AI Trajectory

null

{
  "EnableConfigs": [
    "MAC80211"
  ],
  "FocusSymbols": [
    "ieee80211_do_stop",
    "ieee80211_stop"
  ],
  "Reasoning": "The patch modifies the interface stop logic for AP_VLAN interfaces in mac80211, changing how packets are freed to avoid doing so under a spinlock. This is a functional change in the core mac80211 stack that is reachable via netlink commands (e.g., stopping an AP_VLAN interface).",
  "WorthFuzzing": true
}

null

{
  "PatchDiff": "commit 56347235edcda3b6e81b9dc22e0ff3032dee0c39\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Mon Jul 6 21:06:03 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/net/mac80211/iface.c b/net/mac80211/iface.c\nindex 086272c3ec08c1..43460a705a6bd0 100644\n--- a/net/mac80211/iface.c\n+++ b/net/mac80211/iface.c\n@@ -588,6 +588,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, bool going_do\n \t\tWARN_ON(!list_empty(\u0026sdata-\u003eu.ap.vlans));\n \t} else if (sdata-\u003evif.type == NL80211_IFTYPE_AP_VLAN) {\n \t\t/* remove all packets in parent bc_buf pointing to this dev */\n+\t\t__skb_queue_head_init(\u0026freeq);\n \t\tps = \u0026sdata-\u003ebss-\u003eps;\n \n \t\tspin_lock_irqsave(\u0026ps-\u003ebc_buf.lock, flags);\n@@ -595,10 +596,15 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, bool going_do\n \t\t\tif (skb-\u003edev == sdata-\u003edev) {\n \t\t\t\t__skb_unlink(skb, \u0026ps-\u003ebc_buf);\n \t\t\t\tlocal-\u003etotal_ps_buffered--;\n-\t\t\t\tieee80211_free_txskb(\u0026local-\u003ehw, skb);\n+\t\t\t\t__skb_queue_tail(\u0026freeq, skb);\n \t\t\t}\n \t\t}\n \t\tspin_unlock_irqrestore(\u0026ps-\u003ebc_buf.lock, flags);\n+\n+\t\tskb_queue_walk_safe(\u0026freeq, skb, tmp) {\n+\t\t\t__skb_unlink(skb, \u0026freeq);\n+\t\t\tieee80211_free_txskb(\u0026local-\u003ehw, skb);\n+\t\t}\n \t}\n \n \tif (going_down)\n"
}

gemini-3.1-pro-preview

null

{
  "EnableConfigs": [
    "MAC80211"
  ],
  "FocusSymbols": [
    "ieee80211_do_stop",
    "ieee80211_stop"
  ],
  "Reasoning": "The patch modifies the interface stop logic for AP_VLAN interfaces in mac80211, changing how packets are freed to avoid doing so under a spinlock. This is a functional change in the core mac80211 stack that is reachable via netlink commands (e.g., stopping an AP_VLAN interface).",
  "WorthFuzzing": true
}

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Do not list too generic configs (we already have them enabled). Only list those that
   specifically cover the modified code. List them in the EnableConfigs output array,
   and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit 56347235edcda3b6e81b9dc22e0ff3032dee0c39
Author: syz-cluster <triage@syzkaller.com>
Date:   Mon Jul 6 21:06:03 2026 +0000

    syz-cluster: applied patch under review

diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 086272c3ec08c1..43460a705a6bd0 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -588,6 +588,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, bool going_do
 		WARN_ON(!list_empty(&sdata->u.ap.vlans));
 	} else if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
 		/* remove all packets in parent bc_buf pointing to this dev */
+		__skb_queue_head_init(&freeq);
 		ps = &sdata->bss->ps;
 
 		spin_lock_irqsave(&ps->bc_buf.lock, flags);
@@ -595,10 +596,15 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, bool going_do
 			if (skb->dev == sdata->dev) {
 				__skb_unlink(skb, &ps->bc_buf);
 				local->total_ps_buffered--;
-				ieee80211_free_txskb(&local->hw, skb);
+				__skb_queue_tail(&freeq, skb);
 			}
 		}
 		spin_unlock_irqrestore(&ps->bc_buf.lock, flags);
+
+		skb_queue_walk_safe(&freeq, skb, tmp) {
+			__skb_unlink(skb, &freeq);
+			ieee80211_free_txskb(&local->hw, skb);
+		}
 	}
 
 	if (going_down)

gemini-3.1-pro-preview

null

null

							input: 2149
							output: 44
							thoughts: 155
						

**Analyzing a Mac80211 Patch: Avoiding Potential Concurrency Issues**

Okay, so I'm looking at this patch for `net/mac80211/iface.c`. It's touching the `ieee80211_do_stop` function, which immediately tells me this is related to interface shutdown procedures. The meat of the change is how packets are handled when an AP_VLAN interface is stopped. Specifically, it seems like the old code in `ieee80211_do_stop` had a problem: it was calling `ieee80211_free_txskb` while holding the `ps->bc_buf.lock` spinlock. That's a red flag. I've seen that kind of pattern lead to all sorts of concurrency headaches, maybe even a sleep-in-atomic situation or a classic deadlock, depending on what `ieee80211_free_txskb` actually does internally.

So, the patch cleverly sidesteps the potential problem by queuing the SKBs to a local `freeq` instead. The beauty of this is that it allows the problematic freeing process to happen *after* the spinlock is released. This is a solid, functional change. It's the right way to fix such potential bugs.

Now, let me dig deeper and see what else this is affecting. I'm going to quickly review the surrounding context of `ieee80211_do_stop` to confirm my understanding of the interface's behavior during a shutdown.

{
  "Expression": "ieee80211_do_stop",
  "PathPrefix": "net/mac80211/iface.c"
}

{
  "Output": "net/mac80211/iface.c=461=static int ieee80211_open(struct net_device *dev)\n--\nnet/mac80211/iface.c-478-\nnet/mac80211/iface.c:479:static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, bool going_down)\nnet/mac80211/iface.c-480-{\n--\nnet/mac80211/iface.c=845=static int ieee80211_stop(struct net_device *dev)\n--\nnet/mac80211/iface.c-867-\nnet/mac80211/iface.c:868:\tieee80211_do_stop(sdata, true);\nnet/mac80211/iface.c-869-\n--\nnet/mac80211/iface.c=1980=static int ieee80211_runtime_change_iftype(struct ieee80211_sub_if_data *sdata,\n--\nnet/mac80211/iface.c-2044-\t/* do_stop will synchronize_rcu() first thing */\nnet/mac80211/iface.c:2045:\tieee80211_do_stop(sdata, false);\nnet/mac80211/iface.c-2046-\n--\nnet/mac80211/iface.c=2440=void ieee80211_sdata_stop(struct ieee80211_sub_if_data *sdata)\n--\nnet/mac80211/iface.c-2443-\t\treturn;\nnet/mac80211/iface.c:2444:\tieee80211_do_stop(sdata, true);\nnet/mac80211/iface.c-2445-}\n"
}

gemini-3.1-pro-preview

null

null

							input: 3235
							output: 38
							thoughts: 96
						

Here's my analysis of the situation:

**Reaching a Stop**

Okay, so `ieee80211_do_stop` is the function we're concerned with. I know it gets called in a few critical places within the MAC80211 stack: `ieee80211_stop`, `ieee80211_runtime_change_iftype`, and `ieee80211_sdata_stop`. Given those points of origin, it's safe to say it's definitely reachable code – no worries about dead code elimination here. The patch focuses on how the AP_VLAN interface behaves when stopping. My next step is to examine the Kconfig options for MAC80211.

