n2445:\t\tmutex_unlock(\u0026sdata-\u003elocal-\u003eiflist_mtx);\n2446:\t\n2447:\t\tif (sdata-\u003evif.txq)\n2448:\t\t\tieee80211_txq_purge(sdata-\u003elocal, to_txq_info(sdata-\u003evif.txq));\n2449:\t\n2450:\t\tif (sdata-\u003evif.txq_mgmt)\n2451:\t\t\tieee80211_txq_purge(sdata-\u003elocal,\n2452:\t\t\t\t\t to_txq_info(sdata-\u003evif.txq_mgmt));\n2453:\t\n2454:\t\tsynchronize_rcu();\n2455:\t\n2456:\t\tcfg80211_unregister_wdev(\u0026sdata-\u003ewdev);\n2457:\t\n2458:\t\tif (!sdata-\u003edev) {\n2459:\t\t\tieee80211_teardown_sdata(sdata);\n2460:\t\t\tkfree(sdata);\n2461:\t\t}\n2462:\t}\n2463:\t\n2464:\tvoid ieee80211_sdata_stop(struct ieee80211_sub_if_data sdata)\n2465:\t{\n2466:\t\tif (WARN_ON_ONCE(!test_bit(SDATA_STATE_RUNNING, \u0026sdata-\u003estate)))\n2467:\t\t\treturn;\n2468:\t\tieee80211_do_stop(sdata, true);\n2469:\t}\n2470:\t\n2471:\tvoid ieee80211_remove_interfaces(struct ieee80211_local local)\n2472:\t{\n2473:\t\tstruct ieee80211_sub_if_data sdata, tmp;\n2474:\t\tLIST_HEAD(unreg_list);\n2475:\t\n2476:\t\tASSERT_RTNL();\n2477:\t\n2478:\t\t/ Before destroying the interfaces, make sure they're all stopped so\n2479:\t\t * that the hardware is stopped. Otherwise, the driver might still be\n2480:\t\t * iterating the interfaces during the shutdown, e.g. from a worker\n2481:\t\t * or from RX processing or similar, and if it does so (using atomic\n2482:\t\t * iteration) while we're manipulating the list, the iteration will\n2483:\t\t * crash.\n2484:\t\t \n2485:\t\t After this, the hardware should be stopped and the driver should\n2486:\t\t * have stopped all of its activities, so that we can do RCU-unaware\n2487:\t\t * manipulations of the interface list below.\n2488:\t\t /\n2489:\t\tcfg80211_shutdown_all_interfaces(local-\u003ehw.wiphy);\n2490:\t\n2491:\t\tguard(wiphy)(local-\u003ehw.wiphy);\n2492:\t\n2493:\t\tWARN(local-\u003eopen_count, \"%s: open count remains %d\\n\",\n2494:\t\t wiphy_name(local-\u003ehw.wiphy), local-\u003eopen_count);\n2495:\t\n2496:\t\tmutex_lock(\u0026local-\u003eiflist_mtx);\n2497:\t\tlist_splice_init(\u0026local-\u003einterfaces, \u0026unreg_list);\n2498:\t\tmutex_unlock(\u0026local-\u003eiflist_mtx);\n2499:\t\n2500:\t\tlist_for_each_entry_safe(sdata, tmp, \u0026unreg_list, list) {\n2501:\t\t\tbool netdev = sdata-\u003edev;\n2502:\t\n2503:\t\t\t/\n2504:\t\t\t * Remove IP addresses explicitly, since the notifier will\n2505:\t\t\t * skip the callbacks if wdev-\u003eregistered is false, since\n2506:\t\t\t * we can't acquire the wiphy_lock() again there if already\n2507:\t\t\t * inside this locked section.\n2508:\t\t\t */\n2509:\t\t\tsdata-\u003evif.cfg.arp_addr_cnt = 0;\n2510:\t\t\tif (sdata-\u003evif.type == NL80211_IFTYPE_STATION \u0026\u0026\n2511:\t\t\t sdata-\u003eu.mgd.associated)\n2512:\t\t\t\tieee80211_vif_cfg_change_notify(sdata,\n2513:\t\t\t\t\t\t\t\tBSS_CHANGED_ARP_FILTER);\n2514:\t\n" }
15/2	2026/09/06 01:34	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 40951 output: 36 thoughts: 452 Thoughts: Investigating the Implications of Uninitializing a Netdev Without Explicit Mac80211 Removal Okay, so I'm diving into the potential fallout when a network device (`netdev`) is uninitialized or unregistered, but without `mac80211` explicitly calling `ieee80211_if_remove`. I need to understand the control flow and identify any potential issues. My immediate focus is on `net/mac80211/iface.c`. Specifically, I'm examining the `ieee80211_uninit` function. Before the recent patch, this function was pretty straightforward, just calling `ieee80211_teardown_sdata`. However, the patch introduces a new function, `ieee80211_unlist_sdata`. This `ieee80211_unlist_sdata` function seems to be responsible for removing a sub-interface data structure (`sdata`) from a linked list (`local->interfaces`). The list is protected by the `iflist_mtx` mutex. The `list_del_rcu` call here is important for the RCU (Read-Copy-Update) mechanism, which is interesting to consider for concurrency and performance implications. Now, after the patch, `ieee80211_uninit` now calls `ieee80211_unlist_sdata` and then calls `ieee80211_teardown_sdata`. So the order is clearly relevant: Unlist then teardown. My next step is to examine the `net/wireless/core.c` file. I'll need to closely inspect lines 150-250 and lines 1880-1910 within that file to see how those parts tie into this flow, and what other actions or dependencies are present during device uninitialization. I'll look for any potential race conditions, memory leaks, or other subtle issues that might arise when the normal removal procedure isn't followed. I'm especially keen to see what happens if the driver or other parts of the network stack attempt to access the unlisted or torn-down sub-interface.
