AI Trajectory

null

{
  "EnableConfigs": [
    "IWLWIFI",
    "IWLMVM",
    "IWLMLD"
  ],
  "FocusSymbols": [
    "iwl_pnvm_complete_fn",
    "iwl_parse_shared_mem_22000",
    "iwl_parse_shared_mem",
    "iwl_get_nvm",
    "iwl_mvm_report_wakeup_reasons",
    "iwl_mvm_wowlan_store_wake_pkt",
    "iwl_mvm_nd_match_info_handler",
    "iwl_mvm_ftm_set_secured_ranging",
    "iwl_mvm_get_sar_geo_profile",
    "iwl_mvm_get_crosstimestamp_fw",
    "iwl_pcie_init_fw_sec"
  ],
  "Reasoning": "The patch makes functional changes to the iwlwifi driver, including adding support for UNII-9 channels, adding bounds checks for firmware notifications and responses, fixing memory leaks, and modifying NVM parsing logic. These changes affect the core logic of the driver and are worth fuzzing.",
  "WorthFuzzing": true
}

null

{
  "PatchDiff": "commit e34c9e58d2b24d57fb93131dde76f2a640604858\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Thu Jul 16 02:19:45 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/wireless/intel/iwlwifi/cfg/rf-pe.c b/drivers/net/wireless/intel/iwlwifi/cfg/rf-pe.c\nindex 7a04cb120b1b23..6080f5f23e6987 100644\n--- a/drivers/net/wireless/intel/iwlwifi/cfg/rf-pe.c\n+++ b/drivers/net/wireless/intel/iwlwifi/cfg/rf-pe.c\n@@ -15,6 +15,7 @@\n \t.non_shared_ant = ANT_B,\t\t\t\t\t\\\n \t.vht_mu_mimo_supported = true,\t\t\t\t\t\\\n \t.uhb_supported = true,\t\t\t\t\t\t\\\n+\t.unii9_supported = true,\t\t\t\t\t\\\n \t.eht_supported = true,\t\t\t\t\t\t\\\n \t.uhr_supported = true,\t\t\t\t\t\t\\\n \t.num_rbds = IWL_NUM_RBDS_EHT,\t\t\t\t\t\\\ndiff --git a/drivers/net/wireless/intel/iwlwifi/fw/api/nvm-reg.h b/drivers/net/wireless/intel/iwlwifi/fw/api/nvm-reg.h\nindex 443a9a41632523..0172c0747a47c9 100644\n--- a/drivers/net/wireless/intel/iwlwifi/fw/api/nvm-reg.h\n+++ b/drivers/net/wireless/intel/iwlwifi/fw/api/nvm-reg.h\n@@ -205,6 +205,7 @@ struct iwl_nvm_get_info_phy {\n \n #define IWL_NUM_CHANNELS_V1\t51\n #define IWL_NUM_CHANNELS_V2\t110\n+#define IWL_NUM_CHANNELS_V3\t115\n \n /**\n  * struct iwl_nvm_get_info_regulatory_v1 - regulatory information\n@@ -219,12 +220,12 @@ struct iwl_nvm_get_info_regulatory_v1 {\n } __packed; /* REGULATORY_NVM_GET_INFO_REGULATORY_S_VER_1 */\n \n /**\n- * struct iwl_nvm_get_info_regulatory - regulatory information\n+ * struct iwl_nvm_get_info_regulatory_v2 - regulatory information\n  * @lar_enabled: is LAR enabled\n  * @n_channels: number of valid channels in the array\n  * @channel_profile: regulatory data of this channel\n  */\n-struct iwl_nvm_get_info_regulatory {\n+struct iwl_nvm_get_info_regulatory_v2 {\n \t__le32 lar_enabled;\n \t__le32 n_channels;\n \t__le32 channel_profile[IWL_NUM_CHANNELS_V2];\n@@ -244,6 +245,32 @@ struct iwl_nvm_get_info_rsp_v3 {\n \tstruct iwl_nvm_get_info_regulatory_v1 regulatory;\n } __packed; /* REGULATORY_NVM_GET_INFO_RSP_API_S_VER_3 */\n \n+/**\n+ * struct iwl_nvm_get_info_rsp_v4 - response to get NVM data\n+ * @general: general NVM data\n+ * @mac_sku: data relating to MAC sku\n+ * @phy_sku: data relating to PHY sku\n+ * @regulatory: regulatory data\n+ */\n+struct iwl_nvm_get_info_rsp_v4 {\n+\tstruct iwl_nvm_get_info_general general;\n+\tstruct iwl_nvm_get_info_sku mac_sku;\n+\tstruct iwl_nvm_get_info_phy phy_sku;\n+\tstruct iwl_nvm_get_info_regulatory_v2 regulatory;\n+} __packed; /* REGULATORY_NVM_GET_INFO_RSP_API_S_VER_4 */\n+\n+/**\n+ * struct iwl_nvm_get_info_regulatory - regulatory information\n+ * @lar_enabled: is LAR enabled\n+ * @n_channels: number of valid channels in the array\n+ * @channel_profile: regulatory data of this channel\n+ */\n+struct iwl_nvm_get_info_regulatory {\n+\t__le32 lar_enabled;\n+\t__le32 n_channels;\n+\t__le32 channel_profile[IWL_NUM_CHANNELS_V3];\n+} __packed; /* REGULATORY_NVM_GET_INFO_REGULATORY_S_VER_3 */\n+\n /**\n  * struct iwl_nvm_get_info_rsp - response to get NVM data\n  * @general: general NVM data\n@@ -256,7 +283,7 @@ struct iwl_nvm_get_info_rsp {\n \tstruct iwl_nvm_get_info_sku mac_sku;\n \tstruct iwl_nvm_get_info_phy phy_sku;\n \tstruct iwl_nvm_get_info_regulatory regulatory;\n-} __packed; /* REGULATORY_NVM_GET_INFO_RSP_API_S_VER_4 */\n+} __packed; /* REGULATORY_NVM_GET_INFO_RSP_API_S_VER_5 */\n \n /**\n  * struct iwl_nvm_access_complete_cmd - NVM_ACCESS commands are completed\ndiff --git a/drivers/net/wireless/intel/iwlwifi/fw/api/scan.h b/drivers/net/wireless/intel/iwlwifi/fw/api/scan.h\nindex 08f4cc3ea1c304..ee78371082b094 100644\n--- a/drivers/net/wireless/intel/iwlwifi/fw/api/scan.h\n+++ b/drivers/net/wireless/intel/iwlwifi/fw/api/scan.h\n@@ -1,6 +1,6 @@\n /* SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause */\n /*\n- * Copyright (C) 2012-2014, 2018-2025 Intel Corporation\n+ * Copyright (C) 2012-2014, 2018-2026 Intel Corporation\n  * Copyright (C) 2013-2015 Intel Mobile Communications GmbH\n  * Copyright (C) 2016-2017 Intel Deutschland GmbH\n  */\n@@ -1319,7 +1319,7 @@ struct iwl_scan_offload_match_info {\n \tu8 resume_while_scanning;\n \tu8 self_recovery;\n \t__le16 reserved;\n-\tstruct iwl_scan_offload_profile_match matches[];\n+\tstruct iwl_scan_offload_profile_match matches[IWL_SCAN_MAX_PROFILES_V2];\n } __packed; /* SCAN_OFFLOAD_PROFILES_QUERY_RSP_S_VER_3 and\n \t     * SCAN_OFFLOAD_MATCH_INFO_NOTIFICATION_S_VER_1\n \t     */\ndiff --git a/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c b/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c\nindex afff8d51ca950c..ec0ff58ab312d5 100644\n--- a/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c\n+++ b/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c\n@@ -1,6 +1,6 @@\n // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause\n /*\n- * Copyright(c) 2020-2025 Intel Corporation\n+ * Copyright(c) 2020-2026 Intel Corporation\n  */\n \n #include \"iwl-drv.h\"\n@@ -12,6 +12,7 @@\n #include \"fw/api/alive.h\"\n #include \"fw/uefi.h\"\n #include \"fw/img.h\"\n+#include \"fw/dbg.h\"\n \n #define IWL_PNVM_REDUCED_CAP_BIT BIT(25)\n \n@@ -26,6 +27,12 @@ static bool iwl_pnvm_complete_fn(struct iwl_notif_wait_data *notif_wait,\n \tstruct iwl_trans *trans = (struct iwl_trans *)data;\n \tstruct iwl_pnvm_init_complete_ntfy *pnvm_ntf = (void *)pkt-\u003edata;\n \n+\tif (IWL_FW_CHECK(trans,\n+\t\t\t iwl_rx_packet_payload_len(pkt) \u003c sizeof(*pnvm_ntf),\n+\t\t\t \"Bad notif len: %d\\n\",\n+\t\t\t iwl_rx_packet_payload_len(pkt)))\n+\t\treturn true;\n+\n \tIWL_DEBUG_FW(trans,\n \t\t     \"PNVM complete notification received with status 0x%0x\\n\",\n \t\t     le32_to_cpu(pnvm_ntf-\u003estatus));\ndiff --git a/drivers/net/wireless/intel/iwlwifi/fw/regulatory.c b/drivers/net/wireless/intel/iwlwifi/fw/regulatory.c\nindex 8d9ff36e30f5e3..1d6d38ee55b499 100644\n--- a/drivers/net/wireless/intel/iwlwifi/fw/regulatory.c\n+++ b/drivers/net/wireless/intel/iwlwifi/fw/regulatory.c\n@@ -389,7 +389,7 @@ bool iwl_add_mcc_to_tas_block_list(u16 *list, u8 *size, u16 mcc)\n \tif (*size \u003e= IWL_WTAS_BLACK_LIST_MAX)\n \t\treturn false;\n \n-\tlist[*size++] = mcc;\n+\tlist[(*size)++] = mcc;\n \treturn true;\n }\n IWL_EXPORT_SYMBOL(iwl_add_mcc_to_tas_block_list);\ndiff --git a/drivers/net/wireless/intel/iwlwifi/fw/smem.c b/drivers/net/wireless/intel/iwlwifi/fw/smem.c\nindex 344ddde85b1897..20ed26a1bb00ec 100644\n--- a/drivers/net/wireless/intel/iwlwifi/fw/smem.c\n+++ b/drivers/net/wireless/intel/iwlwifi/fw/smem.c\n@@ -1,6 +1,6 @@\n // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause\n /*\n- * Copyright (C) 2012-2014, 2018-2021, 2025 Intel Corporation\n+ * Copyright (C) 2012-2014, 2018-2021, 2025-2026 Intel Corporation\n  * Copyright (C) 2013-2015 Intel Mobile Communications GmbH\n  * Copyright (C) 2016-2017 Intel Deutschland GmbH\n  */\n@@ -14,9 +14,17 @@ static void iwl_parse_shared_mem_22000(struct iwl_fw_runtime *fwrt,\n {\n \tstruct iwl_shared_mem_cfg *mem_cfg = (void *)pkt-\u003edata;\n \tint i, lmac;\n-\tint lmac_num = le32_to_cpu(mem_cfg-\u003elmac_num);\n-\tu8 api_ver = iwl_fw_lookup_notif_ver(fwrt-\u003efw, SYSTEM_GROUP,\n-\t\t\t\t\t     SHARED_MEM_CFG_CMD, 0);\n+\tint lmac_num;\n+\tu8 api_ver;\n+\n+\tif (IWL_FW_CHECK(fwrt, iwl_rx_packet_payload_len(pkt) \u003c\n+\t\t\t offsetofend(struct iwl_shared_mem_cfg, lmac_smem[1]),\n+\t\t\t \"bad shared mem notification size\\n\"))\n+\t\treturn;\n+\n+\tlmac_num = le32_to_cpu(mem_cfg-\u003elmac_num);\n+\tapi_ver = iwl_fw_lookup_notif_ver(fwrt-\u003efw, SYSTEM_GROUP,\n+\t\t\t\t\t  SHARED_MEM_CFG_CMD, 0);\n \n \t/* Note: notification has 3 entries, but we only expect 2 */\n \tif (IWL_FW_CHECK(fwrt, lmac_num \u003e ARRAY_SIZE(fwrt-\u003esmem_cfg.lmac),\n@@ -30,7 +38,7 @@ static void iwl_parse_shared_mem_22000(struct iwl_fw_runtime *fwrt,\n \n \tif (api_ver \u003e= 4 \u0026\u0026\n \t    !IWL_FW_CHECK(fwrt, iwl_rx_packet_payload_len(pkt) \u003c sizeof(*mem_cfg),\n-\t\t\t  \"bad shared mem notification size\\n\")) {\n+\t\t\t  \"bad shared mem notification size (v4)\\n\")) {\n \t\tfwrt-\u003esmem_cfg.rxfifo2_control_size =\n \t\t\tle32_to_cpu(mem_cfg-\u003erxfifo2_control_size);\n \t}\n@@ -53,6 +61,11 @@ static void iwl_parse_shared_mem(struct iwl_fw_runtime *fwrt,\n \tstruct iwl_shared_mem_cfg_v2 *mem_cfg = (void *)pkt-\u003edata;\n \tint i;\n \n+\tif (IWL_FW_CHECK(fwrt, iwl_rx_packet_payload_len(pkt) \u003c\n+\t\t\t offsetof(struct iwl_shared_mem_cfg_v2, rxfifo_addr),\n+\t\t\t \"bad shared mem notification size\\n\"))\n+\t\treturn;\n+\n \tfwrt-\u003esmem_cfg.num_lmacs = 1;\n \n \tfwrt-\u003esmem_cfg.num_txfifo_entries = ARRAY_SIZE(mem_cfg-\u003etxfifo_size);\n@@ -67,6 +80,11 @@ static void iwl_parse_shared_mem(struct iwl_fw_runtime *fwrt,\n \t/* new API has more data, from rxfifo_addr field and on */\n \tif (fw_has_capa(\u0026fwrt-\u003efw-\u003eucode_capa,\n \t\t\tIWL_UCODE_TLV_CAPA_EXTEND_SHARED_MEM_CFG)) {\n+\t\tif (IWL_FW_CHECK(fwrt, iwl_rx_packet_payload_len(pkt) \u003c\n+\t\t\t\t sizeof(*mem_cfg),\n+\t\t\t\t \"bad shared mem notification size (extend)\\n\"))\n+\t\t\treturn;\n+\n \t\tBUILD_BUG_ON(sizeof(fwrt-\u003esmem_cfg.internal_txfifo_size) !