{
  "Expression": "config MAC80211",
  "PathPrefix": "net/mac80211/Kconfig"
}

{
  "Output": "net/mac80211/Kconfig-1-# SPDX-License-Identifier: GPL-2.0-only\nnet/mac80211/Kconfig:2:config MAC80211\nnet/mac80211/Kconfig-3-\ttristate \"Generic IEEE 802.11 Networking Stack (mac80211)\"\n--\nnet/mac80211/Kconfig=19=if MAC80211 != n\nnet/mac80211/Kconfig-20-\nnet/mac80211/Kconfig:21:config MAC80211_HAS_RC\nnet/mac80211/Kconfig-22-\tbool\nnet/mac80211/Kconfig-23-\nnet/mac80211/Kconfig:24:config MAC80211_RC_MINSTREL\nnet/mac80211/Kconfig-25-\tbool \"Minstrel\" if EXPERT\n--\nnet/mac80211/Kconfig=31=choice\n--\nnet/mac80211/Kconfig-40-\nnet/mac80211/Kconfig:41:config MAC80211_RC_DEFAULT_MINSTREL\nnet/mac80211/Kconfig-42-\tbool \"Minstrel\"\n--\nnet/mac80211/Kconfig=48=endchoice\nnet/mac80211/Kconfig-49-\nnet/mac80211/Kconfig:50:config MAC80211_RC_DEFAULT\nnet/mac80211/Kconfig-51-\tstring\n--\nnet/mac80211/Kconfig=57=comment \"Some wireless drivers require a rate control algorithm\"\n--\nnet/mac80211/Kconfig-59-\nnet/mac80211/Kconfig:60:config MAC80211_KUNIT_TEST\nnet/mac80211/Kconfig-61-\ttristate \"KUnit tests for mac80211\" if !KUNIT_ALL_TESTS\n--\nnet/mac80211/Kconfig-69-\nnet/mac80211/Kconfig:70:config MAC80211_MESH\nnet/mac80211/Kconfig-71-\tbool \"Enable mac80211 mesh networking support\"\n--\nnet/mac80211/Kconfig-78-\nnet/mac80211/Kconfig:79:config MAC80211_LEDS\nnet/mac80211/Kconfig-80-\tbool \"Enable LED triggers\"\n--\nnet/mac80211/Kconfig-87-\nnet/mac80211/Kconfig:88:config MAC80211_DEBUGFS\nnet/mac80211/Kconfig-89-\tbool \"Export mac80211 internals in DebugFS\"\n--\nnet/mac80211/Kconfig-96-\nnet/mac80211/Kconfig:97:config MAC80211_MESSAGE_TRACING\nnet/mac80211/Kconfig-98-\tbool \"Trace all mac80211 debug messages\"\n--\nnet/mac80211/Kconfig-109-\nnet/mac80211/Kconfig:110:menuconfig MAC80211_DEBUG_MENU\nnet/mac80211/Kconfig-111-\tbool \"Select mac80211 debugging features\"\n--\nnet/mac80211/Kconfig-115-\nnet/mac80211/Kconfig:116:config MAC80211_NOINLINE\nnet/mac80211/Kconfig-117-\tbool \"Do not inline TX/RX handlers\"\n--\nnet/mac80211/Kconfig-131-\nnet/mac80211/Kconfig:132:config MAC80211_VERBOSE_DEBUG\nnet/mac80211/Kconfig-133-\tbool \"Verbose debugging output\"\n--\nnet/mac80211/Kconfig-142-\nnet/mac80211/Kconfig:143:config MAC80211_MLME_DEBUG\nnet/mac80211/Kconfig-144-\tbool \"Verbose managed MLME output\"\n--\nnet/mac80211/Kconfig-153-\nnet/mac80211/Kconfig:154:config MAC80211_STA_DEBUG\nnet/mac80211/Kconfig-155-\tbool \"Verbose station debugging\"\n--\nnet/mac80211/Kconfig-162-\nnet/mac80211/Kconfig:163:config MAC80211_HT_DEBUG\nnet/mac80211/Kconfig-164-\tbool \"Verbose HT debugging\"\n--\nnet/mac80211/Kconfig-174-\nnet/mac80211/Kconfig:175:config MAC80211_OCB_DEBUG\nnet/mac80211/Kconfig-176-\tbool \"Verbose OCB debugging\"\n--\nnet/mac80211/Kconfig-185-\nnet/mac80211/Kconfig:186:config MAC80211_IBSS_DEBUG\nnet/mac80211/Kconfig-187-\tbool \"Verbose IBSS debugging\"\n--\nnet/mac80211/Kconfig-196-\nnet/mac80211/Kconfig:197:config MAC80211_PS_DEBUG\nnet/mac80211/Kconfig-198-\tbool \"Verbose powersave mode debugging\"\n--\nnet/mac80211/Kconfig-208-\nnet/mac80211/Kconfig:209:config MAC80211_MPL_DEBUG\nnet/mac80211/Kconfig-210-\tbool \"Verbose mesh peer link debugging\"\n--\nnet/mac80211/Kconfig-221-\nnet/mac80211/Kconfig:222:config MAC80211_MPATH_DEBUG\nnet/mac80211/Kconfig-223-\tbool \"Verbose mesh path debugging\"\n--\nnet/mac80211/Kconfig-234-\nnet/mac80211/Kconfig:235:config MAC80211_MHWMP_DEBUG\nnet/mac80211/Kconfig-236-\tbool \"Verbose mesh HWMP routing debugging\"\n--\nnet/mac80211/Kconfig-247-\nnet/mac80211/Kconfig:248:config MAC80211_MESH_SYNC_DEBUG\nnet/mac80211/Kconfig-249-\tbool \"Verbose mesh synchronization debugging\"\n--\nnet/mac80211/Kconfig-258-\nnet/mac80211/Kconfig:259:config MAC80211_MESH_CSA_DEBUG\nnet/mac80211/Kconfig-260-\tbool \"Verbose mesh channel switch debugging\"\n--\nnet/mac80211/Kconfig-269-\nnet/mac80211/Kconfig:270:config MAC80211_MESH_PS_DEBUG\nnet/mac80211/Kconfig-271-\tbool \"Verbose mesh powersave debugging\"\n--\nnet/mac80211/Kconfig-280-\nnet/mac80211/Kconfig:281:config MAC80211_TDLS_DEBUG\nnet/mac80211/Kconfig-282-\tbool \"Verbose TDLS debugging\"\n--\nnet/mac80211/Kconfig-292-\nnet/mac80211/Kconfig:293:config MAC80211_DEBUG_COUNTERS\nnet/mac80211/Kconfig-294-\tbool \"Extra statistics for TX/RX debugging\"\n--\nnet/mac80211/Kconfig-307-\nnet/mac80211/Kconfig:308:config MAC80211_STA_HASH_MAX_SIZE\nnet/mac80211/Kconfig-309-\tint \"Station hash table maximum size\" if MAC80211_DEBUG_MENU\n"
}

gemini-3.1-pro-preview

null

null

							input: 5715
							output: 42
							thoughts: 160
						

**Fuzzing the `MAC80211` Config and `ieee80211_do_stop` Function**

Okay, so I'm looking at this `MAC80211` configuration, and the key function here seems to be `ieee80211_do_stop`. My immediate thought? This is *definitely* worth fuzzing. The potential for uncovering interesting bugs in this area is high, given its role in stopping the wireless interface.

The patch mentions a bug related to `ieee80211_free_txskb` being called while holding a spinlock. That immediately grabs my attention. Anytime you see a function like `ieee80211_free_txskb` being called under a spinlock, it's a red flag. That function might sleep or acquire a mutex internally – which is a big no-no when you're already within a spinlock's protection. Even if it *doesn't* sleep, it's still bad practice to perform such actions with a spinlock held.

Ah, right, `ieee80211_free_txskb` is part of the `mac80211` subsystem. Makes sense. Okay, time to dive into the implementation of `ieee80211_free_txskb` itself and see exactly what's going on in there. Gotta understand the root cause of this vulnerability.