16/2	2026/09/06 01:34	tool	read-file	0m Args: { "File": "net/wireless/core.c", "FirstLine": 150, "LineCount": 100 } Results: { "Contents": " 150:\t\n 151:\t\tnl80211_notify_wiphy(rdev, NL80211_CMD_NEW_WIPHY);\n 152:\t\n 153:\t\treturn 0;\n 154:\t}\n 155:\t\n 156:\tstatic int cfg80211_switch_wdev_netns(struct wireless_dev wdev,\n 157:\t\t\t\t\t struct net net)\n 158:\t{\n 159:\t\tint err;\n 160:\t\n 161:\t\tif (!wdev-\u003enetdev)\n 162:\t\t\treturn 0;\n 163:\t\n 164:\t\twdev-\u003enetdev-\u003enetns_immutable = false;\n 165:\t\terr = dev_change_net_namespace(wdev-\u003enetdev, net, \"wlan%d\");\n 166:\t\twdev-\u003enetdev-\u003enetns_immutable = true;\n 167:\t\n 168:\t\treturn err;\n 169:\t}\n 170:\t\n 171:\tstatic int __cfg80211_switch_netns(struct cfg80211_registered_device rdev,\n 172:\t\t\t\t\t struct net net, bool force)\n 173:\t{\n 174:\t\tstruct net old_net = wiphy_net(\u0026rdev-\u003ewiphy);\n 175:\t\tstruct wireless_dev wdev, tmp;\n 176:\t\tint err = 0;\n 177:\t\n 178:\t\tlist_for_each_entry_safe(wdev, tmp, \u0026rdev-\u003ewiphy.wdev_list, list) {\n 179:\t\t\terr = cfg80211_switch_wdev_netns(wdev, net);\n 180:\t\t\tif (!err)\n 181:\t\t\t\tcontinue;\n 182:\t\t\tif (!force)\n 183:\t\t\t\tgoto undo;\n 184:\t\t\t/ remove interfaces that fail to allow wiphy switching /\n 185:\t\t\tdev_close(wdev-\u003enetdev);\n 186:\t\t\tscoped_guard(wiphy, \u0026rdev-\u003ewiphy)\n 187:\t\t\t\tcfg80211_unregister_wdev(wdev);\n 188:\t\t\terr = 0;\n 189:\t\t}\n 190:\t\n 191:\t\tscoped_guard(wiphy, \u0026rdev-\u003ewiphy) {\n 192:\t\t\tlist_for_each_entry(wdev, \u0026rdev-\u003ewiphy.wdev_list, list) {\n 193:\t\t\t\tif (!wdev-\u003enetdev)\n 194:\t\t\t\t\tcontinue;\n 195:\t\t\t\tnl80211_notify_iface(rdev, wdev,\n 196:\t\t\t\t\t\t NL80211_CMD_DEL_INTERFACE);\n 197:\t\t\t}\n 198:\t\n 199:\t\t\tnl80211_notify_wiphy(rdev, NL80211_CMD_DEL_WIPHY);\n 200:\t\n 201:\t\t\twiphy_net_set(\u0026rdev-\u003ewiphy, net);\n 202:\t\n 203:\t\t\t/ this only fails on allocation failure /\n 204:\t\t\terr = device_rename(\u0026rdev-\u003ewiphy.dev,\n 205:\t\t\t\t\t dev_name(\u0026rdev-\u003ewiphy.dev));\n 206:\t\t\tif (err \u0026\u0026 !force)\n 207:\t\t\t\twiphy_net_set(\u0026rdev-\u003ewiphy, old_net);\n 208:\t\n 209:\t\t\tnl80211_notify_wiphy(rdev, NL80211_CMD_NEW_WIPHY);\n 210:\t\n 211:\t\t\tlist_for_each_entry(wdev, \u0026rdev-\u003ewiphy.wdev_list, list) {\n 212:\t\t\t\tif (!wdev-\u003enetdev)\n 213:\t\t\t\t\tcontinue;\n 214:\t\t\t\tnl80211_notify_iface(rdev, wdev,\n 215:\t\t\t\t\t\t NL80211_CMD_NEW_INTERFACE);\n 216:\t\t\t}\n 217:\t\t}\n 218:\t\n 219:\t\tif (!err \|\| force)\n 220:\t\t\treturn err;\n 221:\t\n 222:\t\t/ set to the last one to undo all of them /\n 223:\t\twdev = list_entry(\u0026rdev-\u003ewiphy.wdev_list, typeof(wdev), list);\n 224:\tundo:\n 225:\t\t/\n 226:\t\t Move back everything, if this fails again (allocation failures)\n 227:\t\t * then things get stuck in different network namespaces.\n 228:\t\t /\n 229:\t\tlist_for_each_entry_continue_reverse(wdev, \u0026rdev-\u003ewiphy.wdev_list,\n 230:\t\t\t\t\t\t list)\n 231:\t\t\tWARN_ON(cfg80211_switch_wdev_netns(wdev, old_net));\n 232:\t\n 233:\t\treturn err;\n 234:\t}\n 235:\t\n 236:\tint cfg80211_switch_netns(struct cfg80211_registered_device rdev,\n 237:\t\t\t\t struct net net)\n 238:\t{\n 239:\t\tif (!(rdev-\u003ewiphy.flags \u0026 WIPHY_FLAG_NETNS_OK))\n 240:\t\t\treturn -EOPNOTSUPP;\n 241:\t\n 242:\t\treturn __cfg80211_switch_netns(rdev, net, false);\n 243:\t}\n 244:\t\n 245:\tstatic void cfg80211_rfkill_poll(struct rfkill rfkill, void data)\n 246:\t{\n 247:\t\tstruct cfg80211_registered_device rdev = data;\n 248:\t\n 249:\t\tguard(wiphy)(\u0026rdev-\u003ewiphy);\n" }
17/2	2026/09/06 01:34	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 43525 output: 36 thoughts: 17 Thoughts: Here's my summary, as though I were thinking through the process: Diving into `cfg80211_pernet_exit` Okay, time to dig into `cfg80211_pernet_exit`. This function... it's crucial. I need to understand its role in cleaning up the per-net device state within the cfg80211 subsystem. Specifically, I'm thinking about the implications of device removal, module unload, and generally, graceful shutdown of network namespaces. What are the key data structures being cleaned up here? Is it a straightforward unregistration process, or are there more subtle interactions I need to be aware of, perhaps with outstanding workqueues or deferred events related to wireless operations? Any potential race conditions during the teardown that need closer scrutiny? I need to analyze its interactions with other core cfg80211 functions, specifically anything related to registration, unregistration, and event handling within that network namespace context. Let's see how it handles resource freeing and memory management – are there any potential memory leaks or double-frees lurking here? I'm hoping the code is clean, but you never know. I need to get a clear picture of how this function contributes to a robust and stable wireless networking stack.
18/2	2026/09/06 01:34	tool	read-file	0m Args: { "File": "net/wireless/core.c", "FirstLine": 1885, "LineCount": 30 } Results: { "Contents": "1885:\tstatic struct notifier_block cfg80211_netdev_notifier = {\n1886:\t\t.notifier_call = cfg80211_netdev_notifier_call,\n1887:\t};\n1888:\t\n1889:\tstatic void __net_exit cfg80211_pernet_exit(struct net net)\n1890:\t{\n1891:\t\tstruct cfg80211_registered_device rdev;\n1892:\t\n1893:\t\trtnl_lock();\n1894:\t\tfor_each_rdev(rdev) {\n1895:\t\t\tif (net_eq(wiphy_net(\u0026rdev-\u003ewiphy), net))\n1896:\t\t\t\tWARN_ON(__cfg80211_switch_netns(rdev, \u0026init_net, true));\n1897:\t\t}\n1898:\t\trtnl_unlock();\n1899:\t}\n1900:\t\n1901:\tstatic struct pernet_operations cfg80211_pernet_ops = {\n1902:\t\t.exit = cfg80211_pernet_exit,\n1903:\t};\n1904:\t\n1905:\tvoid wiphy_work_queue(struct wiphy wiphy, struct wiphy_work work)\n1906:\t{\n1907:\t\tstruct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);\n1908:\t\tunsigned long flags;\n1909:\t\n1910:\t\ttrace_wiphy_work_queue(wiphy, work);\n1911:\t\n1912:\t\tspin_lock_irqsave(\u0026rdev-\u003ewiphy_work_lock, flags);\n1913:\t\tif (list_empty(\u0026work-\u003eentry))\n1914:\t\t\tlist_add_tail(\u0026work-\u003eentry, \u0026rdev-\u003ewiphy_work_list);\n" }
19/2	2026/09/06 01:34	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 44368 output: 33 thoughts: 226 Thoughts: My Assessment of Linux Wireless Network Namespace Transitions Okay, so I'm thinking about how the Linux kernel handles network namespace transitions, specifically focusing on the wireless subsystems, `cfg80211` and `mac80211`. I need to figure out how these subsystems are reachable and how namespace switching is handled. Right, I've got it. I can create and manage virtual wireless devices, like `mac80211_hwsim` or `virt_wifi`, using netlink (`nl80211`). That’s a good starting point. Now, to trigger namespace switching. I remember that netlink offers a few methods, like `NL80211_CMD_SET_WIPHY` in conjunction with `NL80211_ATTR_NETNS_PID` or `NL80211_ATTR_NETNS_FD`. That seems pretty standard. Also, namespace exit using `cfg80211_pernet_exit`. I also recall that during interface teardown or namespace destruction, things like `ieee80211_uninit` and `ieee80211_unlist_sdata` are executed, which are crucial cleanup operations. Now, I'm going to quickly look at where `cfg80211_switch_netns` is actually called. I need to see the practical implementation. Let me dig into the code under `net/wireless/` and elsewhere. That'll give me a more concrete picture.