=\n \t\t\t     sizeof(mem_cfg-\u003einternal_txfifo_size));\n \ndiff --git a/drivers/net/wireless/intel/iwlwifi/iwl-config.h b/drivers/net/wireless/intel/iwlwifi/iwl-config.h\nindex 6a3539ad73317e..3ac7f000ede478 100644\n--- a/drivers/net/wireless/intel/iwlwifi/iwl-config.h\n+++ b/drivers/net/wireless/intel/iwlwifi/iwl-config.h\n@@ -415,6 +415,7 @@ struct iwl_mac_cfg {\n  * @vht_mu_mimo_supported: VHT MU-MIMO support\n  * @nvm_type: see \u0026enum iwl_nvm_type\n  * @uhb_supported: ultra high band channels supported\n+ * @unii9_supported: UNII-9 channels supported\n  * @eht_supported: EHT supported\n  * @uhr_supported: UHR supported\n  * @num_rbds: number of receive buffer descriptors to use\n@@ -450,6 +451,7 @@ struct iwl_rf_cfg {\n \t    lp_xtal_workaround:1,\n \t    vht_mu_mimo_supported:1,\n \t    uhb_supported:1,\n+\t    unii9_supported:1,\n \t    eht_supported:1,\n \t    uhr_supported:1;\n \tu8 valid_tx_ant;\ndiff --git a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c\nindex d47b4ae2f48630..bd5353fdde81a4 100644\n--- a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c\n+++ b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c\n@@ -85,16 +85,7 @@ static const u16 iwl_nvm_channels[] = {\n \t149, 153, 157, 161, 165\n };\n \n-static const u16 iwl_ext_nvm_channels[] = {\n-\t/* 2.4 GHz */\n-\t1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14,\n-\t/* 5 GHz */\n-\t36, 40, 44, 48, 52, 56, 60, 64, 68, 72, 76, 80, 84, 88, 92,\n-\t96, 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140, 144,\n-\t149, 153, 157, 161, 165, 169, 173, 177, 181\n-};\n-\n-static const u16 iwl_uhb_nvm_channels[] = {\n+static const u16 iwl_unii9_nvm_channels[] = {\n \t/* 2.4 GHz */\n \t1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14,\n \t/* 5 GHz */\n@@ -105,12 +96,16 @@ static const u16 iwl_uhb_nvm_channels[] = {\n \t1, 5, 9, 13, 17, 21, 25, 29, 33, 37, 41, 45, 49, 53, 57, 61, 65, 69,\n \t73, 77, 81, 85, 89, 93, 97, 101, 105, 109, 113, 117, 121, 125, 129,\n \t133, 137, 141, 145, 149, 153, 157, 161, 165, 169, 173, 177, 181, 185,\n-\t189, 193, 197, 201, 205, 209, 213, 217, 221, 225, 229, 233\n+\t189, 193, 197, 201, 205, 209, 213, 217, 221, 225, 229, 233,\n+\n+\t/* UNII-9 */\n+\t237, 241, 245, 249, 253\n };\n \n #define IWL_NVM_NUM_CHANNELS\t\tARRAY_SIZE(iwl_nvm_channels)\n-#define IWL_NVM_NUM_CHANNELS_EXT\tARRAY_SIZE(iwl_ext_nvm_channels)\n-#define IWL_NVM_NUM_CHANNELS_UHB\tARRAY_SIZE(iwl_uhb_nvm_channels)\n+#define IWL_NVM_NUM_CHANNELS_EXT\t51\n+#define IWL_NVM_NUM_CHANNELS_UHB\t110\n+#define IWL_NVM_NUM_CHANNELS_UNII9\tARRAY_SIZE(iwl_unii9_nvm_channels)\n #define NUM_2GHZ_CHANNELS\t\t14\n #define NUM_5GHZ_CHANNELS\t\t37\n #define FIRST_2GHZ_HT_MINUS\t\t5\n@@ -351,12 +346,15 @@ static int iwl_init_channel_map(struct iwl_trans *trans,\n \tint num_of_ch;\n \tconst u16 *nvm_chan;\n \n-\tif (cfg-\u003euhb_supported) {\n+\tif (cfg-\u003eunii9_supported) {\n+\t\tnum_of_ch = IWL_NVM_NUM_CHANNELS_UNII9;\n+\t\tnvm_chan = iwl_unii9_nvm_channels;\n+\t} else if (cfg-\u003euhb_supported) {\n \t\tnum_of_ch = IWL_NVM_NUM_CHANNELS_UHB;\n-\t\tnvm_chan = iwl_uhb_nvm_channels;\n+\t\tnvm_chan = iwl_unii9_nvm_channels;\n \t} else if (cfg-\u003envm_type == IWL_NVM_EXT) {\n \t\tnum_of_ch = IWL_NVM_NUM_CHANNELS_EXT;\n-\t\tnvm_chan = iwl_ext_nvm_channels;\n+\t\tnvm_chan = iwl_unii9_nvm_channels;\n \t} else {\n \t\tnum_of_ch = IWL_NVM_NUM_CHANNELS;\n \t\tnvm_chan = iwl_nvm_channels;\n@@ -1441,7 +1439,9 @@ iwl_parse_mei_nvm_data(struct iwl_trans *trans, const struct iwl_rf_cfg *cfg,\n \tu8 rx_chains = fw-\u003evalid_rx_ant;\n \tu8 tx_chains = fw-\u003evalid_rx_ant;\n \n-\tif (cfg-\u003euhb_supported)\n+\tif (cfg-\u003eunii9_supported)\n+\t\tdata = kzalloc_flex(*data, channels, IWL_NVM_NUM_CHANNELS_UNII9);\n+\telse if (cfg-\u003euhb_supported)\n \t\tdata = kzalloc_flex(*data, channels, IWL_NVM_NUM_CHANNELS_UHB);\n \telse\n \t\tdata = kzalloc_flex(*data, channels, IWL_NVM_NUM_CHANNELS_EXT);\n@@ -1506,7 +1506,9 @@ iwl_parse_nvm_data(struct iwl_trans *trans, const struct iwl_rf_cfg *cfg,\n \tu16 lar_config;\n \tconst __le16 *ch_section;\n \n-\tif (cfg-\u003euhb_supported)\n+\tif (cfg-\u003eunii9_supported)\n+\t\tdata = kzalloc_flex(*data, channels, IWL_NVM_NUM_CHANNELS_UNII9);\n+\telse if (cfg-\u003euhb_supported)\n \t\tdata = kzalloc_flex(*data, channels, IWL_NVM_NUM_CHANNELS_UHB);\n \telse if (cfg-\u003envm_type != IWL_NVM_EXT)\n \t\tdata = kzalloc_flex(*data, channels, IWL_NVM_NUM_CHANNELS);\n@@ -1727,12 +1729,15 @@ iwl_parse_nvm_mcc_info(struct iwl_trans *trans,\n \tint max_num_ch;\n \tstruct iwl_reg_capa reg_capa;\n \n-\tif (cfg-\u003euhb_supported) {\n+\tif (cfg-\u003eunii9_supported) {\n+\t\tmax_num_ch = IWL_NVM_NUM_CHANNELS_UNII9;\n+\t\tnvm_chan = iwl_unii9_nvm_channels;\n+\t} else if (cfg-\u003euhb_supported) {\n \t\tmax_num_ch = IWL_NVM_NUM_CHANNELS_UHB;\n-\t\tnvm_chan = iwl_uhb_nvm_channels;\n+\t\tnvm_chan = iwl_unii9_nvm_channels;\n \t} else if (cfg-\u003envm_type == IWL_NVM_EXT) {\n \t\tmax_num_ch = IWL_NVM_NUM_CHANNELS_EXT;\n-\t\tnvm_chan = iwl_ext_nvm_channels;\n+\t\tnvm_chan = iwl_unii9_nvm_channels;\n \t} else {\n \t\tmax_num_ch = IWL_NVM_NUM_CHANNELS;\n \t\tnvm_chan = iwl_nvm_channels;\n@@ -2087,13 +2092,26 @@ struct iwl_nvm_data *iwl_get_nvm(struct iwl_trans *trans,\n \tstruct iwl_nvm_get_info_rsp_v3 *rsp_v3;\n \tbool v4 = fw_has_api(\u0026fw-\u003eucode_capa,\n \t\t\t     IWL_UCODE_TLV_API_REGULATORY_NVM_INFO);\n-\tsize_t rsp_size = v4 ? sizeof(*rsp) : sizeof(*rsp_v3);\n+\tsize_t rsp_size;\n \tvoid *channel_profile;\n \n \tret = iwl_trans_send_cmd(trans, \u0026hcmd);\n \tif (ret)\n \t\treturn ERR_PTR(ret);\n \n+\tswitch (iwl_fw_lookup_notif_ver(fw, REGULATORY_AND_NVM_GROUP,\n+\t\t\t\t\tNVM_GET_INFO, 0)) {\n+\tcase 5:\n+\t\trsp_size = sizeof(struct iwl_nvm_get_info_rsp);\n+\t\tbreak;\n+\tcase 4:\n+\t\trsp_size = sizeof(struct iwl_nvm_get_info_rsp_v4);\n+\t\tbreak;\n+\tdefault:\n+\t\trsp_size = sizeof(struct iwl_nvm_get_info_rsp_v3);\n+\t\tbreak;\n+\t}\n+\n \tif (WARN(iwl_rx_packet_payload_len(hcmd.resp_pkt) != rsp_size,\n \t\t \"Invalid payload len in NVM response from FW %d\",\n \t\t iwl_rx_packet_payload_len(hcmd.resp_pkt))) {\n@@ -2107,7 +2125,7 @@ struct iwl_nvm_data *iwl_get_nvm(struct iwl_trans *trans,\n \tif (empty_otp)\n \t\tIWL_INFO(trans, \"OTP is empty\\n\");\n \n-\tnvm = kzalloc_flex(*nvm, channels, IWL_NUM_CHANNELS_V2);\n+\tnvm = kzalloc_flex(*nvm, channels, IWL_NUM_CHANNELS_V3);\n \tif (!nvm) {\n \t\tret = -ENOMEM;\n \t\tgoto out;\ndiff --git a/drivers/net/wireless/intel/iwlwifi/mld/tx.c b/drivers/net/wireless/intel/iwlwifi/mld/tx.c\nindex 2185dade95f8cb..2df6643a5aa80f 100644\n--- a/drivers/net/wireless/intel/iwlwifi/mld/tx.c\n+++ b/drivers/net/wireless/intel/iwlwifi/mld/tx.c\n@@ -1120,6 +1120,10 @@ void iwl_mld_handle_tx_resp_notif(struct iwl_mld *mld,\n \tssn = le32_to_cpup((__le32 *)agg_status +\n \t\t\t   tx_resp-\u003eframe_count) \u0026 0xFFFF;\n \n+\tif (IWL_FW_CHECK(mld, txq_id \u003e= ARRAY_SIZE(mld-\u003efw_id_to_txq),\n+\t\t\t \"Invalid txq id %d\\n\", txq_id))\n+\t\treturn;\n+\n \t__skb_queue_head_init(\u0026skbs);\n \n \t/* we can free until ssn % q.n_bd not inclusive */\ndiff --git a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c\nindex 3429d9a10e4209..6b11fa32ea5c6b 100644\n--- a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c\n+++ b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c\n@@ -1509,6 +1509,10 @@ static void iwl_mvm_report_wakeup_reasons(struct iwl_mvm *mvm,\n \t\tif (WARN_ON_ONCE(truncated \u003c 0))\n \t\t\ttruncated = 0;\n \n+\t\t/* this would be a firmware bug */\n+\t\tif (WARN_ON_ONCE(pktsize \u003c sizeof(*hdr)))\n+\t\t\treturn;\n+\n \t\tif (ieee80211_is_data(hdr-\u003eframe_control)) {\n \t\t\tint hdrlen = ieee80211_hdrlen(hdr-\u003eframe_control);\n \t\t\tint ivlen = 0, icvlen = 4; /* also FCS */\n@@ -1517,10 +1521,6 @@ static void iwl_mvm_report_wakeup_reasons(struct iwl_mvm *mvm,\n \t\t\tif (!pkt)\n \t\t\t\tgoto report;\n \n-\t\t\tskb_put_data(pkt, pktdata, hdrlen);\n-\t\t\tpktdata += hdrlen;\n-\t\t\tpktsize -= hdrlen;\n-\n \t\t\tif (ieee80211_has_protected(hdr-\u003eframe_control)) {\n \t\t\t\t/*\n \t\t\t\t * This is unlocked and using gtk_i(c)vlen,\n@@ -1546,6 +1546,17 @@ static void iwl_mvm_report_wakeup_reasons(struct iwl_mvm *mvm,\n \t\t\t\ttruncated = 0;\n \t\t\t}\n \n+\t\t\tif (IWL_FW_CHECK(mvm,\n+\t\t\t\t\t pktsize \u003c= hdrlen + ivlen + icvlen,\n+\t\t\t\t\t \"pktsize is too small %d\\n\",\n+\t\t\t\t\t pktsize)) {\n+\t\t\t\tkfree_skb(pkt);\n+\t\t\t\treturn;\n+\t\t\t}\n+\n+\t\t\tskb_put_data(pkt, pktdata, hdrlen);\n+\t\t\tpktdata += hdrlen;\n+\t\t\tpktsize -= hdrlen;\n \t\t\tpktsize -= ivlen + icvlen;\n \t\t\tpktdata += ivlen;\n \n@@ -2448,13 +2459,15 @@ iwl_mvm_netdetect_query_results(struct iwl_mvm *mvm,\n \n \tif (fw_has_api(\u0026mvm-\u003efw-\u003eucode_capa,\n \t\t       IWL_UCODE_TLV_API_SCAN_OFFLOAD_CHANS)) {\n-\t\tquery_len = sizeof(struct iwl_scan_offload_match_info);\n \t\tmatches_len = sizeof(struct iwl_scan_offload_profile_match) *\n \t\t\tmax_profiles;\n+\t\tquery_len = offsetof(struct iwl_scan_offload_match_info,\n+\t\t\t\t     matches) + matches_len;\n \t} else {\n-\t\tquery_len = sizeof(struct iwl_scan_offload_profiles_query_v1);\n \t\tmatches_len = sizeof(struct iwl_scan_offload_profile_match_v1) *\n \t\t\tmax_profiles;\n+\t\tquery_len = sizeof(struct iwl_scan_offload_profiles_query_v1) +\n+\t\t\tmatches_len;\n \t}\n \n \tlen = iwl_rx_packet_payload_len(cmd.resp_pkt);\n@@ -2756,7 +2769,7 @@ static int iwl_mvm_wowlan_store_wake_pkt(struct iwl_mvm *mvm,\n \t\t\t\t\t struct iwl_wowlan_status_data *status,\n \t\t\t\t\t u32 len)\n {\n-\tu32 data_size, packet_len = le32_to_cpu(notif-\u003ewake_packet_length);\n+\tu32 data_size, packet_len;\n \n \tif (len \u003c sizeof(*notif)) {\n \t\tIWL_ERR(mvm, \"Invalid WoWLAN wake packet notification!