{
  "Expression": "ieee80211_free_txskb",
  "PathPrefix": "net/mac80211/"
}

{
  "Output": "net/mac80211/iface.c=479=static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, bool going_down)\n--\nnet/mac80211/iface.c-605-\t\t\t__skb_unlink(skb, \u0026freeq);\nnet/mac80211/iface.c:606:\t\t\tieee80211_free_txskb(\u0026local-\u003ehw, skb);\nnet/mac80211/iface.c-607-\t\t}\n--\nnet/mac80211/iface.c-685-\t/*\nnet/mac80211/iface.c:686:\t * Since ieee80211_free_txskb() may issue __dev_queue_xmit()\nnet/mac80211/iface.c-687-\t * which should be called with interrupts enabled, reclamation\n--\nnet/mac80211/iface.c-707-\t\t__skb_unlink(skb, \u0026freeq);\nnet/mac80211/iface.c:708:\t\tieee80211_free_txskb(\u0026local-\u003ehw, skb);\nnet/mac80211/iface.c-709-\t}\n--\nnet/mac80211/mesh_pathtbl.c=1004=void mesh_path_discard_frame(struct ieee80211_sub_if_data *sdata,\n--\nnet/mac80211/mesh_pathtbl.c-1006-{\nnet/mac80211/mesh_pathtbl.c:1007:\tieee80211_free_txskb(\u0026sdata-\u003elocal-\u003ehw, skb);\nnet/mac80211/mesh_pathtbl.c-1008-\tsdata-\u003eu.mesh.mshstats.dropped_frames_no_route++;\n--\nnet/mac80211/offchannel.c=171=static void ieee80211_roc_notify_destroy(struct ieee80211_roc_work *roc)\n--\nnet/mac80211/offchannel.c-177-\t\t\t\t\tfalse, GFP_KERNEL);\nnet/mac80211/offchannel.c:178:\t\tieee80211_free_txskb(\u0026roc-\u003esdata-\u003elocal-\u003ehw, roc-\u003eframe);\nnet/mac80211/offchannel.c-179-\t}\n--\nnet/mac80211/offchannel.c=812=int ieee80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,\n--\nnet/mac80211/offchannel.c-1049-\tif (ret)\nnet/mac80211/offchannel.c:1050:\t\tieee80211_free_txskb(\u0026local-\u003ehw, skb);\nnet/mac80211/offchannel.c-1051- out_unlock:\n--\nnet/mac80211/sta_info.c=1207=static bool sta_info_cleanup_expire_buffered_ac(struct ieee80211_local *local,\n--\nnet/mac80211/sta_info.c-1236-\t\t\tbreak;\nnet/mac80211/sta_info.c:1237:\t\tieee80211_free_txskb(\u0026local-\u003ehw, skb);\nnet/mac80211/sta_info.c-1238-\t}\n--\nnet/mac80211/sta_info.c-1265-\t\t       sta-\u003esta.addr);\nnet/mac80211/sta_info.c:1266:\t\tieee80211_free_txskb(\u0026local-\u003ehw, skb);\nnet/mac80211/sta_info.c-1267-\t}\n--\nnet/mac80211/status.c=22=void ieee80211_tx_status_irqsafe(struct ieee80211_hw *hw,\n--\nnet/mac80211/status.c-35-\t       (skb = skb_dequeue(\u0026local-\u003eskb_queue_unreliable))) {\nnet/mac80211/status.c:36:\t\tieee80211_free_txskb(hw, skb);\nnet/mac80211/status.c-37-\t\ttmp--;\n--\nnet/mac80211/status.c=44=static void ieee80211_handle_filtered_frame(struct ieee80211_local *local,\n--\nnet/mac80211/status.c-54-\t\t\t   IEEE80211_TX_CTL_HW_80211_ENCAP)) {\nnet/mac80211/status.c:55:\t\tieee80211_free_txskb(\u0026local-\u003ehw, skb);\nnet/mac80211/status.c-56-\t\treturn;\n--\nnet/mac80211/status.c-168-\t\t\t   !!test_sta_flag(sta, WLAN_STA_PS_STA), jiffies);\nnet/mac80211/status.c:169:\tieee80211_free_txskb(\u0026local-\u003ehw, skb);\nnet/mac80211/status.c-170-}\n--\nnet/mac80211/status.c=1312=EXPORT_SYMBOL(ieee80211_report_low_ack);\nnet/mac80211/status.c-1313-\nnet/mac80211/status.c:1314:void ieee80211_free_txskb(struct ieee80211_hw *hw, struct sk_buff *skb)\nnet/mac80211/status.c-1315-{\n--\nnet/mac80211/status.c-1321-}\nnet/mac80211/status.c:1322:EXPORT_SYMBOL(ieee80211_free_txskb);\nnet/mac80211/status.c-1323-\nnet/mac80211/status.c=1324=void ieee80211_purge_tx_queue(struct ieee80211_hw *hw,\n--\nnet/mac80211/status.c-1329-\twhile ((skb = __skb_dequeue(skbs)))\nnet/mac80211/status.c:1330:\t\tieee80211_free_txskb(hw, skb);\nnet/mac80211/status.c-1331-}\n--\nnet/mac80211/tx.c=330=static void purge_old_ps_buffers(struct ieee80211_local *local)\n--\nnet/mac80211/tx.c-349-\t\t\tpurged++;\nnet/mac80211/tx.c:350:\t\t\tieee80211_free_txskb(\u0026local-\u003ehw, skb);\nnet/mac80211/tx.c-351-\t\t}\n--\nnet/mac80211/tx.c-366-\t\t\t\tpurged++;\nnet/mac80211/tx.c:367:\t\t\t\tieee80211_free_txskb(\u0026local-\u003ehw, skb);\nnet/mac80211/tx.c-368-\t\t\t\tbreak;\n--\nnet/mac80211/tx.c=378=ieee80211_tx_h_multicast_ps_buf(struct ieee80211_tx_data *tx)\n--\nnet/mac80211/tx.c-432-\t\t       \"BC TX buffer full - dropping the oldest frame\\n\");\nnet/mac80211/tx.c:433:\t\tieee80211_free_txskb(\u0026tx-\u003elocal-\u003ehw, skb_dequeue(\u0026ps-\u003ebc_buf));\nnet/mac80211/tx.c-434-\t} else\n--\nnet/mac80211/tx.c=458=ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)\n--\nnet/mac80211/tx.c-503-\t\t\t       sta-\u003esta.addr, ac);\nnet/mac80211/tx.c:504:\t\t\tieee80211_free_txskb(\u0026local-\u003ehw, old);\nnet/mac80211/tx.c-505-\t\t} else\n--\nnet/mac80211/tx.c=1108=static bool ieee80211_tx_prep_agg(struct ieee80211_tx_data *tx,\n--\nnet/mac80211/tx.c-1168-\t\tif (purge_skb)\nnet/mac80211/tx.c:1169:\t\t\tieee80211_free_txskb(\u0026tx-\u003elocal-\u003ehw, purge_skb);\nnet/mac80211/tx.c-1170-\t}\n--\nnet/mac80211/tx.c=1389=static void codel_drop_func(struct sk_buff *skb,\n--\nnet/mac80211/tx.c-1399-\nnet/mac80211/tx.c:1400:\tieee80211_free_txskb(hw, skb);\nnet/mac80211/tx.c-1401-}\n--\nnet/mac80211/tx.c=1434=static void fq_skb_free_func(struct fq *fq,\n--\nnet/mac80211/tx.c-1441-\tlocal = container_of(fq, struct ieee80211_local, fq);\nnet/mac80211/tx.c:1442:\tieee80211_free_txskb(\u0026local-\u003ehw, skb);\nnet/mac80211/tx.c-1443-}\n--\nnet/mac80211/tx.c=1679=static bool ieee80211_tx_frags(struct ieee80211_local *local,\n--\nnet/mac80211/tx.c-1695-\t\t\t__skb_unlink(skb, skbs);\nnet/mac80211/tx.c:1696:\t\t\tieee80211_free_txskb(\u0026local-\u003ehw, skb);\nnet/mac80211/tx.c-1697-\t\t\tcontinue;\n--\nnet/mac80211/tx.c=1816=static int invoke_tx_handlers_early(struct ieee80211_tx_data *tx)\n--\nnet/mac80211/tx.c-1836-\t\tif (tx-\u003eskb)\nnet/mac80211/tx.c:1837:\t\t\tieee80211_free_txskb(\u0026tx-\u003elocal-\u003ehw, tx-\u003eskb);\nnet/mac80211/tx.c-1838-\t\telse\n--\nnet/mac80211/tx.c=1853=static int invoke_tx_handlers_late(struct ieee80211_tx_data *tx)\n--\nnet/mac80211/tx.c-1880-\t\tif (tx-\u003eskb)\nnet/mac80211/tx.c:1881:\t\t\tieee80211_free_txskb(\u0026tx-\u003elocal-\u003ehw, tx-\u003eskb);\nnet/mac80211/tx.c-1882-\t\telse\n--\nnet/mac80211/tx.c=1902=bool ieee80211_tx_prepare_skb(struct ieee80211_hw *hw,\n--\nnet/mac80211/tx.c-1932-\tif (WARN_ON(skb2 != skb || !skb_queue_empty(\u0026tx.skbs))) {\nnet/mac80211/tx.c:1933:\t\tieee80211_free_txskb(hw, skb2);\nnet/mac80211/tx.c-1934-\t\tieee80211_purge_tx_queue(hw, \u0026tx.skbs);\n--\nnet/mac80211/tx.c=1945=static bool ieee80211_tx(struct ieee80211_sub_if_data *sdata,\n--\nnet/mac80211/tx.c-1963-\tif (unlikely(res_prepare == TX_DROP)) {\nnet/mac80211/tx.c:1964:\t\tieee80211_free_txskb(\u0026local-\u003ehw, skb);\nnet/mac80211/tx.c-1965-\t\ttx.sdata-\u003etx_handlers_drop++;\n--\nnet/mac80211/tx.c=2034=void ieee80211_xmit(struct ieee80211_sub_if_data *sdata,\n--\nnet/mac80211/tx.c-2056-\tif (ieee80211_skb_resize(sdata, skb, headroom, encrypt)) {\nnet/mac80211/tx.c:2057:\t\tieee80211_free_txskb(\u0026local-\u003ehw, skb);\nnet/mac80211/tx.c-2058-\t\treturn;\n--\nnet/mac80211/tx.c=2631=static struct sk_buff *ieee80211_build_hdr(struct ieee80211_sub_if_data *sdata,\n--\nnet/mac80211/tx.c-2982-\t\tif (ieee80211_skb_resize(sdata, skb, head_need, ENCRYPT_DATA)) {\nnet/mac80211/tx.c:2983:\t\t\tieee80211_free_txskb(\u0026local-\u003ehw, skb);\nnet/mac80211/tx.c-2984-\t\t\tskb = NULL;\n--\nnet/mac80211/tx.c=3860=struct sk_buff *ieee80211_tx_dequeue(struct ieee80211_hw *hw,\n--\nnet/mac80211/tx.c-3940-\t\t\tI802_DEBUG_INC(local-\u003etx_handlers_drop_unauth_port);\nnet/mac80211/tx.c:3941:\t\t\tieee80211_free_txskb(\u0026local-\u003ehw, skb);\nnet/mac80211/tx.c-3942-\t\t\tgoto begin;\n--\nnet/mac80211/tx.c-3952-\tif (r != TX_CONTINUE) {\nnet/mac80211/tx.c:3953:\t\tieee80211_free_txskb(\u0026local-\u003ehw, skb);\nnet/mac80211/tx.c-3954-\t\tgoto begin;\n--\nnet/mac80211/tx.c-3964-\t\t\tif (r != TX_CONTINUE) {\nnet/mac80211/tx.c:3965:\t\t\t\tieee80211_free_txskb(\u0026local-\u003ehw, skb);\nnet/mac80211/tx.c-3966-\t\t\t\tgoto begin;\n--\nnet/mac80211/tx.c-3983-\t\tif (r != TX_CONTINUE) {\nnet/mac80211/tx.c:3984:\t\t\tieee80211_free_txskb(\u0026local-\u003ehw, skb);\nnet/mac80211/tx.c-3985-\t\t\tgoto begin;\n--\nnet/mac80211/tx.c-4003-\t\tif (skb_linearize(skb)) {\nnet/mac80211/tx.c:4004:\t\t\tieee80211_free_txskb(\u0026local-\u003ehw, skb);\nnet/mac80211/tx.c-4005-\t\t\tgoto begin;\n--\nnet/mac80211/tx.c-4022-\t\t} else if (ieee80211_hw_check(\u0026local-\u003ehw, QUEUE_CONTROL)) {\nnet/mac80211/tx.c:4023:\t\t\tieee80211_free_txskb(\u0026local-\u003ehw, skb);\nnet/mac80211/tx.c-4024-\t\t\tgoto begin;\n--\nnet/mac80211/tx.c=4895=void ieee80211_clear_tx_pending(struct ieee80211_local *local)\n--\nnet/mac80211/tx.c-4901-\t\twhile ((skb = skb_dequeue(\u0026local-\u003epending[i])) != NULL)\nnet/mac80211/tx.c:4902:\t\t\tieee80211_free_txskb(\u0026local-\u003ehw, skb);\nnet/mac80211/tx.c-4903-\t}\n--\nnet/mac80211/tx.c=4963=void ieee80211_tx_pending(struct tasklet_struct *t)\n--\nnet/mac80211/tx.c-4987-\t\t\tif (WARN_ON(!info-\u003econtrol.vif)) {\nnet/mac80211/tx.c:4988:\t\t\t\tieee80211_free_txskb(\u0026local-\u003ehw, skb);\nnet/mac80211/tx.c-4989-\t\t\t\tcontinue;\n--\nnet/mac80211/tx.c=6232=ieee80211_get_buffered_bc(struct ieee80211_hw *hw,\n--\nnet/mac80211/tx.c-6287-\t\t\tbreak;\nnet/mac80211/tx.c:6288:\t\tieee80211_free_txskb(hw, skb);\nnet/mac80211/tx.c-6289-\t}\n--\nnet/mac80211/util.c=551=void ieee80211_add_pending_skb(struct ieee80211_local *local,\n--\nnet/mac80211/util.c-559-\tif (WARN_ON(!info-\u003econtrol.vif)) {\nnet/mac80211/util.c:560:\t\tieee80211_free_txskb(\u0026local-\u003ehw, skb);\nnet/mac80211/util.c-561-\t\treturn;\n--\nnet/mac80211/util.c=573=void ieee80211_add_pending_skbs(struct ieee80211_local *local,\n--\nnet/mac80211/util.c-585-\t\tif (WARN_ON(!info-\u003econtrol.vif)) {\nnet/mac80211/util.c:586:\t\t\tieee80211_free_txskb(\u0026local-\u003ehw, skb);\nnet/mac80211/util.c-587-\t\t\tcontinue;\n"
}