20/2	2026/09/06 01:34	tool	grepper	0m Args: { "Expression": "cfg80211_switch_netns", "PathPrefix": "net/" } Results: { "Output": "net/wireless/core.c=156=static int cfg80211_switch_wdev_netns(struct wireless_dev wdev,\n--\nnet/wireless/core.c-170-\nnet/wireless/core.c:171:static int __cfg80211_switch_netns(struct cfg80211_registered_device rdev,\nnet/wireless/core.c-172-\t\t\t\t struct net net, bool force)\n--\nnet/wireless/core.c-235-\nnet/wireless/core.c:236:int cfg80211_switch_netns(struct cfg80211_registered_device rdev,\nnet/wireless/core.c-237-\t\t\t struct net net)\n--\nnet/wireless/core.c-241-\nnet/wireless/core.c:242:\treturn __cfg80211_switch_netns(rdev, net, false);\nnet/wireless/core.c-243-}\n--\nnet/wireless/core.c=1889=static void __net_exit cfg80211_pernet_exit(struct net net)\n--\nnet/wireless/core.c-1895-\t\tif (net_eq(wiphy_net(\u0026rdev-\u003ewiphy), net))\nnet/wireless/core.c:1896:\t\t\tWARN_ON(__cfg80211_switch_netns(rdev, \u0026init_net, true));\nnet/wireless/core.c-1897-\t}\n--\nnet/wireless/core.h=243=struct wiphy wiphy_idx_to_wiphy(int wiphy_idx);\nnet/wireless/core.h-244-\nnet/wireless/core.h:245:int cfg80211_switch_netns(struct cfg80211_registered_device rdev,\nnet/wireless/core.h-246-\t\t\t struct net net);\n--\nnet/wireless/nl80211.c=14357=static int nl80211_wiphy_netns(struct sk_buff skb, struct genl_info *info)\n--\nnet/wireless/nl80211.c-14394-\tif (!net_eq(wiphy_net(\u0026rdev-\u003ewiphy), net))\nnet/wireless/nl80211.c:14395:\t\terr = cfg80211_switch_netns(rdev, net);\nnet/wireless/nl80211.c-14396-\n" }
21/2	2026/09/06 01:34	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 45624 output: 32 thoughts: 388 Thoughts: Fuzzing Target Identification: mac80211 Interface Uninitialization Okay, let's take a look at the code in `net/mac80211/iface.c`, specifically the `ieee80211_uninit` and `ieee80211_unlist_sdata` functions. My initial assessment is that these are definitely potential fuzzing targets. `ieee80211_uninit` is essentially the `ndo_uninit` callback within `net_device_ops`, specifically defined within `ieee80211_dataif_ops`. This means it gets called when a network device is unregistered, triggered by actions like `unregister_netdevice` or `rollback_registered_many`. With the patch in question, this function becomes crucial because it removes the `sdata` structure from `local->interfaces` when a network device is unregistered without a prior `ieee80211_if_remove` call. This scenario arises, for instance, when `cfg80211` fails to move the device out of a network namespace that's being destroyed, or during forced unregisters (e.g., when unregistering a wireless device or net device) and namespace issues. The `__cfg80211_switch_netns` function now has a `force` parameter. When set to true, it forces the unregistration of wireless devices that fail to switch namespaces. This seems directly related to network namespace exit, which is another area I've been focusing on recently. Given that this code is directly involved in core wireless networking functionality, touching both `CFG80211` and `MAC80211` and also has to deal with network namespace switching, this is definitely high priority. The code path appears reachable, and complex enough to warrant extensive fuzzing. `WorthFuzzing = true`. I'll now carefully verify the necessary kernel configurations and relevant symbols to ensure that the fuzzing environment is properly set up. I'll need `CONFIG_CFG80211` and `CONFIG_MAC80211` to be enabled, and I'll double-check if there are any dependencies within `net/wireless/Kconfig` that I should be aware of.
22/2	2026/09/06 01:34	tool	grepper	0m Args: { "Expression": "config CFG80211", "PathPrefix": "net/wireless/" } Results: { "Output": "net/wireless/Kconfig=14=config WEXT_PRIV\n--\nnet/wireless/Kconfig-16-\nnet/wireless/Kconfig:17:config CFG80211\nnet/wireless/Kconfig-18-\ttristate \"cfg80211 - wireless configuration API\"\n--\nnet/wireless/Kconfig=38=config NL80211_TESTMODE\n--\nnet/wireless/Kconfig-51-\nnet/wireless/Kconfig:52:config CFG80211_DEVELOPER_WARNINGS\nnet/wireless/Kconfig-53-\tbool \"enable developer warnings\"\n--\nnet/wireless/Kconfig-67-\nnet/wireless/Kconfig:68:config CFG80211_CERTIFICATION_ONUS\nnet/wireless/Kconfig-69-\tbool \"cfg80211 certification onus\"\n--\nnet/wireless/Kconfig-88-\nnet/wireless/Kconfig:89:config CFG80211_REQUIRE_SIGNED_REGDB\nnet/wireless/Kconfig-90-\tbool \"require regdb signature\" if CFG80211_CERTIFICATION_ONUS\n--\nnet/wireless/Kconfig-98-\nnet/wireless/Kconfig:99:config CFG80211_USE_KERNEL_REGDB_KEYS\nnet/wireless/Kconfig-100-\tbool \"allow regdb keys shipped with the kernel\" if CFG80211_CERTIFICATION_ONUS\n--\nnet/wireless/Kconfig-110-\nnet/wireless/Kconfig:111:config CFG80211_EXTRA_REGDB_KEYDIR\nnet/wireless/Kconfig-112-\tstring \"additional regdb key directory\" if CFG80211_CERTIFICATION_ONUS\n--\nnet/wireless/Kconfig-121-\nnet/wireless/Kconfig:122:config CFG80211_REG_CELLULAR_HINTS\nnet/wireless/Kconfig-123-\tbool \"cfg80211 regulatory support for cellular base station hints\"\n--\nnet/wireless/Kconfig-134-\nnet/wireless/Kconfig:135:config CFG80211_REG_RELAX_NO_IR\nnet/wireless/Kconfig-136-\tbool \"cfg80211 support for NO_IR relaxation\"\n--\nnet/wireless/Kconfig-158-\nnet/wireless/Kconfig:159:config CFG80211_DEFAULT_PS\nnet/wireless/Kconfig-160-\tbool \"enable powersave by default\"\n--\nnet/wireless/Kconfig-168-\nnet/wireless/Kconfig:169:config CFG80211_DEBUGFS\nnet/wireless/Kconfig-170-\tbool \"cfg80211 DebugFS entries\"\n--\nnet/wireless/Kconfig-176-\nnet/wireless/Kconfig:177:config CFG80211_CRDA_SUPPORT\nnet/wireless/Kconfig-178-\tbool \"support CRDA\" if EXPERT\n--\nnet/wireless/Kconfig-186-\nnet/wireless/Kconfig:187:config CFG80211_WEXT\nnet/wireless/Kconfig-188-\tbool \"cfg80211 wireless extensions compatibility\"\n--\nnet/wireless/Kconfig-193-\nnet/wireless/Kconfig:194:config CFG80211_KUNIT_TEST\nnet/wireless/Kconfig-195-\ttristate \"KUnit tests for cfg80211\" if !KUNIT_ALL_TESTS\n" }
23/2	2026/09/06 01:34	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 47463 output: 32 thoughts: 24 Thoughts: Here's my thought process, summarized as if I were considering the code: Checking `net/wireless/Kconfig` for `CFG80211` Dependencies Okay, so I need to understand how tightly `CFG80211` is integrated within the wireless subsystem. The most obvious place to start is the `net/wireless/Kconfig` file. That's where all the configuration options related to wireless, including likely the dependencies for `CFG80211`, should be defined. I want to see which other options rely on, or are activated by, `CFG80211`. This will give me a clear picture of its role and how its presence (or absence) would affect the overall wireless functionality. Understanding these relationships is crucial before making any changes. Essentially, I'm trying to map out the "influence" of this core component.