\\n\");\n@@ -2775,6 +2788,7 @@ static int iwl_mvm_wowlan_store_wake_pkt(struct iwl_mvm *mvm,\n \t\treturn -EIO;\n \t}\n \n+\tpacket_len = le32_to_cpu(notif-\u003ewake_packet_length);\n \tdata_size = len - offsetof(struct iwl_wowlan_wake_pkt_notif, wake_packet);\n \n \t/* data_size got the padding from the notification, remove it. */\n@@ -2807,7 +2821,8 @@ static void iwl_mvm_nd_match_info_handler(struct iwl_mvm *mvm,\n \tif (IS_ERR_OR_NULL(vif))\n \t\treturn;\n \n-\tif (len \u003c sizeof(struct iwl_scan_offload_match_info) + matches_len) {\n+\tif (len \u003c offsetof(struct iwl_scan_offload_match_info, matches) +\n+\t\t    matches_len) {\n \t\tIWL_ERR(mvm, \"Invalid scan match info notification\\n\");\n \t\treturn;\n \t}\ndiff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ftm-initiator.c b/drivers/net/wireless/intel/iwlwifi/mvm/ftm-initiator.c\nindex 3a14ca5e512ae3..8d7f60dcd0270e 100644\n--- a/drivers/net/wireless/intel/iwlwifi/mvm/ftm-initiator.c\n+++ b/drivers/net/wireless/intel/iwlwifi/mvm/ftm-initiator.c\n@@ -646,7 +646,8 @@ static void iter(struct ieee80211_hw *hw,\n \tWARN_ON(*target-\u003ecipher == IWL_LOCATION_CIPHER_INVALID);\n }\n \n-static void\n+/* The tk buffer is assumed to be exactly TK_11AZ_LEN bytes */\n+static int\n iwl_mvm_ftm_set_secured_ranging(struct iwl_mvm *mvm, struct ieee80211_vif *vif,\n \t\t\t\tu8 *bssid, u8 *cipher, u8 *hltk, u8 *tk,\n \t\t\t\tu8 *rx_pn, u8 *tx_pn, __le32 *flags)\n@@ -656,12 +657,12 @@ iwl_mvm_ftm_set_secured_ranging(struct iwl_mvm *mvm, struct ieee80211_vif *vif,\n \tstruct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);\n \n \tif (mvmvif-\u003eftm_unprotected)\n-\t\treturn;\n+\t\treturn 0;\n #endif\n \n \tif (!(le32_to_cpu(*flags) \u0026 (IWL_INITIATOR_AP_FLAGS_NON_TB |\n \t\t       IWL_INITIATOR_AP_FLAGS_TB)))\n-\t\treturn;\n+\t\treturn 0;\n \n \tlockdep_assert_held(\u0026mvm-\u003emutex);\n \n@@ -679,14 +680,31 @@ iwl_mvm_ftm_set_secured_ranging(struct iwl_mvm *mvm, struct ieee80211_vif *vif,\n \t\tif (vif-\u003ecfg.assoc \u0026\u0026\n \t\t    !memcmp(vif-\u003ebss_conf.bssid, bssid, ETH_ALEN)) {\n \t\t\tstruct iwl_mvm_ftm_iter_data target;\n+\t\t\tu32 key_len;\n \n \t\t\ttarget.bssid = bssid;\n \t\t\ttarget.cipher = cipher;\n \t\t\ttarget.tk = NULL;\n \t\t\tieee80211_iter_keys(mvm-\u003ehw, vif, iter, \u0026target);\n \n-\t\t\tif (!WARN_ON(!target.tk))\n-\t\t\t\tmemcpy(tk, target.tk, TK_11AZ_LEN);\n+\t\t\tif (WARN_ON(!target.tk))\n+\t\t\t\treturn -EINVAL;\n+\n+\t\t\tswitch (*target.cipher) {\n+\t\t\tcase IWL_LOCATION_CIPHER_CCMP_128:\n+\t\t\tcase IWL_LOCATION_CIPHER_GCMP_128:\n+\t\t\t\tkey_len = WLAN_KEY_LEN_CCMP;\n+\t\t\t\tbreak;\n+\t\t\tcase IWL_LOCATION_CIPHER_GCMP_256:\n+\t\t\t\tkey_len = WLAN_KEY_LEN_GCMP_256;\n+\t\t\t\tbreak;\n+\t\t\tdefault:\n+\t\t\t\tWARN_ON(1);\n+\t\t\t\treturn -EINVAL;\n+\t\t\t}\n+\n+\t\t\tmemset(tk, 0, TK_11AZ_LEN);\n+\t\t\tmemcpy(tk, target.tk, key_len);\n \t\t} else {\n \t\t\tmemcpy(tk, entry-\u003etk, sizeof(entry-\u003etk));\n \t\t}\n@@ -695,8 +713,10 @@ iwl_mvm_ftm_set_secured_ranging(struct iwl_mvm *mvm, struct ieee80211_vif *vif,\n \t\tmemcpy(tx_pn, entry-\u003etx_pn, sizeof(entry-\u003etx_pn));\n \n \t\tFTM_SET_FLAG(SECURED);\n-\t\treturn;\n+\t\treturn 0;\n \t}\n+\n+\treturn 0;\n }\n \n static int\n@@ -708,12 +728,11 @@ iwl_mvm_ftm_put_target_v7(struct iwl_mvm *mvm, struct ieee80211_vif *vif,\n \tif (err)\n \t\treturn err;\n \n-\tiwl_mvm_ftm_set_secured_ranging(mvm, vif, target-\u003ebssid,\n-\t\t\t\t\t\u0026target-\u003ecipher, target-\u003ehltk,\n-\t\t\t\t\ttarget-\u003etk, target-\u003erx_pn,\n-\t\t\t\t\ttarget-\u003etx_pn,\n-\t\t\t\t\t\u0026target-\u003einitiator_ap_flags);\n-\treturn err;\n+\treturn iwl_mvm_ftm_set_secured_ranging(mvm, vif, target-\u003ebssid,\n+\t\t\t\t\t      \u0026target-\u003ecipher, target-\u003ehltk,\n+\t\t\t\t\t      target-\u003etk, target-\u003erx_pn,\n+\t\t\t\t\t      target-\u003etx_pn,\n+\t\t\t\t\t      \u0026target-\u003einitiator_ap_flags);\n }\n \n static int iwl_mvm_ftm_start_v11(struct iwl_mvm *mvm,\n@@ -881,11 +900,13 @@ iwl_mvm_ftm_put_target_v10(struct iwl_mvm *mvm, struct ieee80211_vif *vif,\n \tiwl_mvm_ftm_set_target_flags(mvm, peer, \u0026target-\u003einitiator_ap_flags);\n \tiwl_mvm_ftm_set_sta(mvm, vif, peer, \u0026target-\u003esta_id,\n \t\t\t    \u0026target-\u003einitiator_ap_flags);\n-\tiwl_mvm_ftm_set_secured_ranging(mvm, vif, target-\u003ebssid,\n-\t\t\t\t\t\u0026target-\u003ecipher, target-\u003ehltk,\n-\t\t\t\t\ttarget-\u003etk, target-\u003erx_pn,\n-\t\t\t\t\ttarget-\u003etx_pn,\n-\t\t\t\t\t\u0026target-\u003einitiator_ap_flags);\n+\tret = iwl_mvm_ftm_set_secured_ranging(mvm, vif, target-\u003ebssid,\n+\t\t\t\t\t      \u0026target-\u003ecipher, target-\u003ehltk,\n+\t\t\t\t\t      target-\u003etk, target-\u003erx_pn,\n+\t\t\t\t\t      target-\u003etx_pn,\n+\t\t\t\t\t      \u0026target-\u003einitiator_ap_flags);\n+\tif (ret)\n+\t\treturn ret;\n \n \ti2r_max_sts = IWL_MVM_FTM_I2R_MAX_STS \u003e 1 ? 1 :\n \t\tIWL_MVM_FTM_I2R_MAX_STS;\ndiff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c\nindex 6e507d6dcdd2a1..fa523be91d8ad3 100644\n--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c\n+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c\n@@ -964,12 +964,22 @@ int iwl_mvm_get_sar_geo_profile(struct iwl_mvm *mvm)\n \t\treturn ret;\n \t}\n \n+\tif (IWL_FW_CHECK(mvm,\n+\t\t\t iwl_rx_packet_payload_len(cmd.resp_pkt) !=\n+\t\t\t sizeof(*resp),\n+\t\t\t \"Wrong size for iwl_geo_tx_power_profiles_resp: %d\\n\",\n+\t\t\t iwl_rx_packet_payload_len(cmd.resp_pkt))) {\n+\t\tret = -EIO;\n+\t\tgoto out;\n+\t}\n+\n \tresp = (void *)cmd.resp_pkt-\u003edata;\n \tret = le32_to_cpu(resp-\u003eprofile_idx);\n \n \tif (WARN_ON(ret \u003e BIOS_GEO_MAX_PROFILE_NUM))\n \t\tret = -EIO;\n \n+out:\n \tiwl_free_resp(\u0026cmd);\n \treturn ret;\n }\ndiff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ptp.c b/drivers/net/wireless/intel/iwlwifi/mvm/ptp.c\nindex f39eb48864eb4b..49dcb1388007bc 100644\n--- a/drivers/net/wireless/intel/iwlwifi/mvm/ptp.c\n+++ b/drivers/net/wireless/intel/iwlwifi/mvm/ptp.c\n@@ -1,6 +1,6 @@\n // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause\n /*\n- * Copyright (C) 2021 - 2023, 2025 Intel Corporation\n+ * Copyright (C) 2021 - 2023, 2025-2026 Intel Corporation\n  */\n \n #include \"mvm.h\"\n@@ -121,6 +121,8 @@ iwl_mvm_get_crosstimestamp_fw(struct iwl_mvm *mvm, u32 *gp2, u64 *sys_time)\n \t*sys_time = (u64)le32_to_cpu(resp-\u003eplatform_timestamp_hi) \u003c\u003c 32 |\n \t\tle32_to_cpu(resp-\u003eplatform_timestamp_lo);\n \n+\tiwl_free_resp(\u0026cmd);\n+\n \treturn ret;\n }\n \ndiff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c\nindex dc69c71faa76ca..d3c2fe8304777b 100644\n--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c\n+++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c\n@@ -1544,6 +1544,17 @@ static inline u32 iwl_mvm_get_scd_ssn(struct iwl_mvm *mvm,\n \treturn val \u0026 0xFFF;\n }\n \n+static inline size_t iwl_mvm_tx_resp_min_len(struct iwl_mvm *mvm,\n+\t\t\t\t\t     struct iwl_tx_resp *tx_resp)\n+{\n+\tstruct agg_tx_status *agg_status =\n+\t\tiwl_mvm_get_agg_status(mvm, tx_resp);\n+\n+\t/* The aggregate response ends with a trailing SCD SSN __le32 word. */\n+\treturn (u8 *)(agg_status + tx_resp-\u003eframe_count) - (u8 *)tx_resp +\n+\t\tsizeof(__le32);\n+}\n+\n static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,\n \t\t\t\t     struct iwl_rx_packet *pkt)\n {\n@@ -1847,6 +1858,9 @@ static void iwl_mvm_rx_tx_cmd_agg(struct iwl_mvm *mvm,\n \tint queue = SEQ_TO_QUEUE(sequence);\n \tstruct ieee80211_sta *sta;\n \n+\tif (WARN_ON_ONCE(iwl_mvm_has_new_tx_api(mvm)))\n+\t\treturn;\n+\n \tif (WARN_ON_ONCE(queue \u003c IWL_MVM_DQA_MIN_DATA_QUEUE \u0026\u0026\n \t\t\t (queue != IWL_MVM_DQA_BSS_CLIENT_QUEUE)))\n \t\treturn;\n@@ -1881,6 +1895,26 @@ void iwl_mvm_rx_tx_cmd(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb)\n {\n \tstruct iwl_rx_packet *pkt = rxb_addr(rxb);\n \tstruct iwl_tx_resp *tx_resp = (void *)pkt-\u003edata;\n+\tsize_t min_len;\n+\n+\tif (IWL_FW_CHECK(mvm, !tx_resp-\u003eframe_count,\n+\t\t\t \"invalid TX_CMD frame_count %u\\n\",\n+\t\t\t tx_resp-\u003eframe_count))\n+\t\treturn;\n+\n+\tif (IWL_FW_CHECK(mvm,\n+\t\t\t iwl_mvm_has_new_tx_api(mvm) \u0026\u0026\n+\t\t\t tx_resp-\u003eframe_count != 1,\n+\t\t\t \"invalid TX_CMD frame_count %u for new TX API\\n\",\n+\t\t\t tx_resp-\u003eframe_count))\n+\t\treturn;\n+\n+\tmin_len = iwl_mvm_tx_resp_min_len(mvm, tx_resp);\n+\tif (IWL_FW_CHECK(mvm, iwl_rx_packet_payload_len(pkt) \u003c min_len,\n+\t\t\t \"invalid TX_CMD len %u (frame_count %u, min %zu)\\n\",\n+\t\t\t iwl_rx_packet_payload_len(pkt), tx_resp-\u003eframe_count,\n+\t\t\t min_len))\n+\t\treturn;\n \n \tif (tx_resp-\u003eframe_count == 1)\n \t\tiwl_mvm_rx_tx_cmd_single(mvm, pkt);\n@@ -2100,8 +2134,14 @@ void iwl_mvm_rx_ba_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb)\n \t\t\tif (tid == IWL_MGMT_TID)\n \t\t\t\ttid = IWL_MAX_TID_COUNT;\n \n+\t\t\tif (IWL_FW_CHECK(mvm, tid \u003e=\n+\t\t\t\t\t ARRAY_SIZE(mvmsta-\u003etid_data),\n+\t\t\t\t\t \"invalid TID %d in compressed BA\\n\",\n+\t\t\t\t\t tid))\n+\t\t\t\tcontinue;\n+\n \t\t\tif (mvmsta)\n-\t\t\t\tmvmsta-\u003etid_data[i].lq_color = lq_color;\n+\t\t\t\tmvmsta-\u003etid_data[tid].lq_color = lq_color;\n \n \t\t\tiwl_mvm_tx_reclaim(mvm, sta_id, tid,\n \t\t\t\t\t   (int)(le16_to_cpu(ba_tfd-\u003eq_num)),\n@@ -2121,6 +2161,9 @@ void iwl_mvm_rx_ba_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb)\n \tba_notif = (void *)pkt-\u003edata;\n \tsta_id = ba_notif-\u003esta_id;\n \ttid = ba_notif-\u003etid;\n+\tif (IWL_FW_CHECK(mvm, tid \u003e= ARRAY_SIZE(mvmsta-\u003etid_data),\n+\t\t\t \"invalid TID %d in BA notif\\n\", tid))\n+\t\treturn;\n \t/* \"flow\" corresponds to Tx queue */\n \ttxq = le16_to_cpu(ba_notif-\u003escd_flow);\n \t/* \"ssn\" is start of block-ack Tx window, corresponds to index\ndiff --git a/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info.c b/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info.c\nindex d5eb895144efc9..7f886200d69333 100644\n--- a/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info.c\n+++ b/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info.c\n@@ -1,7 +1,7 @@\n // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause\n /*\n  * Copyright (C) 2017 Intel Deutschland GmbH\n- * Copyright (C) 2018-2025 Intel Corporation\n+ * Copyright (C) 2018-2026 Intel Corporation\n  */\n #include \"iwl-trans.h\"\n #include \"iwl-fh.h\"\n@@ -99,6 +99,11 @@ int iwl_pcie_init_fw_sec(struct iwl_trans *trans,\n \t/* add 2 due to separators */\n \tpaging_cnt = iwl_pcie_get_num_sections(fw, lmac_cnt + umac_cnt + 2);\n \n+\tif (WARN_ON(lmac_cnt \u003e ARRAY_SIZE(ctxt_dram-\u003elmac_img) ||\n+\t\t    umac_cnt \u003e ARRAY_SIZE(ctxt_dram-\u003eumac_img) ||\n+\t\t    paging_cnt \u003e ARRAY_SIZE(ctxt_dram-\u003evirtual_img)))\n+\t\treturn -EINVAL;\n+\n \tdram-\u003efw = kzalloc_objs(*dram-\u003efw, umac_cnt + lmac_cnt);\n \tif (!dram-\u003efw)\n \t\treturn -ENOMEM;\n"
}