gemini-3.1-pro-preview

null

null

							input: 11442
							output: 33
							thoughts: 269
						

**Analyzing the Patch for Potential Fuzzing**

Okay, so the patch I'm looking at modifies `ieee80211_do_stop`, specifically within `net/mac80211/iface.c`. This is the function responsible for stopping an interface, which, by its nature, isn't a high-frequency operation – so it's not a hot path. However, it *is* reachable – that's good. I can trigger it with standard netlink commands like `ifconfig wlan0 down`.

Now, the important question: is it worth fuzzing? Given that it's a functional change within the kernel, the answer is a definite yes. We have the `MAC80211` config, which covers this code. Let me double-check though... Yup, the code is indeed in `net/mac80211/iface.c`. I'm going to make sure there aren't any other dependent configs.

Wait a second... the patch specifies a check for `sdata->vif.type == NL80211_IFTYPE_AP_VLAN`. Okay, so it's *specifically* related to AP_VLAN interfaces. That changes things a bit. Does AP_VLAN have its own specific configuration? Let me consult `net/mac80211/Kconfig` or possibly `net/wireless/Kconfig` to see if there's a dedicated config option related to AP_VLAN that I need to be aware of. Gotta ensure the fuzzing setup accurately reflects the relevant kernel build configurations.

{
  "Expression": "AP_VLAN",
  "PathPrefix": "net/mac80211/"
}

{
  "Output": "\nFull output is too long, showing 500 out of 642 lines.\nUse more precise expression if possible.\n\nnet/mac80211/agg-tx.c=603=int ieee80211_start_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid,\n--\nnet/mac80211/agg-tx.c-641-\t    sdata-\u003evif.type != NL80211_IFTYPE_MESH_POINT \u0026\u0026\nnet/mac80211/agg-tx.c:642:\t    sdata-\u003evif.type != NL80211_IFTYPE_AP_VLAN \u0026\u0026\nnet/mac80211/agg-tx.c-643-\t    sdata-\u003evif.type != NL80211_IFTYPE_AP \u0026\u0026\n--\nnet/mac80211/cfg.c=206=static struct wireless_dev *ieee80211_add_iface(struct wiphy *wiphy,\n--\nnet/mac80211/cfg.c-235-\tswitch (type) {\nnet/mac80211/cfg.c:236:\tcase NL80211_IFTYPE_AP_VLAN:\nnet/mac80211/cfg.c-237-\t\tbreak;\n--\nnet/mac80211/cfg.c=259=static int ieee80211_change_iface(struct wiphy *wiphy,\n--\nnet/mac80211/cfg.c-274-\nnet/mac80211/cfg.c:275:\tif (type == NL80211_IFTYPE_AP_VLAN \u0026\u0026 params-\u003euse_4addr == 0) {\nnet/mac80211/cfg.c-276-\t\tRCU_INIT_POINTER(sdata-\u003eu.vlan.sta, NULL);\n--\nnet/mac80211/cfg.c=613=static int ieee80211_add_key(struct wiphy *wiphy, struct wireless_dev *wdev,\n--\nnet/mac80211/cfg.c-699-\tcase NL80211_IFTYPE_AP:\nnet/mac80211/cfg.c:700:\tcase NL80211_IFTYPE_AP_VLAN:\nnet/mac80211/cfg.c-701-\tcase NL80211_IFTYPE_NAN:\n--\nnet/mac80211/cfg.c=2630=static int ieee80211_add_station(struct wiphy *wiphy, struct wireless_dev *wdev,\n--\nnet/mac80211/cfg.c-2643-\nnet/mac80211/cfg.c:2644:\t\tif (sdata-\u003evif.type != NL80211_IFTYPE_AP_VLAN \u0026\u0026\nnet/mac80211/cfg.c-2645-\t\t    sdata-\u003evif.type != NL80211_IFTYPE_AP)\n--\nnet/mac80211/cfg.c=2783=static int ieee80211_change_station(struct wiphy *wiphy,\n--\nnet/mac80211/cfg.c-2820-\tcase NL80211_IFTYPE_AP:\nnet/mac80211/cfg.c:2821:\tcase NL80211_IFTYPE_AP_VLAN:\nnet/mac80211/cfg.c-2822-\t\tif (test_sta_flag(sta, WLAN_STA_ASSOC))\n--\nnet/mac80211/cfg.c-2850-\nnet/mac80211/cfg.c:2851:\t\tif (sta-\u003esdata-\u003evif.type == NL80211_IFTYPE_AP_VLAN \u0026\u0026\nnet/mac80211/cfg.c-2852-\t\t    sta-\u003esdata-\u003eu.vlan.sta)\n--\nnet/mac80211/chan.c=112=ieee80211_chanctx_user_iter_next(struct ieee80211_local *local,\n--\nnet/mac80211/chan.c-142-\nnet/mac80211/chan.c:143:\t\t/* AP_VLAN has a chanctx pointer but follows AP */\nnet/mac80211/chan.c:144:\t\tif (iter-\u003esdata-\u003evif.type == NL80211_IFTYPE_AP_VLAN)\nnet/mac80211/chan.c-145-\t\t\tcontinue;\n--\nnet/mac80211/chan.c=519=ieee80211_get_width_of_link(struct ieee80211_link_data *link)\n--\nnet/mac80211/chan.c-540-\tcase NL80211_IFTYPE_AP:\nnet/mac80211/chan.c:541:\tcase NL80211_IFTYPE_AP_VLAN:\nnet/mac80211/chan.c-542-\t\treturn ieee80211_get_max_required_bw(link);\n--\nnet/mac80211/chan.c=1579=ieee80211_link_chanctx_reservation_complete(struct ieee80211_link_data *link)\n--\nnet/mac80211/chan.c-1595-\tcase NL80211_IFTYPE_UNSPECIFIED:\nnet/mac80211/chan.c:1596:\tcase NL80211_IFTYPE_AP_VLAN:\nnet/mac80211/chan.c-1597-\tcase NL80211_IFTYPE_WDS:\n--\nnet/mac80211/chan.c=2482=void ieee80211_link_release_channel(struct ieee80211_link_data *link)\n--\nnet/mac80211/chan.c-2485-\nnet/mac80211/chan.c:2486:\tif (sdata-\u003evif.type == NL80211_IFTYPE_AP_VLAN)\nnet/mac80211/chan.c-2487-\t\treturn;\n--\nnet/mac80211/chan.c=2495=void ieee80211_link_vlan_copy_chanctx(struct ieee80211_link_data *link)\n--\nnet/mac80211/chan.c-2506-\nnet/mac80211/chan.c:2507:\tif (WARN_ON(sdata-\u003evif.type != NL80211_IFTYPE_AP_VLAN || !sdata-\u003ebss))\nnet/mac80211/chan.c-2508-\t\treturn;\n--\nnet/mac80211/debugfs_netdev.c=937=static void add_files(struct ieee80211_sub_if_data *sdata)\n--\nnet/mac80211/debugfs_netdev.c-964-\t\tbreak;\nnet/mac80211/debugfs_netdev.c:965:\tcase NL80211_IFTYPE_AP_VLAN:\nnet/mac80211/debugfs_netdev.c-966-\t\tadd_vlan_files(sdata);\n--\nnet/mac80211/driver-ops.c=57=int drv_add_interface(struct ieee80211_local *local,\n--\nnet/mac80211/driver-ops.c-64-\nnet/mac80211/driver-ops.c:65:\tif (WARN_ON(sdata-\u003evif.type == NL80211_IFTYPE_AP_VLAN ||\nnet/mac80211/driver-ops.c-66-\t\t    (sdata-\u003evif.type == NL80211_IFTYPE_MONITOR \u0026\u0026\n--\nnet/mac80211/driver-ops.h=25=get_bss_sdata(struct ieee80211_sub_if_data *sdata)\nnet/mac80211/driver-ops.h-26-{\nnet/mac80211/driver-ops.h:27:\tif (sdata \u0026\u0026 sdata-\u003evif.type == NL80211_IFTYPE_AP_VLAN)\nnet/mac80211/driver-ops.h-28-\t\tsdata = container_of(sdata-\u003ebss, struct ieee80211_sub_if_data,\n--\nnet/mac80211/he.c=13=ieee80211_update_from_he_6ghz_capa(const struct ieee80211_he_6ghz_capa *he_6ghz_capa,\n--\nnet/mac80211/he.c-19-\tif (sta-\u003esdata-\u003evif.type == NL80211_IFTYPE_AP ||\nnet/mac80211/he.c:20:\t    sta-\u003esdata-\u003evif.type == NL80211_IFTYPE_AP_VLAN) {\nnet/mac80211/he.c-21-\t\tswitch (le16_get_bits(he_6ghz_capa-\u003ecapa,\n--\nnet/mac80211/ht.c=138=bool ieee80211_ht_cap_ie_to_sta_ht_cap(struct ieee80211_sub_if_data *sdata,\n--\nnet/mac80211/ht.c-256-\tif (sta-\u003esdata-\u003evif.type == NL80211_IFTYPE_AP ||\nnet/mac80211/ht.c:257:\t    sta-\u003esdata-\u003evif.type == NL80211_IFTYPE_AP_VLAN ||\nnet/mac80211/ht.c-258-\t    sta-\u003esdata-\u003evif.type == NL80211_IFTYPE_NAN ||\n--\nnet/mac80211/ieee80211_i.h=1954=void ieee80211_vif_unblock_queues_csa(struct ieee80211_sub_if_data *sdata);\n--\nnet/mac80211/ieee80211_i.h-1957- * interface. It returns -1 if that number is not tracked, that is for netdevs\nnet/mac80211/ieee80211_i.h:1958: * not in AP or AP_VLAN mode or when using 4addr.