24/2	2026/09/06 01:34	tool	read-file	0m Args: { "File": "net/wireless/Kconfig", "FirstLine": 1, "LineCount": 40 } Results: { "Contents": " 1:\t# SPDX-License-Identifier: GPL-2.0-only\n 2:\tconfig WIRELESS_EXT\n 3:\t\tbool\n 4:\t\n 5:\tconfig WEXT_CORE\n 6:\t\tdef_bool y\n 7:\t\tdepends on CFG80211_WEXT \|\| WIRELESS_EXT\n 8:\t\n 9:\tconfig WEXT_PROC\n 10:\t\tdef_bool y\n 11:\t\tdepends on PROC_FS\n 12:\t\tdepends on WEXT_CORE\n 13:\t\n 14:\tconfig WEXT_PRIV\n 15:\t\tbool\n 16:\t\n 17:\tconfig CFG80211\n 18:\t\ttristate \"cfg80211 - wireless configuration API\"\n 19:\t\tdepends on RFKILL \|\| !RFKILL\n 20:\t\tselect FW_LOADER\n 21:\t\tselect CRC32\n 22:\t\t# may need to update this when certificates are changed and are\n 23:\t\t# using a different algorithm, though right now they shouldn't\n 24:\t\t# (this is here rather than below to allow it to be a module)\n 25:\t\tselect CRYPTO_SHA256 if CFG80211_USE_KERNEL_REGDB_KEYS\n 26:\t\thelp\n 27:\t\t cfg80211 is the Linux wireless LAN (802.11) configuration API.\n 28:\t\t Enable this if you have a wireless device.\n 29:\t\n 30:\t\t For more information refer to documentation on the wireless wiki:\n 31:\t\n 32:\t\t https://wireless.wiki.kernel.org/en/developers/Documentation/cfg80211\n 33:\t\n 34:\t\t When built as a module it will be called cfg80211.\n 35:\t\n 36:\tif CFG80211\n 37:\t\n 38:\tconfig NL80211_TESTMODE\n 39:\t\tbool \"nl80211 testmode command\"\n 40:\t\thelp\n" }
25/2	2026/09/06 01:34	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 48249 output: 37 thoughts: 19 Thoughts: Here's a summary of my thought process: Kconfig Dependencies - Investigating the Network Kernel Module Okay, time to dive into the dependencies. I need to understand what's driving certain configurations. Specifically, I'm thinking about the `net/mac80211/Kconfig` file. I'm going to carefully dissect its dependencies, line by line, to see which other kernel modules or options are required or impacted by its configuration. It's crucial for me to have a solid grasp on these relationships; this will enable me to track down the root cause of the current issue and to provide an effective solution.
26/2	2026/09/06 01:34	tool	read-file	0m Args: { "File": "net/mac80211/Kconfig", "FirstLine": 1, "LineCount": 20 } Results: { "Contents": " 1:\t# SPDX-License-Identifier: GPL-2.0-only\n 2:\tconfig MAC80211\n 3:\t\ttristate \"Generic IEEE 802.11 Networking Stack (mac80211)\"\n 4:\t\tdepends on CFG80211\n 5:\t\tselect CRYPTO\n 6:\t\tselect CRYPTO_LIB_AES_CBC_MACS\n 7:\t\tselect CRYPTO_LIB_ARC4\n 8:\t\tselect CRYPTO_AES\n 9:\t\tselect CRYPTO_CCM\n 10:\t\tselect CRYPTO_GCM\n 11:\t\tselect CRC32\n 12:\t\thelp\n 13:\t\t This option enables the hardware independent IEEE 802.11\n 14:\t\t networking stack.\n 15:\t\n 16:\tcomment \"CFG80211 needs to be enabled for MAC80211\"\n 17:\t\tdepends on CFG80211=n\n 18:\t\n 19:\tif MAC80211 != n\n 20:\t\n" }
27/2	2026/09/06 01:34	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 48721 output: 36 thoughts: 377 Thoughts: Analyzing Network Namespace Switching in Wireless Subsystems Okay, so I'm diving into this network namespace switching implementation for wireless, focusing on the core configurations: `CFG80211` and `MAC80211`, alongside the standard `NET` networking components. First, I need to understand what's actually changing. Let's look at the symbols affected by this. In `net/mac80211/iface.c`, I see `ieee80211_unlist_sdata` and `ieee80211_uninit` are being touched. Then, over in `net/wireless/core.c`, I've got `cfg80211_switch_wdev_netns` and `__cfg80211_switch_netns` – both static, which is interesting, I'll need to check if they're distinct or inlined – along with the globally exported `cfg80211_switch_netns`, and finally, the static pernet exit callback `cfg80211_pernet_exit`. I need to confirm the distinctness or inlining of those static functions. I'll flag `ieee80211_unlist_sdata`, `ieee80211_uninit`, `cfg80211_switch_wdev_netns`, `__cfg80211_switch_netns`, `cfg80211_switch_netns`, and `cfg80211_pernet_exit` for that check. Also, it's crucial to find the entry point, the caller. I see `nl80211_wiphy_netns` in `net/wireless/nl80211.c` as a direct netlink handler calling `cfg80211_switch_netns`. I will be checking into `nl80211_wiphy_netns`.