gemini-3.1-pro-preview

null

{
  "EnableConfigs": [
    "IWLWIFI",
    "IWLMVM",
    "IWLMLD"
  ],
  "FocusSymbols": [
    "iwl_pnvm_complete_fn",
    "iwl_parse_shared_mem_22000",
    "iwl_parse_shared_mem",
    "iwl_get_nvm",
    "iwl_mvm_report_wakeup_reasons",
    "iwl_mvm_wowlan_store_wake_pkt",
    "iwl_mvm_nd_match_info_handler",
    "iwl_mvm_ftm_set_secured_ranging",
    "iwl_mvm_get_sar_geo_profile",
    "iwl_mvm_get_crosstimestamp_fw",
    "iwl_pcie_init_fw_sec"
  ],
  "Reasoning": "The patch makes functional changes to the iwlwifi driver, including adding support for UNII-9 channels, adding bounds checks for firmware notifications and responses, fixing memory leaks, and modifying NVM parsing logic. These changes affect the core logic of the driver and are worth fuzzing.",
  "WorthFuzzing": true
}

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Do not list too generic configs (we already have them enabled). Only list those that
   specifically cover the modified code. List them in the EnableConfigs output array,
   and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit e34c9e58d2b24d57fb93131dde76f2a640604858
Author: syz-cluster <triage@syzkaller.com>
Date:   Thu Jul 16 02:19:45 2026 +0000

    syz-cluster: applied patch under review

diff --git a/drivers/net/wireless/intel/iwlwifi/cfg/rf-pe.c b/drivers/net/wireless/intel/iwlwifi/cfg/rf-pe.c
index 7a04cb120b1b23..6080f5f23e6987 100644
--- a/drivers/net/wireless/intel/iwlwifi/cfg/rf-pe.c
+++ b/drivers/net/wireless/intel/iwlwifi/cfg/rf-pe.c
@@ -15,6 +15,7 @@
 	.non_shared_ant = ANT_B,					\
 	.vht_mu_mimo_supported = true,					\
 	.uhb_supported = true,						\
+	.unii9_supported = true,					\
 	.eht_supported = true,						\
 	.uhr_supported = true,						\
 	.num_rbds = IWL_NUM_RBDS_EHT,					\
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/api/nvm-reg.h b/drivers/net/wireless/intel/iwlwifi/fw/api/nvm-reg.h
index 443a9a41632523..0172c0747a47c9 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/api/nvm-reg.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/api/nvm-reg.h
@@ -205,6 +205,7 @@ struct iwl_nvm_get_info_phy {
 
 #define IWL_NUM_CHANNELS_V1	51
 #define IWL_NUM_CHANNELS_V2	110
+#define IWL_NUM_CHANNELS_V3	115
 
 /**
  * struct iwl_nvm_get_info_regulatory_v1 - regulatory information
@@ -219,12 +220,12 @@ struct iwl_nvm_get_info_regulatory_v1 {
 } __packed; /* REGULATORY_NVM_GET_INFO_REGULATORY_S_VER_1 */
 
 /**
- * struct iwl_nvm_get_info_regulatory - regulatory information
+ * struct iwl_nvm_get_info_regulatory_v2 - regulatory information
  * @lar_enabled: is LAR enabled
  * @n_channels: number of valid channels in the array
  * @channel_profile: regulatory data of this channel
  */
-struct iwl_nvm_get_info_regulatory {
+struct iwl_nvm_get_info_regulatory_v2 {
 	__le32 lar_enabled;
 	__le32 n_channels;
 	__le32 channel_profile[IWL_NUM_CHANNELS_V2];
@@ -244,6 +245,32 @@ struct iwl_nvm_get_info_rsp_v3 {
 	struct iwl_nvm_get_info_regulatory_v1 regulatory;
 } __packed; /* REGULATORY_NVM_GET_INFO_RSP_API_S_VER_3 */
 
+/**
+ * struct iwl_nvm_get_info_rsp_v4 - response to get NVM data
+ * @general: general NVM data
+ * @mac_sku: data relating to MAC sku
+ * @phy_sku: data relating to PHY sku
+ * @regulatory: regulatory data
+ */
+struct iwl_nvm_get_info_rsp_v4 {
+	struct iwl_nvm_get_info_general general;
+	struct iwl_nvm_get_info_sku mac_sku;
+	struct iwl_nvm_get_info_phy phy_sku;
+	struct iwl_nvm_get_info_regulatory_v2 regulatory;
+} __packed; /* REGULATORY_NVM_GET_INFO_RSP_API_S_VER_4 */
+
+/**
+ * struct iwl_nvm_get_info_regulatory - regulatory information
+ * @lar_enabled: is LAR enabled
+ * @n_channels: number of valid channels in the array
+ * @channel_profile: regulatory data of this channel
+ */
+struct iwl_nvm_get_info_regulatory {
+	__le32 lar_enabled;
+	__le32 n_channels;
+	__le32 channel_profile[IWL_NUM_CHANNELS_V3];
+} __packed; /* REGULATORY_NVM_GET_INFO_REGULATORY_S_VER_3 */
+
 /**
  * struct iwl_nvm_get_info_rsp - response to get NVM data
  * @general: general NVM data
@@ -256,7 +283,7 @@ struct iwl_nvm_get_info_rsp {
 	struct iwl_nvm_get_info_sku mac_sku;
 	struct iwl_nvm_get_info_phy phy_sku;
 	struct iwl_nvm_get_info_regulatory regulatory;
-} __packed; /* REGULATORY_NVM_GET_INFO_RSP_API_S_VER_4 */
+} __packed; /* REGULATORY_NVM_GET_INFO_RSP_API_S_VER_5 */
 