\nnet/mac80211/ieee80211_i.h-1959- */\n--\nnet/mac80211/ieee80211_i.h=1961=ieee80211_vif_get_num_mcast_if(struct ieee80211_sub_if_data *sdata)\n--\nnet/mac80211/ieee80211_i.h-1964-\t\treturn atomic_read(\u0026sdata-\u003eu.ap.num_mcast_sta);\nnet/mac80211/ieee80211_i.h:1965:\tif (sdata-\u003evif.type == NL80211_IFTYPE_AP_VLAN \u0026\u0026 !sdata-\u003eu.vlan.sta)\nnet/mac80211/ieee80211_i.h-1966-\t\treturn atomic_read(\u0026sdata-\u003eu.vlan.num_mcast_sta);\n--\nnet/mac80211/ieee80211_i.h=2306=ieee80211_mgmt_ba(struct sk_buff *skb, const u8 *da,\n--\nnet/mac80211/ieee80211_i.h-2314-\tif (sdata-\u003evif.type == NL80211_IFTYPE_AP ||\nnet/mac80211/ieee80211_i.h:2315:\t    sdata-\u003evif.type == NL80211_IFTYPE_AP_VLAN ||\nnet/mac80211/ieee80211_i.h-2316-\t    sdata-\u003evif.type == NL80211_IFTYPE_MESH_POINT)\n--\nnet/mac80211/iface.c=329=static inline int identical_mac_addr_allowed(int type1, int type2)\n--\nnet/mac80211/iface.c-334-\t\ttype2 == NL80211_IFTYPE_P2P_DEVICE ||\nnet/mac80211/iface.c:335:\t\t(type1 == NL80211_IFTYPE_AP \u0026\u0026 type2 == NL80211_IFTYPE_AP_VLAN) ||\nnet/mac80211/iface.c:336:\t\t(type1 == NL80211_IFTYPE_AP_VLAN \u0026\u0026\nnet/mac80211/iface.c-337-\t\t\t(type2 == NL80211_IFTYPE_AP ||\nnet/mac80211/iface.c:338:\t\t\t type2 == NL80211_IFTYPE_AP_VLAN));\nnet/mac80211/iface.c-339-}\n--\nnet/mac80211/iface.c=341=static int ieee80211_check_concurrent_iface(struct ieee80211_sub_if_data *sdata,\n--\nnet/mac80211/iface.c-414-\t\t\t */\nnet/mac80211/iface.c:415:\t\t\tif (iftype == NL80211_IFTYPE_AP_VLAN \u0026\u0026\nnet/mac80211/iface.c-416-\t\t\t    nsdata-\u003evif.type == NL80211_IFTYPE_AP)\n--\nnet/mac80211/iface.c=479=static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, bool going_down)\n--\nnet/mac80211/iface.c-513-\t\tbreak;\nnet/mac80211/iface.c:514:\tcase NL80211_IFTYPE_AP_VLAN:\nnet/mac80211/iface.c-515-\t\tieee80211_apvlan_link_clear(sdata);\n--\nnet/mac80211/iface.c-530-\t *\nnet/mac80211/iface.c:531:\t * For AP_VLANs, NAN and NAN_DATA stations may exist since there's\nnet/mac80211/iface.c-532-\t * nothing else that would have removed them, but in other modes there\n--\nnet/mac80211/iface.c-535-\tflushed = sta_info_flush(sdata, -1);\nnet/mac80211/iface.c:536:\tWARN_ON_ONCE(sdata-\u003evif.type != NL80211_IFTYPE_AP_VLAN \u0026\u0026\nnet/mac80211/iface.c-537-\t\t     sdata-\u003evif.type != NL80211_IFTYPE_NAN \u0026\u0026\n--\nnet/mac80211/iface.c-588-\t\tWARN_ON(!list_empty(\u0026sdata-\u003eu.ap.vlans));\nnet/mac80211/iface.c:589:\t} else if (sdata-\u003evif.type == NL80211_IFTYPE_AP_VLAN) {\nnet/mac80211/iface.c-590-\t\t/* remove all packets in parent bc_buf pointing to this dev */\n--\nnet/mac80211/iface.c-613-\tswitch (sdata-\u003evif.type) {\nnet/mac80211/iface.c:614:\tcase NL80211_IFTYPE_AP_VLAN:\nnet/mac80211/iface.c-615-\t\tlist_del(\u0026sdata-\u003eu.vlan.list);\n--\nnet/mac80211/iface.c-710-\nnet/mac80211/iface.c:711:\tif (sdata-\u003evif.type == NL80211_IFTYPE_AP_VLAN)\nnet/mac80211/iface.c-712-\t\tieee80211_txq_remove_vlan(local, sdata);\n--\nnet/mac80211/iface.c-743-\tswitch (sdata-\u003evif.type) {\nnet/mac80211/iface.c:744:\tcase NL80211_IFTYPE_AP_VLAN:\nnet/mac80211/iface.c-745-\t\tbreak;\n--\nnet/mac80211/iface.c=989=static int ieee80211_netdev_fill_forward_path(struct net_device_path_ctx *ctx,\n--\nnet/mac80211/iface.c-1004-\tswitch (sdata-\u003evif.type) {\nnet/mac80211/iface.c:1005:\tcase NL80211_IFTYPE_AP_VLAN:\nnet/mac80211/iface.c-1006-\t\tsta = rcu_dereference(sdata-\u003eu.vlan.sta);\n--\nnet/mac80211/iface.c=1110=static void ieee80211_set_vif_encap_ops(struct ieee80211_sub_if_data *sdata)\n--\nnet/mac80211/iface.c-1115-\nnet/mac80211/iface.c:1116:\tif (sdata-\u003evif.type == NL80211_IFTYPE_AP_VLAN) {\nnet/mac80211/iface.c-1117-\t\tif (!sdata-\u003ebss)\n--\nnet/mac80211/iface.c=1136=static void ieee80211_recalc_sdata_offload(struct ieee80211_sub_if_data *sdata)\n--\nnet/mac80211/iface.c-1146-\tlist_for_each_entry(vsdata, \u0026local-\u003einterfaces, list) {\nnet/mac80211/iface.c:1147:\t\tif (vsdata-\u003evif.type != NL80211_IFTYPE_AP_VLAN ||\nnet/mac80211/iface.c-1148-\t\t    vsdata-\u003ebss != \u0026sdata-\u003eu.ap)\n--\nnet/mac80211/iface.c=1365=int ieee80211_do_open(struct wireless_dev *wdev, bool coming_up)\n--\nnet/mac80211/iface.c-1376-\tswitch (sdata-\u003evif.type) {\nnet/mac80211/iface.c:1377:\tcase NL80211_IFTYPE_AP_VLAN: {\nnet/mac80211/iface.c-1378-\t\tstruct ieee80211_sub_if_data *master;\n--\nnet/mac80211/iface.c-1438-\t\t\t/*\nnet/mac80211/iface.c:1439:\t\t\t * no need to worry about AP_VLAN/NAN_DATA cleanup since\nnet/mac80211/iface.c-1440-\t\t\t * in that case we can't have open_count == 0\n--\nnet/mac80211/iface.c-1465-\tswitch (sdata-\u003evif.type) {\nnet/mac80211/iface.c:1466:\tcase NL80211_IFTYPE_AP_VLAN:\nnet/mac80211/iface.c-1467-\t\t/* no need to tell driver, but set carrier and chanctx */\n--\nnet/mac80211/iface.c-1609-\t\tRCU_INIT_POINTER(sdata-\u003eu.nan_data.nmi, NULL);\nnet/mac80211/iface.c:1610:\tif (sdata-\u003evif.type == NL80211_IFTYPE_AP_VLAN)\nnet/mac80211/iface.c-1611-\t\tlist_del(\u0026sdata-\u003eu.vlan.list);\n--\nnet/mac80211/iface.c=1878=static void ieee80211_setup_sdata(struct ieee80211_sub_if_data *sdata,\n--\nnet/mac80211/iface.c-1959-\t\tbreak;\nnet/mac80211/iface.c:1960:\tcase NL80211_IFTYPE_AP_VLAN:\nnet/mac80211/iface.c-1961-\tcase NL80211_IFTYPE_P2P_DEVICE:\n--\nnet/mac80211/iface.c=2099=static void ieee80211_assign_perm_addr(struct ieee80211_local *local,\n--\nnet/mac80211/iface.c-2120-\t\tbreak;\nnet/mac80211/iface.c:2121:\tcase NL80211_IFTYPE_AP_VLAN:\nnet/mac80211/iface.c-2122-\t\t/* match up with an AP interface */\n--\nnet/mac80211/iface.c=2228=int ieee80211_if_add(struct ieee80211_local *local, const char *name,\n--\nnet/mac80211/iface.c-2280-\nnet/mac80211/iface.c:2281:\t\tif (type != NL80211_IFTYPE_AP_VLAN \u0026\u0026\nnet/mac80211/iface.c-2282-\t\t    (type != NL80211_IFTYPE_MONITOR ||\n--\nnet/mac80211/iface.c=2535=void ieee80211_vif_inc_num_mcast(struct ieee80211_sub_if_data *sdata)\n--\nnet/mac80211/iface.c-2538-\t\tatomic_inc(\u0026sdata-\u003eu.ap.num_mcast_sta);\nnet/mac80211/iface.c:2539:\telse if (sdata-\u003evif.type == NL80211_IFTYPE_AP_VLAN)\nnet/mac80211/iface.c-2540-\t\tatomic_inc(\u0026sdata-\u003eu.vlan.num_mcast_sta);\n--\nnet/mac80211/iface.c=2543=void ieee80211_vif_dec_num_mcast(struct ieee80211_sub_if_data *sdata)\n--\nnet/mac80211/iface.c-2546-\t\tatomic_dec(\u0026sdata-\u003eu.ap.num_mcast_sta);\nnet/mac80211/iface.c:2547:\telse if (sdata-\u003evif.type == NL80211_IFTYPE_AP_VLAN)\nnet/mac80211/iface.c-2548-\t\tatomic_dec(\u0026sdata-\u003eu.vlan.num_mcast_sta);\n--\nnet/mac80211/key.c=120=static int ieee80211_key_enable_hw_accel(struct ieee80211_key *key)\n--\nnet/mac80211/key.c-165-\nnet/mac80211/key.c:166:\tif (sdata-\u003evif.type == NL80211_IFTYPE_AP_VLAN) {\nnet/mac80211/key.c-167-\t\t/*\n--\nnet/mac80211/key.c=350=static void __ieee80211_set_default_key(struct ieee80211_link_data *link,\n--\nnet/mac80211/key.c-368-\t\tieee80211_check_fast_xmit_iface(sdata);\nnet/mac80211/key.c:369:\t\tif (sdata-\u003evif.type != NL80211_IFTYPE_AP_VLAN)\nnet/mac80211/key.c-370-\t\t\tdrv_set_default_unicast_key(sdata-\u003elocal, sdata, idx);\n--\nnet/mac80211/key.c=1139=void ieee80211_free_keys(struct ieee80211_sub_if_data *sdata,\n--\nnet/mac80211/key.c-1164-\nnet/mac80211/key.c:1165:\tif (sdata-\u003evif.type == NL80211_IFTYPE_AP_VLAN) {\nnet/mac80211/key.c-1166-\t\tif (sdata-\u003ebss) {\n--\nnet/mac80211/link.c=95=void ieee80211_link_init(struct ieee80211_sub_if_data *sdata,\n--\nnet/mac80211/link.c-104-\nnet/mac80211/link.c:105:\tif (sdata-\u003evif.type == NL80211_IFTYPE_AP_VLAN) {\nnet/mac80211/link.c-106-\t\tstruct ieee80211_sub_if_data *ap_bss;\n--\nnet/mac80211/link.c-141-\t\tcase NL80211_IFTYPE_AP:\nnet/mac80211/link.c:142:\t\tcase NL80211_IFTYPE_AP_VLAN:\nnet/mac80211/link.c-143-\t\t\tether_addr_copy(link_conf-\u003eaddr,\n--\nnet/mac80211/link.c=251=static void ieee80211_set_vif_links_bitmaps(struct ieee80211_sub_if_data *sdata,\n--\nnet/mac80211/link.c-268-\tcase NL80211_IFTYPE_AP:\nnet/mac80211/link.c:269:\tcase NL80211_IFTYPE_AP_VLAN:\nnet/mac80211/link.c-270-\t\t/* in an AP all links are always active */\n--\nnet/mac80211/link.c=287=static int ieee80211_vif_update_links(struct ieee80211_sub_if_data *sdata,\n--\nnet/mac80211/link.c-377-\t\t/* tell the driver */\nnet/mac80211/link.c:378:\t\tif (sdata-\u003evif.type != NL80211_IFTYPE_AP_VLAN)\nnet/mac80211/link.c-379-\t\t\tret = drv_change_vif_links(sdata-\u003elocal, sdata,\n--\nnet/mac80211/main.c=96=static u32 ieee80211_calc_hw_conf_chan(struct ieee80211_local *local,\n--\nnet/mac80211/main.c-176-\t\t\tcontinue;\nnet/mac80211/main.c:177:\t\tif (sdata-\u003evif.type == NL80211_IFTYPE_AP_VLAN)\nnet/mac80211/main.c-178-\t\t\tcontinue;\n--\nnet/mac80211/main.c=336=void ieee80211_bss_info_change_notify(struct ieee80211_sub_if_data *sdata,\n--\nnet/mac80211/main.c-344-\nnet/mac80211/main.c:345:\tif (!changed || sdata-\u003evif.type == NL80211_IFTYPE_AP_VLAN)\nnet/mac80211/main.c-346-\t\treturn;\n--\nnet/mac80211/main.c=389=void ieee80211_vif_cfg_change_notify(struct ieee80211_sub_if_data *sdata,\n--\nnet/mac80211/main.c-395-\nnet/mac80211/main.c:396:\tif (!changed || sdata-\u003evif.type == NL80211_IFTYPE_AP_VLAN)\nnet/mac80211/main.c-397-\t\treturn;\n--\nnet/mac80211/main.c=402=void ieee80211_link_info_change_notify(struct ieee80211_sub_if_data *sdata,\n--\nnet/mac80211/main.c-413-\tswitch (sdata-\u003evif.type) {\nnet/mac80211/main.c:414:\tcase NL80211_IFTYPE_AP_VLAN:\nnet/mac80211/main.c-415-\t\treturn;\n--\nnet/mac80211/main.c=638=static int ieee80211_ifa6_changed(struct notifier_block *nb,\n--\nnet/mac80211/main.c-656-\t * For now only support station mode. This is mostly because\nnet/mac80211/main.c:657:\t * doing AP would have to handle AP_VLAN in some way ...\nnet/mac80211/main.c-658-\t */\n--\nnet/mac80211/main.c=670=ieee80211_default_mgmt_stypes[NUM_NL80211_IFTYPES] = {\n--\nnet/mac80211/main.c-705-\t},\nnet/mac80211/main.c:706:\t[NL80211_IFTYPE_AP_VLAN] = {\nnet/mac80211/main.c-707-\t\t/* copy AP */\n--\nnet/mac80211/main.c=1138=int ieee80211_register_hw(struct ieee80211_hw *hw)\n--\nnet/mac80211/main.c-1366-\t/* if low-level driver supports AP, we also support VLAN.\nnet/mac80211/main.c:1367:\t * drivers advertising SW_CRYPTO_CONTROL should enable AP_VLAN\nnet/mac80211/main.c-1368-\t * based on their support to transmit SW encrypted packets.\n--\nnet/mac80211/main.c-1371-\t    !ieee80211_hw_check(\u0026local-\u003ehw, SW_CRYPTO_CONTROL)) {\nnet/mac80211/main.c:1372:\t\thw-\u003ewiphy-\u003einterface_modes |= BIT(NL80211_IFTYPE_AP_VLAN);\nnet/mac80211/main.c:1373:\t\thw-\u003ewiphy-\u003esoftware_iftypes |= BIT(NL80211_IFTYPE_AP_VLAN);\nnet/mac80211/main.c-1374-\t}\n--\nnet/mac80211/offchannel.c=812=int ieee80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,\n--\nnet/mac80211/offchannel.c-850-\tcase NL80211_IFTYPE_AP:\nnet/mac80211/offchannel.c:851:\tcase NL80211_IFTYPE_AP_VLAN:\nnet/mac80211/offchannel.c-852-\tcase NL80211_IFTYPE_P2P_GO:\n--\nnet/mac80211/pm.c=21=int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)\n--\nnet/mac80211/pm.c-151-\t\tswitch (sdata-\u003evif.type) {\nnet/mac80211/pm.c:152:\t\tcase NL80211_IFTYPE_AP_VLAN:\nnet/mac80211/pm.c-153-\t\tcase NL80211_IFTYPE_MONITOR:\n--\nnet/mac80211/rx.c=1681=static void sta_ps_start(struct sta_info *sta)\n--\nnet/mac80211/rx.c-1688-\tif (sta-\u003esdata-\u003evif.type == NL80211_IFTYPE_AP ||\nnet/mac80211/rx.c:1689:\t    sta-\u003esdata-\u003evif.type == NL80211_IFTYPE_AP_VLAN)\nnet/mac80211/rx.c-1690-\t\tps = \u0026sdata-\u003ebss-\u003eps;\n--\nnet/mac80211/rx.c=1806=ieee80211_rx_h_uapsd_and_pspoll(struct ieee80211_rx_data *rx)\n--\nnet/mac80211/rx.c-1815-\tif (sdata-\u003evif.type != NL80211_IFTYPE_AP \u0026\u0026\nnet/mac80211/rx.c:1816:\t    sdata-\u003evif.type != NL80211_IFTYPE_AP_VLAN)\nnet/mac80211/rx.c-1817-\t\treturn RX_CONTINUE;\n--\nnet/mac80211/rx.c=1857=ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)\n--\nnet/mac80211/rx.c-1941-\t    (rx-\u003esdata-\u003evif.type == NL80211_IFTYPE_AP ||\nnet/mac80211/rx.c:1942:\t     rx-\u003esdata-\u003evif.type == NL80211_IFTYPE_AP_VLAN)) {\nnet/mac80211/rx.c-1943-\t\tif (test_sta_flag(sta, WLAN_STA_PS_STA)) {\n--\nnet/mac80211/rx.c-1970-\t\t    (rx-\u003esdata-\u003evif.type == NL80211_IFTYPE_AP ||\nnet/mac80211/rx.c:1971:\t\t     (rx-\u003esdata-\u003evif.type == NL80211_IFTYPE_AP_VLAN \u0026\u0026\nnet/mac80211/rx.c-1972-\t\t      !rx-\u003esdata-\u003eu.vlan.sta))) {\n--\nnet/mac80211/rx.c=2646=__ieee80211_data_to_8023(struct ieee80211_rx_data *rx, bool *port_control)\n--\nnet/mac80211/rx.c-2655-\tif (ieee80211_has_a4(hdr-\u003eframe_control) \u0026\u0026\nnet/mac80211/rx.c:2656:\t    sdata-\u003evif.type == NL80211_IFTYPE_AP_VLAN \u0026\u0026 !sdata-\u003eu.vlan.sta)\nnet/mac80211/rx.c-2657-\t\treturn RX_DROP_U_UNEXPECTED_VLAN_4ADDR;\n--\nnet/mac80211/rx.c-2667-\tif (is_multicast_ether_addr(hdr-\u003eaddr1) \u0026\u0026\nnet/mac80211/rx.c:2668:\t    sdata-\u003evif.type == NL80211_IFTYPE_AP_VLAN \u0026\u0026 sdata-\u003eu.vlan.sta)\nnet/mac80211/rx.c-2669-\t\treturn RX_DROP_U_UNEXPECTED_VLAN_MCAST;\n--\nnet/mac80211/rx.c=2789=ieee80211_deliver_skb(struct ieee80211_rx_data *rx)\n--\nnet/mac80211/rx.c-2813-\tif ((sdata-\u003evif.type == NL80211_IFTYPE_AP ||\nnet/mac80211/rx.c:2814:\t     sdata-\u003evif.type == NL80211_IFTYPE_AP_VLAN) \u0026\u0026\nnet/mac80211/rx.c-2815-\t    !