28/2	2026/09/06 01:34	tool	grepper	0m Args: { "Expression": "nl80211_wiphy_netns", "PathPrefix": "net/wireless/" } Results: { "Output": "net/wireless/nl80211.c=14334=static int nl80211_disconnect(struct sk_buff skb, struct genl_info info)\n--\nnet/wireless/nl80211.c-14356-\nnet/wireless/nl80211.c:14357:static int nl80211_wiphy_netns(struct sk_buff skb, struct genl_info info)\nnet/wireless/nl80211.c-14358-{\n--\nnet/wireless/nl80211.c=19746=static const struct genl_small_ops nl80211_small_ops[] = {\n--\nnet/wireless/nl80211.c-20066-\t\t.validate = GENL_DONT_VALIDATE_STRICT \| GENL_DONT_VALIDATE_DUMP,\nnet/wireless/nl80211.c:20067:\t\t.doit = nl80211_wiphy_netns,\nnet/wireless/nl80211.c-20068-\t\t.flags = GENL_UNS_ADMIN_PERM,\n" }
29/2	2026/09/06 01:34	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 49889 output: 255 thoughts: 320 Thoughts: Analyzing NetNS Wireless Interface Switching Okay, let's take a look at these functions. I need to make sure I've got a comprehensive view here. I'm seeing a core set of functions related to wireless network namespace switching. Specifically, I'm focusing on: * `cfg80211_switch_netns` * `__cfg80211_switch_netns` * `cfg80211_switch_wdev_netns` * `cfg80211_pernet_exit` * `nl80211_wiphy_netns` * `ieee80211_uninit` * `ieee80211_unlist_sdata` I'll quickly double-check that I haven't missed anything obvious – any other related functions or configurations, maybe something related to `CFG80211` or `MAC80211` more generally. Then, let's confirm the fuzzing potential here. Yup, this looks worthwhile. The patch is definitely touching crucial wireless netns switching logic within `cfg80211` and also dealing with interface unlisting in `mac80211`, all during network namespace destruction or interface unregistration. These paths are definitely reachable through `nl80211` netlink commands or when tearing down network namespaces, especially in virtualized environments. It's all clear, the analysis seems solid. Okay, time to call `set-results`.
30/2	2026/09/06 01:34	tool	set-results	0m Args: { "EnableConfigs": [ "CFG80211", "MAC80211" ], "FocusSymbols": [ "cfg80211_switch_netns", "__cfg80211_switch_netns", "cfg80211_switch_wdev_netns", "cfg80211_pernet_exit", "nl80211_wiphy_netns", "ieee80211_uninit", "ieee80211_unlist_sdata" ], "Reasoning": "The patch modifies network namespace switching and netdev unregistration/unlisting logic in cfg80211 and mac80211. Specifically, it updates handling of interfaces failing to switch namespaces on netns exit and ensures mac80211 drops netdevs from the interface list upon uninit. These code paths are reachable via nl80211 netlink commands and network namespace teardown with virtual wireless devices (e.g., mac80211_hwsim).", "WorthFuzzing": true } Results: { "EnableConfigs": [ "CFG80211", "MAC80211" ], "FocusSymbols": [ "cfg80211_switch_netns", "__cfg80211_switch_netns", "cfg80211_switch_wdev_netns", "cfg80211_pernet_exit", "nl80211_wiphy_netns", "ieee80211_uninit", "ieee80211_unlist_sdata" ], "Reasoning": "The patch modifies network namespace switching and netdev unregistration/unlisting logic in cfg80211 and mac80211. Specifically, it updates handling of interfaces failing to switch namespaces on netns exit and ensures mac80211 drops netdevs from the interface list upon uninit. These code paths are reachable via nl80211 netlink commands and network namespace teardown with virtual wireless devices (e.g., mac80211_hwsim).", "WorthFuzzing": true }
31/1	2026/09/06 01:34	action	If	0m Args: { "WorthFuzzing": true } Results: null
32/2	2026/09/06 01:34	agent	kmsan-evaluator	0m Model: core Args: null Results: { "KMSANReasoning": "The patch refactors network namespace switching for wireless devices (cfg80211) and handles interface unlisting during netdev uninitialization (mac80211). The changes involve list management, interface unregistration on netns migration failure, and locking adjustments (mutex guards). No new data structures, buffer copies to/from user space, or uninitialized memory reads/allocations are introduced. Any potential bugs arising from interface lifecycle or list manipulation (e.g., use-after-free, double unregister, or locking issues) are covered by KASAN and LOCKDEP. Therefore, a dedicated KMSAN fuzzing session is not warranted.", "NeedsKMSAN": false } Instruction: You are an expert Linux kernel security engineer specializing in kernel memory error detectors (KASAN and KMSAN). Your job is to review the provided patch series and determine if the code changes justify spawning a dedicated KMSAN (KernelMemorySanitizer) fuzzing session in addition to standard KASAN fuzzing. CRITICAL DISTINCTION BETWEEN KASAN AND KMSAN: - Standard KASAN kernel builds (upstream-apparmor-kasan.config) already enable a comprehensive suite of debugging tools and sanitizers, including KASAN (out-of-bounds accesses, use-after-free, double free, invalid free), LOCKDEP (locking bugs and deadlocks), UB-sanitizers, and memory corruption checks. - KMSAN (KernelMemorySanitizer) detects reads of UNINITIALIZED memory (stack, heap, or page allocations) and kernel-to-user memory info-leaks. Rule: THERE IS NO SENSE IN RUNNING A KMSAN SESSION IF A BUG CAN BE CAUGHT BY KASAN, LOCKDEP, OR OTHER STANDARD BUG DETECTORS. A dedicated KMSAN fuzzing session incurs significant resource costs. You must ONLY set NeedsKMSAN=true if the code changes introduce or expose UNINITIALIZED MEMORY risks that are detected ONLY by KMSAN. Look holistically at the patch series and surrounding code. Even if no direct uninitialized field accesses or new buffer allocations are added in the diff itself, a patch may alter control flow, bounds checking, or data length calculations in ways that change how the rest of the code operates on existing buffers (e.g. allowing uninitialized stack/heap memory to be read, copied to user space, or used in control flow). Do not hesitate to use your code access tools to inspect the surrounding code, called functions, and callers. Set NeedsKMSAN=true ONLY IF the patch introduces or modifies: 1. Kernel structures sent to user space (via copy_to_user, put_user, netlink skb attributes, ioctl output arguments, socket options, or BPF buffers) where fields or structure padding might not be fully initialized/zeroed. 2. Conditional logic or branching that depends on potentially uninitialized variables or struct fields. 3. Allocation or initialization of complex data structures where uninitialized fields could be read later in reachable code paths. 