 /**
  * struct iwl_nvm_access_complete_cmd - NVM_ACCESS commands are completed
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/api/scan.h b/drivers/net/wireless/intel/iwlwifi/fw/api/scan.h
index 08f4cc3ea1c304..ee78371082b094 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/api/scan.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/api/scan.h
@@ -1,6 +1,6 @@
 /* SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause */
 /*
- * Copyright (C) 2012-2014, 2018-2025 Intel Corporation
+ * Copyright (C) 2012-2014, 2018-2026 Intel Corporation
  * Copyright (C) 2013-2015 Intel Mobile Communications GmbH
  * Copyright (C) 2016-2017 Intel Deutschland GmbH
  */
@@ -1319,7 +1319,7 @@ struct iwl_scan_offload_match_info {
 	u8 resume_while_scanning;
 	u8 self_recovery;
 	__le16 reserved;
-	struct iwl_scan_offload_profile_match matches[];
+	struct iwl_scan_offload_profile_match matches[IWL_SCAN_MAX_PROFILES_V2];
 } __packed; /* SCAN_OFFLOAD_PROFILES_QUERY_RSP_S_VER_3 and
 	     * SCAN_OFFLOAD_MATCH_INFO_NOTIFICATION_S_VER_1
 	     */
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c b/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c
index afff8d51ca950c..ec0ff58ab312d5 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c
+++ b/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
 /*
- * Copyright(c) 2020-2025 Intel Corporation
+ * Copyright(c) 2020-2026 Intel Corporation
  */
 
 #include "iwl-drv.h"
@@ -12,6 +12,7 @@
 #include "fw/api/alive.h"
 #include "fw/uefi.h"
 #include "fw/img.h"
+#include "fw/dbg.h"
 
 #define IWL_PNVM_REDUCED_CAP_BIT BIT(25)
 
@@ -26,6 +27,12 @@ static bool iwl_pnvm_complete_fn(struct iwl_notif_wait_data *notif_wait,
 	struct iwl_trans *trans = (struct iwl_trans *)data;
 	struct iwl_pnvm_init_complete_ntfy *pnvm_ntf = (void *)pkt->data;
 
+	if (IWL_FW_CHECK(trans,
+			 iwl_rx_packet_payload_len(pkt) < sizeof(*pnvm_ntf),
+			 "Bad notif len: %d\n",
+			 iwl_rx_packet_payload_len(pkt)))
+		return true;
+
 	IWL_DEBUG_FW(trans,
 		     "PNVM complete notification received with status 0x%0x\n",
 		     le32_to_cpu(pnvm_ntf->status));
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/regulatory.c b/drivers/net/wireless/intel/iwlwifi/fw/regulatory.c
index 8d9ff36e30f5e3..1d6d38ee55b499 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/regulatory.c
+++ b/drivers/net/wireless/intel/iwlwifi/fw/regulatory.c
@@ -389,7 +389,7 @@ bool iwl_add_mcc_to_tas_block_list(u16 *list, u8 *size, u16 mcc)
 	if (*size >= IWL_WTAS_BLACK_LIST_MAX)
 		return false;
 
-	list[*size++] = mcc;
+	list[(*size)++] = mcc;
 	return true;
 }
 IWL_EXPORT_SYMBOL(iwl_add_mcc_to_tas_block_list);
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/smem.c b/drivers/net/wireless/intel/iwlwifi/fw/smem.c
index 344ddde85b1897..20ed26a1bb00ec 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/smem.c
+++ b/drivers/net/wireless/intel/iwlwifi/fw/smem.c
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
 /*
- * Copyright (C) 2012-2014, 2018-2021, 2025 Intel Corporation
+ * Copyright (C) 2012-2014, 2018-2021, 2025-2026 Intel Corporation
  * Copyright (C) 2013-2015 Intel Mobile Communications GmbH
  * Copyright (C) 2016-2017 Intel Deutschland GmbH
  */
@@ -14,9 +14,17 @@ static void iwl_parse_shared_mem_22000(struct iwl_fw_runtime *fwrt,
 {
 	struct iwl_shared_mem_cfg *mem_cfg = (void *)pkt->data;
 	int i, lmac;
-	int lmac_num = le32_to_cpu(mem_cfg->lmac_num);
-	u8 api_ver = iwl_fw_lookup_notif_ver(fwrt->fw, SYSTEM_GROUP,
-					     SHARED_MEM_CFG_CMD, 0);
+	int lmac_num;
+	u8 api_ver;
+
+	if (IWL_FW_CHECK(fwrt, iwl_rx_packet_payload_len(pkt) <
+			 offsetofend(struct iwl_shared_mem_cfg, lmac_smem[1]),
+			 "bad shared mem notification size\n"))
+		return;
+
+	lmac_num = le32_to_cpu(mem_cfg->lmac_num);
+	api_ver = iwl_fw_lookup_notif_ver(fwrt->fw, SYSTEM_GROUP,
+					  SHARED_MEM_CFG_CMD, 0);
 
 	/* Note: notification has 3 entries, but we only expect 2 */
 	if (IWL_FW_CHECK(fwrt, lmac_num > ARRAY_SIZE(fwrt->smem_cfg.lmac),
@@ -30,7 +38,7 @@ static void iwl_parse_shared_mem_22000(struct iwl_fw_runtime *fwrt,
 
 	if (api_ver >= 4 &&
 	    !IWL_FW_CHECK(fwrt, iwl_rx_packet_payload_len(pkt) < sizeof(*mem_cfg),
-			  "bad shared mem notification size\n")) {
+			  "bad shared mem notification size (v4)\n")) {
 		fwrt->smem_cfg.rxfifo2_control_size =
 			le32_to_cpu(mem_cfg->rxfifo2_control_size);
 	}
@@ -53,6 +61,11 @@ static void iwl_parse_shared_mem(struct iwl_fw_runtime *fwrt,
 	struct iwl_shared_mem_cfg_v2 *mem_cfg = (void *)pkt->data;
 	int i;
 
+	if (IWL_FW_CHECK(fwrt, iwl_rx_packet_payload_len(pkt) <
+			 offsetof(struct iwl_shared_mem_cfg_v2, rxfifo_addr),
+			 "bad shared mem notification size\n"))
+		return;
+
 	fwrt->smem_cfg.num_lmacs = 1;
 
 	fwrt->smem_cfg.num_txfifo_entries = ARRAY_SIZE(mem_cfg->txfifo_size);
@@ -67,6 +80,11 @@ static void iwl_parse_shared_mem(struct iwl_fw_runtime *fwrt,
 	/* new API has more data, from rxfifo_addr field and on */
 	if (fw_has_capa(&fwrt->fw->ucode_capa,
 			IWL_UCODE_TLV_CAPA_EXTEND_SHARED_MEM_CFG)) {
+		if (IWL_FW_CHECK(fwrt, iwl_rx_packet_payload_len(pkt) <
+				 sizeof(*mem_cfg),
+				 "bad shared mem notification size (extend)\n"))
+			return;
+
 		BUILD_BUG_ON(sizeof(fwrt->smem_cfg.internal_txfifo_size) !=
 			     sizeof(mem_cfg->internal_txfifo_size));
 
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-config.h b/drivers/net/wireless/intel/iwlwifi/iwl-config.h
index 6a3539ad73317e..3ac7f000ede478 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-config.h
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-config.h
@@ -415,6 +415,7 @@ struct iwl_mac_cfg {
  * @vht_mu_mimo_supported: VHT MU-MIMO support
  * @nvm_type: see &enum iwl_nvm_type
  * @uhb_supported: ultra high band channels supported
+ * @unii9_supported: UNII-9 channels supported
  * @eht_supported: EHT supported
  * @uhr_supported: UHR supported
  * @num_rbds: number of receive buffer descriptors to use
@@ -450,6 +451,7 @@ struct iwl_rf_cfg {
 	    lp_xtal_workaround:1,
 	    vht_mu_mimo_supported:1,
 	    uhb_supported:1,
+	    unii9_supported:1,
 	    eht_supported:1,
 	    uhr_supported:1;
 	u8 valid_tx_ant;
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
index d47b4ae2f48630..bd5353fdde81a4 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
@@ -85,16 +85,7 @@ static const u16 iwl_nvm_channels[] = {
 	149, 153, 157, 161, 165
 };
 
-static const u16 iwl_ext_nvm_channels[] = {
-	/* 2.4 GHz */
-	1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14,
-	/* 5 GHz */
-	36, 40, 44, 48, 52, 56, 60, 64, 68, 72, 76, 80, 84, 88, 92,
-	96, 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140, 144,
-	149, 153, 157, 161, 165, 169, 173, 177, 181
-};
-
-static const u16 iwl_uhb_nvm_channels[] = {
+static const u16 iwl_unii9_nvm_channels[] = {
 	/* 2.4 GHz */
 	1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14,
 	/* 5 GHz */
@@ -105,12 +96,16 @@ static const u16 iwl_uhb_nvm_channels[] = {
 	1, 5, 9, 13, 17, 21, 25, 29, 33, 37, 41, 45, 49, 53, 57, 61, 65, 69,
 	73, 77, 81, 85, 89, 93, 97, 101, 105, 109, 113, 117, 121, 125, 129,
 	133, 137, 141, 145, 149, 153, 157, 161, 165, 169, 173, 177, 181, 185,
-	189, 193, 197, 201, 205, 209, 213, 217, 221, 225, 229, 233
+	189, 193, 197, 201, 205, 209, 213, 217, 221, 225, 229, 233,
+
+	/* UNII-9 */
+	237, 241, 245, 249, 253
 };
 
 #define IWL_NVM_NUM_CHANNELS		ARRAY_SIZE(iwl_nvm_channels)
-#define IWL_NVM_NUM_CHANNELS_EXT	ARRAY_SIZE(iwl_ext_nvm_channels)
-#define IWL_NVM_NUM_CHANNELS_UHB	ARRAY_SIZE(iwl_uhb_nvm_channels)
+#define IWL_NVM_NUM_CHANNELS_EXT	51
+#define IWL_NVM_NUM_CHANNELS_UHB	110
+#define IWL_NVM_NUM_CHANNELS_UNII9	ARRAY_SIZE(iwl_unii9_nvm_channels)
 #define NUM_2GHZ_CHANNELS		14
 #define NUM_5GHZ_CHANNELS		37
 #define FIRST_2GHZ_HT_MINUS		5
@@ -351,12 +346,15 @@ static int iwl_init_channel_map(struct iwl_trans *trans,
 	int num_of_ch;
 	const u16 *nvm_chan;
 
-	if (cfg->uhb_supported) {
+	if (cfg->unii9_supported) {
+		num_of_ch = IWL_NVM_NUM_CHANNELS_UNII9;
+		nvm_chan = iwl_unii9_nvm_channels;
+	} else if (cfg->uhb_supported) {
 		num_of_ch = IWL_NVM_NUM_CHANNELS_UHB;
-		nvm_chan = iwl_uhb_nvm_channels;
+		nvm_chan = iwl_unii9_nvm_channels;
 	} else if (cfg->nvm_type == IWL_NVM_EXT) {
 		num_of_ch = IWL_NVM_NUM_CHANNELS_EXT;
-		nvm_chan = iwl_ext_nvm_channels;
+		nvm_chan = iwl_unii9_nvm_channels;
 	} else {
 		num_of_ch = IWL_NVM_NUM_CHANNELS;
 		nvm_chan = iwl_nvm_channels;
@@ -1441,7 +1439,9 @@ iwl_parse_mei_nvm_data(struct iwl_trans *trans, const struct iwl_rf_cfg *cfg,
 	u8 rx_chains = fw->valid_rx_ant;
 	u8 tx_chains = fw->valid_rx_ant;
 
-	if (cfg->uhb_supported)
+	if (cfg->unii9_supported)
+		data = kzalloc_flex(*data, channels, IWL_NVM_NUM_CHANNELS_UNII9);
+	else if (cfg->uhb_supported)
 		data = kzalloc_flex(*data, channels, IWL_NVM_NUM_CHANNELS_UHB);
 	else
 		data = kzalloc_flex(*data, channels, IWL_NVM_NUM_CHANNELS_EXT);
@@ -1506,7 +1506,9 @@ iwl_parse_nvm_data(struct iwl_trans *trans, const struct iwl_rf_cfg *cfg,
 	u16 lar_config;
 	const __le16 *ch_section;
 