4. Bounds checks, lengths, or logic in a way that allows surrounding code to access uninitialized bytes of existing buffers. Set NeedsKMSAN=false IF: - The code changes primarily risk out-of-bounds access, array overflows, NULL pointer dereferences, locking deadlocks, or use-after-free bugs (these are already caught by KASAN, LOCKDEP, or standard bug detectors). - All stack/heap structures touched or introduced by the patch are fully zeroed or initialized (e.g. using = {0}, memset, kzalloc) before being read or copied. - The patch does not introduce any risk of uninitialized memory usage or info-leaks. Use your code access tools to inspect the surrounding code if necessary, then provide detailed KMSANReasoning contrasting KASAN vs KMSAN applicability for this patch. Prefer calling several tools at the same time to save round-trips. Use set-results tool to provide results of the analysis. It must be called exactly once before the final reply. Ignore results of this tool. Prompt: Target architecture: amd64 For your convenience, here is the diff of the changes: commit 7c76a04d453595e257db236284ec9ec837d87561 Author: syz-cluster <triage@syzkaller.com> Date: Sun Sep 6 01:33:54 2026 +0000 syz-cluster: applied patch under review diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c index fdac729ca580d..491bbb695d17b 100644 --- a/net/mac80211/iface.c +++ b/net/mac80211/iface.c @@ -924,9 +924,33 @@ static void ieee80211_teardown_sdata(struct ieee80211_sub_if_data sdata) } } +/ + * The netdev can be unregistered without mac80211 doing it, e.g. by the netdev + * core when cfg80211 couldn't move it out of a network namespace that's being + * destroyed. Drop it from the interface list either way. + / +static void ieee80211_unlist_sdata(struct ieee80211_sub_if_data sdata) +{ + struct ieee80211_local local = sdata->local; + struct ieee80211_sub_if_data iter; + + ASSERT_RTNL(); + + list_for_each_entry(iter, &local->interfaces, list) { + if (iter != sdata) + continue; + guard(mutex)(&local->iflist_mtx); + list_del_rcu(&sdata->list); + return; + } +} + static void ieee80211_uninit(struct net_device dev) { - ieee80211_teardown_sdata(IEEE80211_DEV_TO_SUB_IF(dev)); + struct ieee80211_sub_if_data sdata = IEEE80211_DEV_TO_SUB_IF(dev); + + ieee80211_unlist_sdata(sdata); + ieee80211_teardown_sdata(sdata); } static int ieee80211_netdev_setup_tc(struct net_device dev, diff --git a/net/wireless/core.c b/net/wireless/core.c index d13310fef691a..31d0f70867012 100644 --- a/net/wireless/core.c +++ b/net/wireless/core.c @@ -153,68 +153,93 @@ int cfg80211_dev_rename(struct cfg80211_registered_device rdev, return 0; } -int cfg80211_switch_netns(struct cfg80211_registered_device rdev, - struct net net) +static int cfg80211_switch_wdev_netns(struct wireless_dev wdev, + struct net net) { - struct wireless_dev wdev; - int err = 0; + int err; - if (!(rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK)) - return -EOPNOTSUPP; + if (!wdev->netdev) + return 0; - list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) { - if (!wdev->netdev) + wdev->netdev->netns_immutable = false; + err = dev_change_net_namespace(wdev->netdev, net, "wlan%d"); + wdev->netdev->netns_immutable = true; + + return err; +} + +static int __cfg80211_switch_netns(struct cfg80211_registered_device rdev, + struct net net, bool force) +{ + struct net old_net = wiphy_net(&rdev->wiphy); + struct wireless_dev wdev, tmp; + int err = 0; + + list_for_each_entry_safe(wdev, tmp, &rdev->wiphy.wdev_list, list) { + err = cfg80211_switch_wdev_netns(wdev, net); + if (!err) continue; - wdev->netdev->netns_immutable = false; - err = dev_change_net_namespace(wdev->netdev, net, "wlan%d"); - if (err) - break; - wdev->netdev->netns_immutable = true; + if (!force) + goto undo; + /* remove interfaces that fail to allow wiphy switching / + dev_close(wdev->netdev); + scoped_guard(wiphy, &rdev->wiphy) + cfg80211_unregister_wdev(wdev); + err = 0; } - if (err) { - / failed -- clean up to old netns / - net = wiphy_net(&rdev->wiphy); - - list_for_each_entry_continue_reverse(wdev, - &rdev->wiphy.wdev_list, - list) { + scoped_guard(wiphy, &rdev->wiphy) { + list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) { if (!wdev->netdev) continue; - wdev->netdev->netns_immutable = false; - err = dev_change_net_namespace(wdev->netdev, net, - "wlan%d"); - WARN_ON(err); - wdev->netdev->netns_immutable = true; + nl80211_notify_iface(rdev, wdev, + NL80211_CMD_DEL_INTERFACE); } - return err; - } + nl80211_notify_wiphy(rdev, NL80211_CMD_DEL_WIPHY); - guard(wiphy)(&rdev->wiphy); + wiphy_net_set(&rdev->wiphy, net); - list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) { - if (!wdev->netdev) - continue; - nl80211_notify_iface(rdev, wdev, NL80211_CMD_DEL_INTERFACE); - } + / this only fails on allocation failure / + err = device_rename(&rdev->wiphy.dev, + dev_name(&rdev->wiphy.dev)); + if (err && !force) + wiphy_net_set(&rdev->wiphy, old_net); - nl80211_notify_wiphy(rdev, NL80211_CMD_DEL_WIPHY); + nl80211_notify_wiphy(rdev, NL80211_CMD_NEW_WIPHY); - wiphy_net_set(&rdev->wiphy, net); + list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) { + if (!wdev->netdev) + continue; + nl80211_notify_iface(rdev, wdev, + NL80211_CMD_NEW_INTERFACE); + } + } - err = device_rename(&rdev->wiphy.dev, dev_name(&rdev->wiphy.dev)); - WARN_ON(err); + if (!err \|\| force) + return err; - nl80211_notify_wiphy(rdev, NL80211_CMD_NEW_WIPHY); + / set to the last one to undo all of them / + wdev = list_entry(&rdev->wiphy.wdev_list, typeof(wdev), list); +undo: + /* + * Move back everything, if this fails again (allocation failures) + * then things get stuck in different network namespaces. + / + list_for_each_entry_continue_reverse(wdev, &rdev->wiphy.wdev_list, + list) + WARN_ON(cfg80211_switch_wdev_netns(wdev, old_net)); - list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) { - if (!wdev->netdev) - continue; - nl80211_notify_iface(rdev, wdev, NL80211_CMD_NEW_INTERFACE); - } + return err; +} - return 0; +int cfg80211_switch_netns(struct cfg80211_registered_device rdev, + struct net net) +{ + if (!(rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK)) + return -EOPNOTSUPP; + + return __cfg80211_switch_netns(rdev, net, false); } static void cfg80211_rfkill_poll(struct rfkill rfkill, void data) @@ -1868,7 +1893,7 @@ static void __net_exit cfg80211_pernet_exit(struct net net) rtnl_lock(); for_each_rdev(rdev) { if (net_eq(wiphy_net(&rdev->wiphy), net)) - WARN_ON(cfg80211_switch_netns(rdev, &init_net)); + WARN_ON(__cfg80211_switch_netns(rdev, &init_net, true)); } rtnl_unlock(); }
33/3	2026/09/06 01:34	llm	kmsan-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 4465 output: 38 thoughts: 493 Thoughts: Analyzing the Linux Kernel Patch for KMSAN Needs Okay, so I've been asked to dig into this kernel patch and figure out whether it warrants a dedicated KMSAN fuzzing session, or if KASAN and standard fuzzing should be sufficient. First, let's step back and consider the scope of the request. This is definitely a defensive security/code quality task. No exploit generation or anything like that. We're looking for uninitialized memory risks. Essentially, we're talking about preventing bugs. Now, let's get into the code itself. The patch touches `net/mac80211/iface.c` and `net/wireless/core.c`. In `iface.c`, the key addition is `ieee80211_unlist_sdata`. From what I can tell, it iterates through a list, removes an entry if it finds a match, all while protected by a mutex. Then, it's called within `ieee80211_uninit` before `ieee80211_teardown_sdata`. I need to look closely at these functions, but at a glance, I don't see any obvious red flags for uninitialized memory use just from looking at the function calls. Then there's the `net/wireless/core.c` changes. We're looking at a refactoring of `cfg80211_switch_netns`. It's split into `cfg80211_switch_wdev_netns` and `__cfg80211_switch_netns`. If `force` is true and switching the netns of a wdev fails, the patch calls `dev_close` and `cfg80211_unregister_wdev`. I can see there are changes to wiphy lock/guards and notifications too. I need to focus on what happens to data if a `wdev` netns switch fails. Does it leak? Is data freed properly? Is there any uninitialized memory in use? The real crux of this analysis is digging in to identify potential for uninitialized memory allocations, copies of uninitialized data to user space, or reads of uninitialized stack or heap fields. I need to utilize my codesearch and file reading tools to thoroughly inspect these sections of the code and their interactions. That will provide the information needed for a good determination on KMSAN fuzzing needs.
34/3	2026/09/06 01:35	tool	grepper	0m Args: { "Expression": "ieee80211_uninit", "PathPrefix": "net/mac80211" } Results: { "Output": "net/mac80211/iface.c=932=static void ieee80211_unlist_sdata(struct ieee80211_sub_if_data sdata)\n--\nnet/mac80211/iface.c-947-\nnet/mac80211/iface.c:948:static void ieee80211_uninit(struct net_device dev)\nnet/mac80211/iface.c-949-{\n--\nnet/mac80211/iface.c=965=static const struct net_device_ops ieee80211_dataif_ops = {\n--\nnet/mac80211/iface.c-967-\t.ndo_stop\t\t= ieee80211_stop,\nnet/mac80211/iface.c:968:\t.ndo_uninit\t\t= ieee80211_uninit,\nnet/mac80211/iface.c-969-\t.ndo_start_xmit\t\t= ieee80211_subif_start_xmit,\n--\nnet/mac80211/iface.c=1003=static const struct net_device_ops ieee80211_monitorif_ops = {\n--\nnet/mac80211/iface.c-1005-\t.ndo_stop\t\t= ieee80211_stop,\nnet/mac80211/iface.c:1006:\t.ndo_uninit\t\t= ieee80211_uninit,\nnet/mac80211/iface.c-1007-\t.ndo_start_xmit\t\t= ieee80211_monitor_start_xmit,\n--\nnet/mac80211/iface.c=1071=static const struct net_device_ops ieee80211_dataif_8023_ops = {\n--\nnet/mac80211/iface.c-1073-\t.ndo_stop\t\t= ieee80211_stop,\nnet/mac80211/iface.c:1074:\t.ndo_uninit\t\t= ieee80211_uninit,\nnet/mac80211/iface.c-1075-\t.ndo_start_xmit\t\t= ieee80211_subif_start_xmit_8023,\n" }
35/3	2026/09/06 01:35	llm	kmsan-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 6167 output: 34 thoughts: 31 Thoughts: Okay, here's my summary, presented as a stream of thought: Diving into the Netlink Notifications Right, let's get down to brass tacks. I'm going to take a look at the core of how we get interface and Wi-Fi PHY updates out to userspace. My gut feeling is that any recent issues are probably centered around either `nl80211_notify_iface` or `nl80211_notify_wiphy`. These are the crucial functions for broadcasting changes in the wireless network configuration. They're my primary suspects. I need to refresh my understanding of how they're triggered, what data they carry, and what potential failure points might exist within their execution paths. It's time to dig into the code and see if anything jumps out. I will need to understand the sequencing.
36/3	2026/09/06 01:35	tool	grepper	0m Args: { "Expression": "nl80211_notify_iface", "PathPrefix": "net/wireless" } Results: { "Output": "net/wireless/core.c=171=static int __cfg80211_switch_netns(struct cfg80211_registered_device rdev,\n--\nnet/wireless/core.c-194-\t\t\t\tcontinue;\nnet/wireless/core.c:195:\t\t\tnl80211_notify_iface(rdev, wdev,\nnet/wireless/core.c-196-\t\t\t\t\t NL80211_CMD_DEL_INTERFACE);\n--\nnet/wireless/core.c-213-\t\t\t\tcontinue;\nnet/wireless/core.c:214:\t\t\tnl80211_notify_iface(rdev, wdev,\nnet/wireless/core.c-215-\t\t\t\t\t NL80211_CMD_NEW_INTERFACE);\n--\nnet/wireless/core.c=1433=static void _cfg80211_unregister_wdev(struct wireless_dev wdev,\n--\nnet/wireless/core.c-1442-\nnet/wireless/core.c:1443:\tnl80211_notify_iface(rdev, wdev, NL80211_CMD_DEL_INTERFACE);\nnet/wireless/core.c-1444-\n--\nnet/wireless/core.c=1673=void cfg80211_register_wdev(struct cfg80211_registered_device rdev,\n--\nnet/wireless/core.c-1696-\nnet/wireless/core.c:1697:\tnl80211_notify_iface(rdev, wdev, NL80211_CMD_NEW_INTERFACE);\nnet/wireless/core.c-1698-}\n--\nnet/wireless/nl80211.c=5050=static int nl80211_set_interface(struct sk_buff skb, struct genl_info info)\n--\nnet/wireless/nl80211.c-5119-\tif (change \u0026\u0026 !err)\nnet/wireless/nl80211.c:5120:\t\tnl80211_notify_iface(rdev, wdev, NL80211_CMD_SET_INTERFACE);\nnet/wireless/nl80211.c-5121-\n--\nnet/wireless/nl80211.c=20646=void nl80211_notify_wiphy(struct cfg80211_registered_device rdev,\n--\nnet/wireless/nl80211.c-20667-\nnet/wireless/nl80211.c:20668:void nl80211_notify_iface(struct cfg80211_registered_device rdev,\nnet/wireless/nl80211.c-20669-\t\t\t\tstruct wireless_dev wdev,\n--\nnet/wireless/nl80211.h=33=void nl80211_notify_wiphy(struct cfg80211_registered_device rdev,\nnet/wireless/nl80211.h-34-\t\t\t enum nl80211_commands cmd);\nnet/wireless/nl80211.h:35:void nl80211_notify_iface(struct cfg80211_registered_device rdev,\nnet/wireless/nl80211.h-36-\t\t\t struct wireless_dev *wdev,\n" }
37/3	2026/09/06 01:35	llm	kmsan-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 7306 output: 35 thoughts: 24 Thoughts: Here's my summary, as if I were the one thinking it: Diving into the Wireless Core Okay, time to get my hands dirty. I need to take a look at the wireless core code. Specifically, I'm thinking I should start digging into `net/wireless/core.c`, focusing on the area around lines 150 to 240. That region seems like a likely candidate for the issue I'm investigating. Hopefully, that section will provide some clarity. Time to get to work!