-	if (cfg->uhb_supported)
+	if (cfg->unii9_supported)
+		data = kzalloc_flex(*data, channels, IWL_NVM_NUM_CHANNELS_UNII9);
+	else if (cfg->uhb_supported)
 		data = kzalloc_flex(*data, channels, IWL_NVM_NUM_CHANNELS_UHB);
 	else if (cfg->nvm_type != IWL_NVM_EXT)
 		data = kzalloc_flex(*data, channels, IWL_NVM_NUM_CHANNELS);
@@ -1727,12 +1729,15 @@ iwl_parse_nvm_mcc_info(struct iwl_trans *trans,
 	int max_num_ch;
 	struct iwl_reg_capa reg_capa;
 
-	if (cfg->uhb_supported) {
+	if (cfg->unii9_supported) {
+		max_num_ch = IWL_NVM_NUM_CHANNELS_UNII9;
+		nvm_chan = iwl_unii9_nvm_channels;
+	} else if (cfg->uhb_supported) {
 		max_num_ch = IWL_NVM_NUM_CHANNELS_UHB;
-		nvm_chan = iwl_uhb_nvm_channels;
+		nvm_chan = iwl_unii9_nvm_channels;
 	} else if (cfg->nvm_type == IWL_NVM_EXT) {
 		max_num_ch = IWL_NVM_NUM_CHANNELS_EXT;
-		nvm_chan = iwl_ext_nvm_channels;
+		nvm_chan = iwl_unii9_nvm_channels;
 	} else {
 		max_num_ch = IWL_NVM_NUM_CHANNELS;
 		nvm_chan = iwl_nvm_channels;
@@ -2087,13 +2092,26 @@ struct iwl_nvm_data *iwl_get_nvm(struct iwl_trans *trans,
 	struct iwl_nvm_get_info_rsp_v3 *rsp_v3;
 	bool v4 = fw_has_api(&fw->ucode_capa,
 			     IWL_UCODE_TLV_API_REGULATORY_NVM_INFO);
-	size_t rsp_size = v4 ? sizeof(*rsp) : sizeof(*rsp_v3);
+	size_t rsp_size;
 	void *channel_profile;
 
 	ret = iwl_trans_send_cmd(trans, &hcmd);
 	if (ret)
 		return ERR_PTR(ret);
 
+	switch (iwl_fw_lookup_notif_ver(fw, REGULATORY_AND_NVM_GROUP,
+					NVM_GET_INFO, 0)) {
+	case 5:
+		rsp_size = sizeof(struct iwl_nvm_get_info_rsp);
+		break;
+	case 4:
+		rsp_size = sizeof(struct iwl_nvm_get_info_rsp_v4);
+		break;
+	default:
+		rsp_size = sizeof(struct iwl_nvm_get_info_rsp_v3);
+		break;
+	}
+
 	if (WARN(iwl_rx_packet_payload_len(hcmd.resp_pkt) != rsp_size,
 		 "Invalid payload len in NVM response from FW %d",
 		 iwl_rx_packet_payload_len(hcmd.resp_pkt))) {
@@ -2107,7 +2125,7 @@ struct iwl_nvm_data *iwl_get_nvm(struct iwl_trans *trans,
 	if (empty_otp)
 		IWL_INFO(trans, "OTP is empty\n");
 
-	nvm = kzalloc_flex(*nvm, channels, IWL_NUM_CHANNELS_V2);
+	nvm = kzalloc_flex(*nvm, channels, IWL_NUM_CHANNELS_V3);
 	if (!nvm) {
 		ret = -ENOMEM;
 		goto out;
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/tx.c b/drivers/net/wireless/intel/iwlwifi/mld/tx.c
index 2185dade95f8cb..2df6643a5aa80f 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/tx.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/tx.c
@@ -1120,6 +1120,10 @@ void iwl_mld_handle_tx_resp_notif(struct iwl_mld *mld,
 	ssn = le32_to_cpup((__le32 *)agg_status +
 			   tx_resp->frame_count) & 0xFFFF;
 
+	if (IWL_FW_CHECK(mld, txq_id >= ARRAY_SIZE(mld->fw_id_to_txq),
+			 "Invalid txq id %d\n", txq_id))
+		return;
+
 	__skb_queue_head_init(&skbs);
 
 	/* we can free until ssn % q.n_bd not inclusive */
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
index 3429d9a10e4209..6b11fa32ea5c6b 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
@@ -1509,6 +1509,10 @@ static void iwl_mvm_report_wakeup_reasons(struct iwl_mvm *mvm,
 		if (WARN_ON_ONCE(truncated < 0))
 			truncated = 0;
 
+		/* this would be a firmware bug */
+		if (WARN_ON_ONCE(pktsize < sizeof(*hdr)))
+			return;
+
 		if (ieee80211_is_data(hdr->frame_control)) {
 			int hdrlen = ieee80211_hdrlen(hdr->frame_control);
 			int ivlen = 0, icvlen = 4; /* also FCS */
@@ -1517,10 +1521,6 @@ static void iwl_mvm_report_wakeup_reasons(struct iwl_mvm *mvm,
 			if (!pkt)
 				goto report;
 
-			skb_put_data(pkt, pktdata, hdrlen);
-			pktdata += hdrlen;
-			pktsize -= hdrlen;
-
 			if (ieee80211_has_protected(hdr->frame_control)) {
 				/*
 				 * This is unlocked and using gtk_i(c)vlen,
@@ -1546,6 +1546,17 @@ static void iwl_mvm_report_wakeup_reasons(struct iwl_mvm *mvm,
 				truncated = 0;
 			}
 
+			if (IWL_FW_CHECK(mvm,
+					 pktsize <= hdrlen + ivlen + icvlen,
+					 "pktsize is too small %d\n",
+					 pktsize)) {
+				kfree_skb(pkt);
+				return;
+			}
+
+			skb_put_data(pkt, pktdata, hdrlen);
+			pktdata += hdrlen;
+			pktsize -= hdrlen;
 			pktsize -= ivlen + icvlen;
 			pktdata += ivlen;
 
@@ -2448,13 +2459,15 @@ iwl_mvm_netdetect_query_results(struct iwl_mvm *mvm,
 
 	if (fw_has_api(&mvm->fw->ucode_capa,
 		       IWL_UCODE_TLV_API_SCAN_OFFLOAD_CHANS)) {
-		query_len = sizeof(struct iwl_scan_offload_match_info);
 		matches_len = sizeof(struct iwl_scan_offload_profile_match) *
 			max_profiles;
+		query_len = offsetof(struct iwl_scan_offload_match_info,
+				     matches) + matches_len;
 	} else {
-		query_len = sizeof(struct iwl_scan_offload_profiles_query_v1);
 		matches_len = sizeof(struct iwl_scan_offload_profile_match_v1) *
 			max_profiles;
+		query_len = sizeof(struct iwl_scan_offload_profiles_query_v1) +
+			matches_len;
 	}
 
 	len = iwl_rx_packet_payload_len(cmd.resp_pkt);
@@ -2756,7 +2769,7 @@ static int iwl_mvm_wowlan_store_wake_pkt(struct iwl_mvm *mvm,
 					 struct iwl_wowlan_status_data *status,
 					 u32 len)
 {
-	u32 data_size, packet_len = le32_to_cpu(notif->wake_packet_length);
+	u32 data_size, packet_len;
 
 	if (len < sizeof(*notif)) {
 		IWL_ERR(mvm, "Invalid WoWLAN wake packet notification!\n");
@@ -2775,6 +2788,7 @@ static int iwl_mvm_wowlan_store_wake_pkt(struct iwl_mvm *mvm,
 		return -EIO;
 	}
 
+	packet_len = le32_to_cpu(notif->wake_packet_length);
 	data_size = len - offsetof(struct iwl_wowlan_wake_pkt_notif, wake_packet);
 
 	/* data_size got the padding from the notification, remove it. */
@@ -2807,7 +2821,8 @@ static void iwl_mvm_nd_match_info_handler(struct iwl_mvm *mvm,
 	if (IS_ERR_OR_NULL(vif))
 		return;
 
-	if (len < sizeof(struct iwl_scan_offload_match_info) + matches_len) {
+	if (len < offsetof(struct iwl_scan_offload_match_info, matches) +
+		    matches_len) {
 		IWL_ERR(mvm, "Invalid scan match info notification\n");
 		return;
 	}
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ftm-initiator.c b/drivers/net/wireless/intel/iwlwifi/mvm/ftm-initiator.c
index 3a14ca5e512ae3..8d7f60dcd0270e 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/ftm-initiator.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/ftm-initiator.c
@@ -646,7 +646,8 @@ static void iter(struct ieee80211_hw *hw,
 	WARN_ON(*target->cipher == IWL_LOCATION_CIPHER_INVALID);
 }
 
-static void
+/* The tk buffer is assumed to be exactly TK_11AZ_LEN bytes */
+static int
 iwl_mvm_ftm_set_secured_ranging(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
 				u8 *bssid, u8 *cipher, u8 *hltk, u8 *tk,
 				u8 *rx_pn, u8 *tx_pn, __le32 *flags)
@@ -656,12 +657,12 @@ iwl_mvm_ftm_set_secured_ranging(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
 	struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
 
 	if (mvmvif->ftm_unprotected)
-		return;
+		return 0;
 #endif
 
 	if (!(le32_to_cpu(*flags) & (IWL_INITIATOR_AP_FLAGS_NON_TB |
 		       IWL_INITIATOR_AP_FLAGS_TB)))
-		return;
+		return 0;
 
 	lockdep_assert_held(&mvm->mutex);
 
@@ -679,14 +680,31 @@ iwl_mvm_ftm_set_secured_ranging(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
 		if (vif->cfg.assoc &&
 		    !memcmp(vif->bss_conf.bssid, bssid, ETH_ALEN)) {
 			struct iwl_mvm_ftm_iter_data target;
+			u32 key_len;
 
 			target.bssid = bssid;
 			target.cipher = cipher;
 			target.tk = NULL;
 			ieee80211_iter_keys(mvm->hw, vif, iter, &target);
 
-			if (!WARN_ON(!target.tk))
-				memcpy(tk, target.tk, TK_11AZ_LEN);
+			if (WARN_ON(!target.tk))
+				return -EINVAL;
+
+			switch (*target.cipher) {
+			case IWL_LOCATION_CIPHER_CCMP_128:
+			case IWL_LOCATION_CIPHER_GCMP_128:
+				key_len = WLAN_KEY_LEN_CCMP;
+				break;
+			case IWL_LOCATION_CIPHER_GCMP_256:
+				key_len = WLAN_KEY_LEN_GCMP_256;
+				break;
+			default:
+				WARN_ON(1);
+				return -EINVAL;
+			}
+
+			memset(tk, 0, TK_11AZ_LEN);
+			memcpy(tk, target.tk, key_len);
 		} else {
 			memcpy(tk, entry->tk, sizeof(entry->tk));
 		}
@@ -695,8 +713,10 @@ iwl_mvm_ftm_set_secured_ranging(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
 		memcpy(tx_pn, entry->tx_pn, sizeof(entry->tx_pn));
 
 		FTM_SET_FLAG(SECURED);
-		return;
+		return 0;
 	}
+
+	return 0;
 }
 
 static int
@@ -708,12 +728,11 @@ iwl_mvm_ftm_put_target_v7(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
 	if (err)
 		return err;
 
-	iwl_mvm_ftm_set_secured_ranging(mvm, vif, target->bssid,
-					&target->cipher, target->hltk,
-					target->tk, target->rx_pn,
-					target->tx_pn,
-					&target->initiator_ap_flags);
-	return err;
+	return iwl_mvm_ftm_set_secured_ranging(mvm, vif, target->bssid,
+					      &target->cipher, target->hltk,
+					      target->tk, target->rx_pn,
+					      target->tx_pn,
+					      &target->initiator_ap_flags);
 }
 
 static int iwl_mvm_ftm_start_v11(struct iwl_mvm *mvm,
@@ -881,11 +900,13 @@ iwl_mvm_ftm_put_target_v10(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
 	iwl_mvm_ftm_set_target_flags(mvm, peer, &target->initiator_ap_flags);
 	iwl_mvm_ftm_set_sta(mvm, vif, peer, &target->sta_id,
 			    &target->initiator_ap_flags);
-	iwl_mvm_ftm_set_secured_ranging(mvm, vif, target->bssid,
-					&target->cipher, target->hltk,
-					target->tk, target->rx_pn,
-					target->tx_pn,
-					&target->initiator_ap_flags);
+	ret = iwl_mvm_ftm_set_secured_ranging(mvm, vif, target->bssid,
+					      &target->cipher, target->hltk,
+					      target->tk, target->rx_pn,
+					      target->tx_pn,
+					      &target->initiator_ap_flags);
+	if (ret)
+		return ret;
 
 	i2r_max_sts = IWL_MVM_FTM_I2R_MAX_STS > 1 ? 1 :
 		IWL_MVM_FTM_I2R_MAX_STS;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
index 6e507d6dcdd2a1..fa523be91d8ad3 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
@@ -964,12 +964,22 @@ int iwl_mvm_get_sar_geo_profile(struct iwl_mvm *mvm)
 		return ret;
 	}
 