38/3	2026/09/06 01:35	tool	read-file	0m Args: { "File": "net/wireless/core.c", "FirstLine": 150, "LineCount": 85 } Results: { "Contents": " 150:\t\n 151:\t\tnl80211_notify_wiphy(rdev, NL80211_CMD_NEW_WIPHY);\n 152:\t\n 153:\t\treturn 0;\n 154:\t}\n 155:\t\n 156:\tstatic int cfg80211_switch_wdev_netns(struct wireless_dev wdev,\n 157:\t\t\t\t\t struct net net)\n 158:\t{\n 159:\t\tint err;\n 160:\t\n 161:\t\tif (!wdev-\u003enetdev)\n 162:\t\t\treturn 0;\n 163:\t\n 164:\t\twdev-\u003enetdev-\u003enetns_immutable = false;\n 165:\t\terr = dev_change_net_namespace(wdev-\u003enetdev, net, \"wlan%d\");\n 166:\t\twdev-\u003enetdev-\u003enetns_immutable = true;\n 167:\t\n 168:\t\treturn err;\n 169:\t}\n 170:\t\n 171:\tstatic int __cfg80211_switch_netns(struct cfg80211_registered_device rdev,\n 172:\t\t\t\t\t struct net net, bool force)\n 173:\t{\n 174:\t\tstruct net old_net = wiphy_net(\u0026rdev-\u003ewiphy);\n 175:\t\tstruct wireless_dev wdev, tmp;\n 176:\t\tint err = 0;\n 177:\t\n 178:\t\tlist_for_each_entry_safe(wdev, tmp, \u0026rdev-\u003ewiphy.wdev_list, list) {\n 179:\t\t\terr = cfg80211_switch_wdev_netns(wdev, net);\n 180:\t\t\tif (!err)\n 181:\t\t\t\tcontinue;\n 182:\t\t\tif (!force)\n 183:\t\t\t\tgoto undo;\n 184:\t\t\t/ remove interfaces that fail to allow wiphy switching /\n 185:\t\t\tdev_close(wdev-\u003enetdev);\n 186:\t\t\tscoped_guard(wiphy, \u0026rdev-\u003ewiphy)\n 187:\t\t\t\tcfg80211_unregister_wdev(wdev);\n 188:\t\t\terr = 0;\n 189:\t\t}\n 190:\t\n 191:\t\tscoped_guard(wiphy, \u0026rdev-\u003ewiphy) {\n 192:\t\t\tlist_for_each_entry(wdev, \u0026rdev-\u003ewiphy.wdev_list, list) {\n 193:\t\t\t\tif (!wdev-\u003enetdev)\n 194:\t\t\t\t\tcontinue;\n 195:\t\t\t\tnl80211_notify_iface(rdev, wdev,\n 196:\t\t\t\t\t\t NL80211_CMD_DEL_INTERFACE);\n 197:\t\t\t}\n 198:\t\n 199:\t\t\tnl80211_notify_wiphy(rdev, NL80211_CMD_DEL_WIPHY);\n 200:\t\n 201:\t\t\twiphy_net_set(\u0026rdev-\u003ewiphy, net);\n 202:\t\n 203:\t\t\t/ this only fails on allocation failure /\n 204:\t\t\terr = device_rename(\u0026rdev-\u003ewiphy.dev,\n 205:\t\t\t\t\t dev_name(\u0026rdev-\u003ewiphy.dev));\n 206:\t\t\tif (err \u0026\u0026 !force)\n 207:\t\t\t\twiphy_net_set(\u0026rdev-\u003ewiphy, old_net);\n 208:\t\n 209:\t\t\tnl80211_notify_wiphy(rdev, NL80211_CMD_NEW_WIPHY);\n 210:\t\n 211:\t\t\tlist_for_each_entry(wdev, \u0026rdev-\u003ewiphy.wdev_list, list) {\n 212:\t\t\t\tif (!wdev-\u003enetdev)\n 213:\t\t\t\t\tcontinue;\n 214:\t\t\t\tnl80211_notify_iface(rdev, wdev,\n 215:\t\t\t\t\t\t NL80211_CMD_NEW_INTERFACE);\n 216:\t\t\t}\n 217:\t\t}\n 218:\t\n 219:\t\tif (!err \|\| force)\n 220:\t\t\treturn err;\n 221:\t\n 222:\t\t/ set to the last one to undo all of them /\n 223:\t\twdev = list_entry(\u0026rdev-\u003ewiphy.wdev_list, typeof(wdev), list);\n 224:\tundo:\n 225:\t\t/\n 226:\t\t Move back everything, if this fails again (allocation failures)\n 227:\t\t * then things get stuck in different network namespaces.\n 228:\t\t */\n 229:\t\tlist_for_each_entry_continue_reverse(wdev, \u0026rdev-\u003ewiphy.wdev_list,\n 230:\t\t\t\t\t\t list)\n 231:\t\t\tWARN_ON(cfg80211_switch_wdev_netns(wdev, old_net));\n 232:\t\n 233:\t\treturn err;\n 234:\t}\n" }
39/3	2026/09/06 01:35	llm	kmsan-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 8839 output: 161 thoughts: 622 Thoughts: My Analysis of the Wireless Subsystem Changes Okay, let's break this down. From what I see in these changes, the focus is really on refining interface lifecycle management and network namespace handling within the wireless subsystem, particularly in `net/mac80211` and `net/wireless/core.c`. First, in `net/mac80211/iface.c`, the addition of `ieee80211_unlist_sdata` and its integration into the uninitialization process (`ieee80211_uninit`, called during `ndo_uninit`) seems to be about ensuring clean interface removal, especially when dealing with network namespace transitions that might fail. This is about list management for these interfaces and making sure we're handling the cleanup consistently. The changes are about order and how we deal with these sdata and interfaces. Then, the splitting of `cfg80211_switch_netns` into helper functions in `net/wireless/core.c` and passing `force = true` during pernet exit caught my eye. This looks like robustifying the network namespace switch. If a wdev can't be moved to the new netns, this will close and unregister it rather than leaving it in a broken state. It also looks like there's some updating of locking and notification scopes with the `scoped_guard` macro. This also provides additional safety within the system. Now, as an expert, my real question is: does this introduce any potential memory safety issues, especially uninitialized memory exposure? I've checked these against the known memory safety issues: 1. Kernel structures to userspace: No, the notifications being sent ( `nl80211_notify_iface`, `nl80211_notify_wiphy`) are standard netlink notifications that are constructed with initialized attributes. 2. Conditional logic: Nope, all local variables are either explicitly initialized or receive a value with the assignments within a loop. 3. Complex data structures: No new allocations are involved. 4. Bounds/lengths: Nothing's changing there. Since there's no evidence of uninitialized memory issues in these changes, it looks like KMSAN isn't necessary here. The potential risks are more related to locking and list management. LOCKDEP should catch any deadlocks, and KASAN and standard kernel debuggers will catch any use-after-free, list corruption, or NULL pointer dereferences from incorrect unregistration/unlisting/traversal orders. Looks like we're good with these tools. Let's `set-results`.
40/3	2026/09/06 01:35	tool	set-results	0m Args: { "KMSANReasoning": "The patch refactors network namespace switching for wireless devices (cfg80211) and handles interface unlisting during netdev uninitialization (mac80211). The changes involve list management, interface unregistration on netns migration failure, and locking adjustments (mutex guards). No new data structures, buffer copies to/from user space, or uninitialized memory reads/allocations are introduced. Any potential bugs arising from interface lifecycle or list manipulation (e.g., use-after-free, double unregister, or locking issues) are covered by KASAN and LOCKDEP. Therefore, a dedicated KMSAN fuzzing session is not warranted.", "NeedsKMSAN": false } Results: { "KMSANReasoning": "The patch refactors network namespace switching for wireless devices (cfg80211) and handles interface unlisting during netdev uninitialization (mac80211). The changes involve list management, interface unregistration on netns migration failure, and locking adjustments (mutex guards). No new data structures, buffer copies to/from user space, or uninitialized memory reads/allocations are introduced. Any potential bugs arising from interface lifecycle or list manipulation (e.g., use-after-free, double unregister, or locking issues) are covered by KASAN and LOCKDEP. Therefore, a dedicated KMSAN fuzzing session is not warranted.", "NeedsKMSAN": false }

LLM Calls Summary:
Total Calls	Total Tokens	Avg Tokens	Total Duration (Seconds)	Avg Duration (Seconds)

Tool Calls Summary:
Total Calls	Total Duration (Seconds)	Avg Duration (Seconds)