+	if (IWL_FW_CHECK(mvm,
+			 iwl_rx_packet_payload_len(cmd.resp_pkt) !=
+			 sizeof(*resp),
+			 "Wrong size for iwl_geo_tx_power_profiles_resp: %d\n",
+			 iwl_rx_packet_payload_len(cmd.resp_pkt))) {
+		ret = -EIO;
+		goto out;
+	}
+
 	resp = (void *)cmd.resp_pkt->data;
 	ret = le32_to_cpu(resp->profile_idx);
 
 	if (WARN_ON(ret > BIOS_GEO_MAX_PROFILE_NUM))
 		ret = -EIO;
 
+out:
 	iwl_free_resp(&cmd);
 	return ret;
 }
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ptp.c b/drivers/net/wireless/intel/iwlwifi/mvm/ptp.c
index f39eb48864eb4b..49dcb1388007bc 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/ptp.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/ptp.c
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
 /*
- * Copyright (C) 2021 - 2023, 2025 Intel Corporation
+ * Copyright (C) 2021 - 2023, 2025-2026 Intel Corporation
  */
 
 #include "mvm.h"
@@ -121,6 +121,8 @@ iwl_mvm_get_crosstimestamp_fw(struct iwl_mvm *mvm, u32 *gp2, u64 *sys_time)
 	*sys_time = (u64)le32_to_cpu(resp->platform_timestamp_hi) << 32 |
 		le32_to_cpu(resp->platform_timestamp_lo);
 
+	iwl_free_resp(&cmd);
+
 	return ret;
 }
 
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
index dc69c71faa76ca..d3c2fe8304777b 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
@@ -1544,6 +1544,17 @@ static inline u32 iwl_mvm_get_scd_ssn(struct iwl_mvm *mvm,
 	return val & 0xFFF;
 }
 
+static inline size_t iwl_mvm_tx_resp_min_len(struct iwl_mvm *mvm,
+					     struct iwl_tx_resp *tx_resp)
+{
+	struct agg_tx_status *agg_status =
+		iwl_mvm_get_agg_status(mvm, tx_resp);
+
+	/* The aggregate response ends with a trailing SCD SSN __le32 word. */
+	return (u8 *)(agg_status + tx_resp->frame_count) - (u8 *)tx_resp +
+		sizeof(__le32);
+}
+
 static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
 				     struct iwl_rx_packet *pkt)
 {
@@ -1847,6 +1858,9 @@ static void iwl_mvm_rx_tx_cmd_agg(struct iwl_mvm *mvm,
 	int queue = SEQ_TO_QUEUE(sequence);
 	struct ieee80211_sta *sta;
 
+	if (WARN_ON_ONCE(iwl_mvm_has_new_tx_api(mvm)))
+		return;
+
 	if (WARN_ON_ONCE(queue < IWL_MVM_DQA_MIN_DATA_QUEUE &&
 			 (queue != IWL_MVM_DQA_BSS_CLIENT_QUEUE)))
 		return;
@@ -1881,6 +1895,26 @@ void iwl_mvm_rx_tx_cmd(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb)
 {
 	struct iwl_rx_packet *pkt = rxb_addr(rxb);
 	struct iwl_tx_resp *tx_resp = (void *)pkt->data;
+	size_t min_len;
+
+	if (IWL_FW_CHECK(mvm, !tx_resp->frame_count,
+			 "invalid TX_CMD frame_count %u\n",
+			 tx_resp->frame_count))
+		return;
+
+	if (IWL_FW_CHECK(mvm,
+			 iwl_mvm_has_new_tx_api(mvm) &&
+			 tx_resp->frame_count != 1,
+			 "invalid TX_CMD frame_count %u for new TX API\n",
+			 tx_resp->frame_count))
+		return;
+
+	min_len = iwl_mvm_tx_resp_min_len(mvm, tx_resp);
+	if (IWL_FW_CHECK(mvm, iwl_rx_packet_payload_len(pkt) < min_len,
+			 "invalid TX_CMD len %u (frame_count %u, min %zu)\n",
+			 iwl_rx_packet_payload_len(pkt), tx_resp->frame_count,
+			 min_len))
+		return;
 
 	if (tx_resp->frame_count == 1)
 		iwl_mvm_rx_tx_cmd_single(mvm, pkt);
@@ -2100,8 +2134,14 @@ void iwl_mvm_rx_ba_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb)
 			if (tid == IWL_MGMT_TID)
 				tid = IWL_MAX_TID_COUNT;
 
+			if (IWL_FW_CHECK(mvm, tid >=
+					 ARRAY_SIZE(mvmsta->tid_data),
+					 "invalid TID %d in compressed BA\n",
+					 tid))
+				continue;
+
 			if (mvmsta)
-				mvmsta->tid_data[i].lq_color = lq_color;
+				mvmsta->tid_data[tid].lq_color = lq_color;
 
 			iwl_mvm_tx_reclaim(mvm, sta_id, tid,
 					   (int)(le16_to_cpu(ba_tfd->q_num)),
@@ -2121,6 +2161,9 @@ void iwl_mvm_rx_ba_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb)
 	ba_notif = (void *)pkt->data;
 	sta_id = ba_notif->sta_id;
 	tid = ba_notif->tid;
+	if (IWL_FW_CHECK(mvm, tid >= ARRAY_SIZE(mvmsta->tid_data),
+			 "invalid TID %d in BA notif\n", tid))
+		return;
 	/* "flow" corresponds to Tx queue */
 	txq = le16_to_cpu(ba_notif->scd_flow);
 	/* "ssn" is start of block-ack Tx window, corresponds to index
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info.c b/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info.c
index d5eb895144efc9..7f886200d69333 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info.c
@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
 /*
  * Copyright (C) 2017 Intel Deutschland GmbH
- * Copyright (C) 2018-2025 Intel Corporation
+ * Copyright (C) 2018-2026 Intel Corporation
  */
 #include "iwl-trans.h"
 #include "iwl-fh.h"
@@ -99,6 +99,11 @@ int iwl_pcie_init_fw_sec(struct iwl_trans *trans,
 	/* add 2 due to separators */
 	paging_cnt = iwl_pcie_get_num_sections(fw, lmac_cnt + umac_cnt + 2);
 
+	if (WARN_ON(lmac_cnt > ARRAY_SIZE(ctxt_dram->lmac_img) ||
+		    umac_cnt > ARRAY_SIZE(ctxt_dram->umac_img) ||
+		    paging_cnt > ARRAY_SIZE(ctxt_dram->virtual_img)))
+		return -EINVAL;
+
 	dram->fw = kzalloc_objs(*dram->fw, umac_cnt + lmac_cnt);
 	if (!dram->fw)
 		return -ENOMEM;

gemini-3.1-pro-preview

null

null

							input: 14616
							output: 39
							thoughts: 1153
						

**Analyzing the iwlwifi Driver Patch for Fuzzing Opportunities**

Okay, so I've got a patch for the `iwlwifi` driver, which means we're dealing with a core component of Linux kernel wireless networking, specifically for Intel's Wi-Fi adapters. The sheer number of files touched is the first indicator that this is a significant change, impacting a wide range of functionalities. My initial thought is, this is a prime candidate for fuzzing, given its close interaction with both hardware and firmware.

Looking at the files, we're talking about everything from RF configuration (`rf-pe.c`), NVM (non-volatile memory) parsing and handling (`nvm-reg.h`, `pnvm.c`, `iwl-nvm-parse.c`, and so on), regulatory domain handling (`regulatory.c`), shared memory management (`smem.c`), Multicast/MVM and TX/RX data processing (`tx.c`, `d3.c`, `ftm-initiator.c`, `fw.c`, `ptp.c`, `tx.c`, `ctxt-info.c`), and core driver configuration (`iwl-config.h`). This touches a lot of surface area!

The changes themselves are interesting. The addition of `unii9_supported` in the RF and MAC configurations hints at new hardware capabilities or support for updated standards. New definitions related to NVM data structures (`IWL_NUM_CHANNELS_V3`, `iwl_nvm_get_info_rsp_v4` etc.) suggest expanded NVM data handling and potentially new regulatory domain information.

Crucially, the mentions of added bounds checks and payload length checks for firmware communications are huge. This is exactly the kind of thing that fuzzers love to target. These checks represent areas where input validation could be improved, increasing the potential for out-of-bounds reads/writes or other exploitable conditions. The bug fixes, specifically the ones related to memory leaks and incorrect data copies ( `iwl_add_mcc_to_tas_block_list`, `iwl_mvm_get_crosstimestamp_fw`, `iwl_mvm_ftm_set_secured_ranging`, `iwl_mvm_rx_tx_cmd`, `iwl_mvm_rx_ba_notif`), highlight areas where subtle programming errors could lead to serious consequences. These are great targets to exploit.

So, where do we focus the fuzzer? Let's compile a list of interesting functions directly modified by the patch: `iwl_pnvm_complete_fn`, `iwl_add_mcc_to_tas_block_list`, `iwl_parse_shared_mem_22000`, `iwl_parse_shared_mem`, `iwl_init_channel_map`, `iwl_parse_mei_nvm_data`, `iwl_parse_nvm_data`, `iwl_parse_nvm_mcc_info`, `iwl_get_nvm`, `iwl_mld_handle_tx_resp_notif`, `iwl_mvm_report_wakeup_reasons`, `iwl_mvm_netdetect_query_results`, `iwl_mvm_wowlan_store_wake_pkt`, `iwl_mvm_nd_match_info_handler`, `iwl_mvm_ftm_set_secured_ranging`, `iwl_mvm_ftm_put_target_v7`, `iwl_mvm_ftm_put_target_v10`, `iwl_mvm_get_sar_geo_profile`, `iwl_mvm_get_crosstimestamp_fw`, `iwl_mvm_rx_tx_cmd_agg`, `iwl_mvm_rx_tx_cmd`, `iwl_mvm_rx_ba_notif`, `iwl_pcie_init_fw_sec`.

Before we even start fuzzing, let's verify that the necessary configurations are enabled. We're looking at `IWLWIFI`, `IWLMVM` for sure. Potentially `IWLMEI` too. The fuzzing setup will need to have these enabled.

{
  "Expression": "config IWLWIFI",
  "PathPrefix": "drivers/net/wireless/intel/iwlwifi/Kconfig"
}

{
  "Output": "drivers/net/wireless/intel/iwlwifi/Kconfig-1-# SPDX-License-Identifier: GPL-2.0-only\ndrivers/net/wireless/intel/iwlwifi/Kconfig:2:config IWLWIFI\ndrivers/net/wireless/intel/iwlwifi/Kconfig-3-\ttristate \"Intel Wireless WiFi Next Gen AGN - Wireless-N/Advanced-N/Ultimate-N (iwlwifi) \"\n--\ndrivers/net/wireless/intel/iwlwifi/Kconfig=47=if IWLWIFI\ndrivers/net/wireless/intel/iwlwifi/Kconfig-48-\ndrivers/net/wireless/intel/iwlwifi/Kconfig:49:config IWLWIFI_KUNIT_TESTS\ndrivers/net/wireless/intel/iwlwifi/Kconfig-50-\ttristate\n--\ndrivers/net/wireless/intel/iwlwifi/Kconfig-57-\ndrivers/net/wireless/intel/iwlwifi/Kconfig:58:config IWLWIFI_LEDS\ndrivers/net/wireless/intel/iwlwifi/Kconfig-59-\tbool\n--\ndrivers/net/wireless/intel/iwlwifi/Kconfig=84=config IWLMLD\n--\ndrivers/net/wireless/intel/iwlwifi/Kconfig-94-# don't call it _MODULE -- will confuse Kconfig/fixdep/...\ndrivers/net/wireless/intel/iwlwifi/Kconfig:95:config IWLWIFI_OPMODE_MODULAR\ndrivers/net/wireless/intel/iwlwifi/Kconfig-96-\tbool\n--\ndrivers/net/wireless/intel/iwlwifi/Kconfig=105=menu \"Debugging Options\"\ndrivers/net/wireless/intel/iwlwifi/Kconfig-106-\ndrivers/net/wireless/intel/iwlwifi/Kconfig:107:config IWLWIFI_DEBUG\ndrivers/net/wireless/intel/iwlwifi/Kconfig-108-\tbool \"Enable full debugging output in the iwlwifi driver\"\n--\ndrivers/net/wireless/intel/iwlwifi/Kconfig-130-\ndrivers/net/wireless/intel/iwlwifi/Kconfig:131:config IWLWIFI_DEBUGFS\ndrivers/net/wireless/intel/iwlwifi/Kconfig-132-\tbool \"iwlwifi debugfs support\"\n--\ndrivers/net/wireless/intel/iwlwifi/Kconfig-138-\ndrivers/net/wireless/intel/iwlwifi/Kconfig:139:config IWLWIFI_DEVICE_TRACING\ndrivers/net/wireless/intel/iwlwifi/Kconfig-140-\tbool \"iwlwifi device access tracing\"\n"
}

gemini-3.1-pro-preview

null

null

							input: 17400
							output: 82
							thoughts: 55
						

**Investigating the Intel Wireless Drivers' Configuration**

Okay, so I need to refresh my memory on how these Intel wireless drivers are configured, specifically for the Multi-Virtual Machine (`IWLMVM`) and the MEI (Management Engine Interface) features (`IWLMEI`). My initial instinct is to dig into the `Kconfig` files – they're the usual suspects for these sorts of configurations. I should find `IWLMVM` in `drivers/net/wireless/intel/iwlwifi/mvm/Kconfig` and `IWLMEI` in `drivers/net/wireless/intel/iwlwifi/mei/Kconfig`. Let me go check those files and confirm my assumptions about the configuration options and their dependencies. This will help me to contextualize the information I need to proceed further.

no matches

{
  "Expression": "config IWLMVM",
  "PathPrefix": "drivers/net/wireless/intel/iwlwifi/mvm/Kconfig"
}

{
  "error": "no matches"
}

no matches

{
  "Expression": "config IWLMEI",
  "PathPrefix": "drivers/net/wireless/intel/iwlwifi/mei/Kconfig"
}

{
  "error": "no matches"
}

gemini-3.1-pro-preview

null

null

							input: 17734
							output: 35
							thoughts: 48
						

Okay, here's my take on those thoughts, framed as an expert's internal monologue:

**Investigating Intel Wireless Configuration Options**

Right, so I need to get a handle on the configuration options for the Intel wireless drivers, specifically the `iwlwifi` modules. The easiest way to get an initial overview is to jump straight into the Kconfig files. I'm going to search for something simple and targeted to zero in on the relevant sections quickly. Let's start with a general search for `config IWL`, focusing on those configuration fragments. I'll search both the top-level `iwlwifi` directory's `Kconfig` and, since it has grown, also the `mvm` sub-directory's `Kconfig` to cover all of the modules that might be impacted by my configuration or testing. Hopefully, that should give me a good base to start with, revealing the main knobs I can tweak and the dependencies between them. From there, I can start to build a more complete picture of the whole setup.

{
  "Expression": "config IWL",
  "PathPrefix": "drivers/net/wireless/intel/iwlwifi/"
}

{
  "Output": "drivers/net/wireless/intel/iwlwifi/Kconfig-1-# SPDX-License-Identifier: GPL-2.0-only\ndrivers/net/wireless/intel/iwlwifi/Kconfig:2:config IWLWIFI\ndrivers/net/wireless/intel/iwlwifi/Kconfig-3-\ttristate \"Intel Wireless WiFi Next Gen AGN - Wireless-N/Advanced-N/Ultimate-N (iwlwifi) \"\n--\ndrivers/net/wireless/intel/iwlwifi/Kconfig=47=if IWLWIFI\ndrivers/net/wireless/intel/iwlwifi/Kconfig-48-\ndrivers/net/wireless/intel/iwlwifi/Kconfig:49:config IWLWIFI_KUNIT_TESTS\ndrivers/net/wireless/intel/iwlwifi/Kconfig-50-\ttristate\n--\ndrivers/net/wireless/intel/iwlwifi/Kconfig-57-\ndrivers/net/wireless/intel/iwlwifi/Kconfig:58:config IWLWIFI_LEDS\ndrivers/net/wireless/intel/iwlwifi/Kconfig-59-\tbool\n--\ndrivers/net/wireless/intel/iwlwifi/Kconfig-65-\ndrivers/net/wireless/intel/iwlwifi/Kconfig:66:config IWLDVM\ndrivers/net/wireless/intel/iwlwifi/Kconfig-67-\ttristate \"Intel Wireless WiFi DVM Firmware support\"\n--\ndrivers/net/wireless/intel/iwlwifi/Kconfig-73-\ndrivers/net/wireless/intel/iwlwifi/Kconfig:74:config IWLMVM\ndrivers/net/wireless/intel/iwlwifi/Kconfig-75-\ttristate \"Intel Wireless WiFi MVM Firmware support\"\n--\ndrivers/net/wireless/intel/iwlwifi/Kconfig-83-\ndrivers/net/wireless/intel/iwlwifi/Kconfig:84:config IWLMLD\ndrivers/net/wireless/intel/iwlwifi/Kconfig-85-\ttristate \"Intel Wireless WiFi MLD Firmware support\"\n--\ndrivers/net/wireless/intel/iwlwifi/Kconfig-94-# don't call it _MODULE -- will confuse Kconfig/fixdep/...\ndrivers/net/wireless/intel/iwlwifi/Kconfig:95:config IWLWIFI_OPMODE_MODULAR\ndrivers/net/wireless/intel/iwlwifi/Kconfig-96-\tbool\n--\ndrivers/net/wireless/intel/iwlwifi/Kconfig=105=menu \"Debugging Options\"\ndrivers/net/wireless/intel/iwlwifi/Kconfig-106-\ndrivers/net/wireless/intel/iwlwifi/Kconfig:107:config IWLWIFI_DEBUG\ndrivers/net/wireless/intel/iwlwifi/Kconfig-108-\tbool \"Enable full debugging output in the iwlwifi driver\"\n--\ndrivers/net/wireless/intel/iwlwifi/Kconfig-130-\ndrivers/net/wireless/intel/iwlwifi/Kconfig:131:config IWLWIFI_DEBUGFS\ndrivers/net/wireless/intel/iwlwifi/Kconfig-132-\tbool \"iwlwifi debugfs support\"\n--\ndrivers/net/wireless/intel/iwlwifi/Kconfig-138-\ndrivers/net/wireless/intel/iwlwifi/Kconfig:139:config IWLWIFI_DEVICE_TRACING\ndrivers/net/wireless/intel/iwlwifi/Kconfig-140-\tbool \"iwlwifi device access tracing\"\n--\ndrivers/net/wireless/intel/iwlwifi/Kconfig=158=endif\ndrivers/net/wireless/intel/iwlwifi/Kconfig-159-\ndrivers/net/wireless/intel/iwlwifi/Kconfig:160:config IWLMEI\ndrivers/net/wireless/intel/iwlwifi/Kconfig-161-\ttristate \"Intel Management Engine communication over WLAN\"\n"
}

gemini-3.1-pro-preview

null

null

							input: 19002
							output: 268
							thoughts: 2133
						

**Analysis of the IWlwifi Patch for Fuzzing Suitability**

Okay, so I've got this patch for the Intel wireless driver, `iwlwifi`. The relevant configurations appear to be `IWLWIFI`, `IWLMVM`, and `IWLMLD`.  The patch touches files in `mvm/`, `mld/`, `fw/`, `pcie/`, and `cfg/`, so it's a fairly widespread modification.  My initial thought is to identify the key functions added or modified and see if they're worth fuzzing.

I've identified these functions as potentially interesting: `iwl_pnvm_complete_fn`, `iwl_add_mcc_to_tas_block_list`, `iwl_parse_shared_mem_22000`, `iwl_parse_shared_mem`, `iwl_init_channel_map`, `iwl_parse_mei_nvm_data`, `iwl_parse_nvm_data`, `iwl_parse_nvm_mcc_info`, `iwl_get_nvm`, `iwl_mld_handle_tx_resp_notif`, `iwl_mvm_report_wakeup_reasons`, `iwl_mvm_netdetect_query_results`, `iwl_mvm_wowlan_store_wake_pkt`, `iwl_mvm_nd_match_info_handler`, `iwl_mvm_ftm_set_secured_ranging`, `iwl_mvm_ftm_put_target_v7`, `iwl_mvm_ftm_put_target_v10`, `iwl_mvm_get_sar_geo_profile`, `iwl_mvm_get_crosstimestamp_fw`, `iwl_mvm_rx_tx_cmd`, `iwl_mvm_rx_tx_cmd_agg`, `iwl_mvm_rx_ba_notif`, and `iwl_pcie_init_fw_sec`.

Now, let's filter the noise. `iwl_mvm_rx_tx_cmd`, `iwl_mvm_rx_tx_cmd_agg`, and `iwl_mvm_rx_ba_notif` are clearly in the hot-path RX/TX.  `iwl_mld_handle_tx_resp_notif` also seems high-frequency. `iwl_mvm_report_wakeup_reasons`, `iwl_mvm_wowlan_store_wake_pkt`, `iwl_mvm_netdetect_query_results`, and `iwl_mvm_nd_match_info_handler` all deal with WoWLAN/Netdetect. `iwl_mvm_ftm_set_secured_ranging` and `iwl_mvm_ftm_put_target_v7`, `iwl_mvm_ftm_put_target_v10` relate to FTM (Fine Timing Measurement), `iwl_mvm_get_sar_geo_profile` is SAR, and `iwl_mvm_get_crosstimestamp_fw` deals with PTP.  `iwl_pcie_init_fw_sec` appears to be firmware initialization, `iwl_pnvm_complete_fn` handles PNVM initialization, and `iwl_parse_shared_mem_22000`, `iwl_parse_shared_mem`, `iwl_init_channel_map`, `iwl_parse_nvm_data`, and `iwl_get_nvm` appear to relate to NVM parsing and firmware loading.

I need to focus on functions that are likely to be reached through different code paths, and are not just high-frequency packet processing.  Therefore, I'm excluding the hot-path functions.

So, I'll initially include: `iwl_pnvm_complete_fn`, `iwl_parse_shared_mem_22000`, `iwl_parse_shared_mem`, `iwl_get_nvm`, `iwl_mvm_report_wakeup_reasons`, `iwl_mvm_wowlan_store_wake_pkt`, `iwl_mvm_nd_match_info_handler`, `iwl_mvm_ftm_set_secured_ranging`, `iwl_mvm_get_sar_geo_profile`, `iwl_mvm_get_crosstimestamp_fw`, and `iwl_pcie_init_fw_sec` as the focus

{
  "EnableConfigs": [
    "IWLWIFI",
    "IWLMVM",
    "IWLMLD"
  ],
  "FocusSymbols": [
    "iwl_pnvm_complete_fn",
    "iwl_parse_shared_mem_22000",
    "iwl_parse_shared_mem",
    "iwl_get_nvm",
    "iwl_mvm_report_wakeup_reasons",
    "iwl_mvm_wowlan_store_wake_pkt",
    "iwl_mvm_nd_match_info_handler",
    "iwl_mvm_ftm_set_secured_ranging",
    "iwl_mvm_get_sar_geo_profile",
    "iwl_mvm_get_crosstimestamp_fw",
    "iwl_pcie_init_fw_sec"
  ],
  "Reasoning": "The patch makes functional changes to the iwlwifi driver, including adding support for UNII-9 channels, adding bounds checks for firmware notifications and responses, fixing memory leaks, and modifying NVM parsing logic. These changes affect the core logic of the driver and are worth fuzzing.",
  "WorthFuzzing": true
}

{
  "EnableConfigs": [
    "IWLWIFI",
    "IWLMVM",
    "IWLMLD"
  ],
  "FocusSymbols": [
    "iwl_pnvm_complete_fn",
    "iwl_parse_shared_mem_22000",
    "iwl_parse_shared_mem",
    "iwl_get_nvm",
    "iwl_mvm_report_wakeup_reasons",
    "iwl_mvm_wowlan_store_wake_pkt",
    "iwl_mvm_nd_match_info_handler",
    "iwl_mvm_ftm_set_secured_ranging",
    "iwl_mvm_get_sar_geo_profile",
    "iwl_mvm_get_crosstimestamp_fw",
    "iwl_pcie_init_fw_sec"
  ],
  "Reasoning": "The patch makes functional changes to the iwlwifi driver, including adding support for UNII-9 channels, adding bounds checks for firmware notifications and responses, fixing memory leaks, and modifying NVM parsing logic. These changes affect the core logic of the driver and are worth fuzzing.",
  "WorthFuzzing": true
}