(sdata-\u003eflags \u0026 IEEE80211_SDATA_DONT_BRIDGE_PACKETS) \u0026\u0026\nnet/mac80211/rx.c-2816-\t    ehdr-\u003eh_proto != rx-\u003esdata-\u003econtrol_port_protocol \u0026\u0026\nnet/mac80211/rx.c:2817:\t    (sdata-\u003evif.type != NL80211_IFTYPE_AP_VLAN || !sdata-\u003eu.vlan.sta)) {\nnet/mac80211/rx.c-2818-\t\tif (is_multicast_ether_addr(ehdr-\u003eh_dest) \u0026\u0026\n--\nnet/mac80211/rx.c=3140=__ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx, u8 data_offset)\n--\nnet/mac80211/rx.c-3154-\t\tcase NL80211_IFTYPE_AP:\nnet/mac80211/rx.c:3155:\t\tcase NL80211_IFTYPE_AP_VLAN:\nnet/mac80211/rx.c-3156-\t\t\tcheck_da = NULL;\n--\nnet/mac80211/rx.c=3226=ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)\n--\nnet/mac80211/rx.c-3243-\t\tswitch (rx-\u003esdata-\u003evif.type) {\nnet/mac80211/rx.c:3244:\t\tcase NL80211_IFTYPE_AP_VLAN:\nnet/mac80211/rx.c-3245-\t\t\tif (!rx-\u003esdata-\u003eu.vlan.sta)\n--\nnet/mac80211/rx.c=3283=ieee80211_rx_h_data(struct ieee80211_rx_data *rx)\n--\nnet/mac80211/rx.c-3338-\nnet/mac80211/rx.c:3339:\tif (rx-\u003esdata-\u003evif.type == NL80211_IFTYPE_AP_VLAN \u0026\u0026\nnet/mac80211/rx.c-3340-\t    unlikely(port_control) \u0026\u0026 sdata-\u003ebss) {\n--\nnet/mac80211/rx.c=3623=ieee80211_rx_h_action(struct ieee80211_rx_data *rx)\n--\nnet/mac80211/rx.c-3649-\t\t    sdata-\u003evif.type != NL80211_IFTYPE_MESH_POINT \u0026\u0026\nnet/mac80211/rx.c:3650:\t\t    sdata-\u003evif.type != NL80211_IFTYPE_AP_VLAN \u0026\u0026\nnet/mac80211/rx.c-3651-\t\t    sdata-\u003evif.type != NL80211_IFTYPE_AP \u0026\u0026\n--\nnet/mac80211/rx.c-3665-\t\t\tif (sdata-\u003evif.type != NL80211_IFTYPE_AP \u0026\u0026\nnet/mac80211/rx.c:3666:\t\t\t    sdata-\u003evif.type != NL80211_IFTYPE_AP_VLAN)\nnet/mac80211/rx.c-3667-\t\t\t\tgoto handled;\n--\nnet/mac80211/rx.c-3739-\t\t    sdata-\u003evif.type != NL80211_IFTYPE_MESH_POINT \u0026\u0026\nnet/mac80211/rx.c:3740:\t\t    sdata-\u003evif.type != NL80211_IFTYPE_AP_VLAN \u0026\u0026\nnet/mac80211/rx.c-3741-\t\t    sdata-\u003evif.type != NL80211_IFTYPE_AP \u0026\u0026\n--\nnet/mac80211/rx.c-3767-\t\t    sdata-\u003evif.type != NL80211_IFTYPE_MESH_POINT \u0026\u0026\nnet/mac80211/rx.c:3768:\t\t    sdata-\u003evif.type != NL80211_IFTYPE_AP_VLAN \u0026\u0026\nnet/mac80211/rx.c-3769-\t\t    sdata-\u003evif.type != NL80211_IFTYPE_AP \u0026\u0026\n--\nnet/mac80211/rx.c=4071=ieee80211_rx_h_action_return(struct ieee80211_rx_data *rx)\n--\nnet/mac80211/rx.c-4092-\t    (sdata-\u003evif.type == NL80211_IFTYPE_AP ||\nnet/mac80211/rx.c:4093:\t     sdata-\u003evif.type == NL80211_IFTYPE_AP_VLAN))\nnet/mac80211/rx.c-4094-\t\treturn RX_DROP_U_MALFORMED_ACTION;\n--\nnet/mac80211/rx.c=4506=static bool ieee80211_accept_frame(struct ieee80211_rx_data *rx)\n--\nnet/mac80211/rx.c-4582-\t\treturn ether_addr_equal(sdata-\u003evif.addr, hdr-\u003eaddr1);\nnet/mac80211/rx.c:4583:\tcase NL80211_IFTYPE_AP_VLAN:\nnet/mac80211/rx.c-4584-\tcase NL80211_IFTYPE_AP:\n--\nnet/mac80211/rx.c=4713=void ieee80211_check_fast_rx(struct sta_info *sta)\n--\nnet/mac80211/rx.c-4772-\t\tbreak;\nnet/mac80211/rx.c:4773:\tcase NL80211_IFTYPE_AP_VLAN:\nnet/mac80211/rx.c-4774-\tcase NL80211_IFTYPE_AP:\n--\nnet/mac80211/rx.c-4785-\t\t\t!(sdata-\u003eflags \u0026 IEEE80211_SDATA_DONT_BRIDGE_PACKETS) \u0026\u0026\nnet/mac80211/rx.c:4786:\t\t\t(sdata-\u003evif.type != NL80211_IFTYPE_AP_VLAN ||\nnet/mac80211/rx.c-4787-\t\t\t !sdata-\u003eu.vlan.sta);\nnet/mac80211/rx.c-4788-\nnet/mac80211/rx.c:4789:\t\tif (sdata-\u003evif.type == NL80211_IFTYPE_AP_VLAN \u0026\u0026\nnet/mac80211/rx.c-4790-\t\t    sdata-\u003eu.vlan.sta) {\n--\nnet/mac80211/rx.c=5348=static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,\n--\nnet/mac80211/rx.c-5491-\t\tif (sdata-\u003evif.type == NL80211_IFTYPE_MONITOR ||\nnet/mac80211/rx.c:5492:\t\t    sdata-\u003evif.type == NL80211_IFTYPE_AP_VLAN)\nnet/mac80211/rx.c-5493-\t\t\tcontinue;\n--\nnet/mac80211/sta_info.c=132=static void __cleanup_single_sta(struct sta_info *sta)\n--\nnet/mac80211/sta_info.c-143-\t\tif (sta-\u003esdata-\u003evif.type == NL80211_IFTYPE_AP ||\nnet/mac80211/sta_info.c:144:\t\t    sta-\u003esdata-\u003evif.type == NL80211_IFTYPE_AP_VLAN)\nnet/mac80211/sta_info.c-145-\t\t\tps = \u0026sdata-\u003ebss-\u003eps;\n--\nnet/mac80211/sta_info.c=1100=static void __sta_info_recalc_tim(struct sta_info *sta, bool ignore_pending)\n--\nnet/mac80211/sta_info.c-1109-\tif (sta-\u003esdata-\u003evif.type == NL80211_IFTYPE_AP ||\nnet/mac80211/sta_info.c:1110:\t    sta-\u003esdata-\u003evif.type == NL80211_IFTYPE_AP_VLAN) {\nnet/mac80211/sta_info.c-1111-\t\tif (WARN_ON_ONCE(!sta-\u003esdata-\u003ebss))\n--\nnet/mac80211/sta_info.c=1303=static int __must_check __sta_info_destroy_part1(struct sta_info *sta)\n--\nnet/mac80211/sta_info.c-1380-\nnet/mac80211/sta_info.c:1381:\tif (sdata-\u003evif.type == NL80211_IFTYPE_AP_VLAN \u0026\u0026\nnet/mac80211/sta_info.c-1382-\t    rcu_access_pointer(sdata-\u003eu.vlan.sta) == sta)\n--\nnet/mac80211/sta_info.c=1388=static int _sta_info_move_state(struct sta_info *sta,\n--\nnet/mac80211/sta_info.c-1505-\t\t}\nnet/mac80211/sta_info.c:1506:\t\tif (sta-\u003esdata-\u003evif.type == NL80211_IFTYPE_AP_VLAN ||\nnet/mac80211/sta_info.c-1507-\t\t    sta-\u003esdata-\u003evif.type == NL80211_IFTYPE_AP)\n--\nnet/mac80211/sta_info.c=1820=void ieee80211_sta_ps_deliver_wakeup(struct sta_info *sta)\n--\nnet/mac80211/sta_info.c-1828-\nnet/mac80211/sta_info.c:1829:\tif (sdata-\u003evif.type == NL80211_IFTYPE_AP_VLAN)\nnet/mac80211/sta_info.c-1830-\t\tsdata = container_of(sdata-\u003ebss, struct ieee80211_sub_if_data,\n--\nnet/mac80211/sta_info.c=3679=ieee80211_sta_usable_bw(struct link_sta_info *link_sta,\n--\nnet/mac80211/sta_info.c-3687-\nnet/mac80211/sta_info.c:3688:\tif (sdata-\u003evif.type == NL80211_IFTYPE_AP_VLAN) {\nnet/mac80211/sta_info.c-3689-\t\tsdata = get_bss_sdata(sdata);\n--\nnet/mac80211/tkip.c=239=int ieee80211_tkip_decrypt_data(struct arc4_ctx *ctx,\n--\nnet/mac80211/tkip.c-298-\nnet/mac80211/tkip.c:299:\t\tif (sdata-\u003evif.type == NL80211_IFTYPE_AP_VLAN)\nnet/mac80211/tkip.c-300-\t\t\tsdata = container_of(key-\u003esdata-\u003ebss,\n--\nnet/mac80211/tx.c=378=ieee80211_tx_h_multicast_ps_buf(struct ieee80211_tx_data *tx)\n--\nnet/mac80211/tx.c-393-\tif (tx-\u003esdata-\u003evif.type == NL80211_IFTYPE_AP ||\nnet/mac80211/tx.c:394:\t    tx-\u003esdata-\u003evif.type == NL80211_IFTYPE_AP_VLAN) {\nnet/mac80211/tx.c-395-\t\tif (!tx-\u003esdata-\u003ebss)\n--\nnet/mac80211/tx.c=1208=ieee80211_tx_prepare(struct ieee80211_sub_if_data *sdata,\n--\nnet/mac80211/tx.c-1236-\t} else {\nnet/mac80211/tx.c:1237:\t\tif (sdata-\u003evif.type == NL80211_IFTYPE_AP_VLAN) {\nnet/mac80211/tx.c-1238-\t\t\ttx-\u003esta = rcu_dereference(sdata-\u003eu.vlan.sta);\n--\nnet/mac80211/tx.c=1483=void ieee80211_txq_remove_vlan(struct ieee80211_local *local,\n--\nnet/mac80211/tx.c-1490-\nnet/mac80211/tx.c:1491:\tif (WARN_ON(sdata-\u003evif.type != NL80211_IFTYPE_AP_VLAN))\nnet/mac80211/tx.c-1492-\t\treturn;\n--\nnet/mac80211/tx.c=1651=static bool ieee80211_queue_skb(struct ieee80211_local *local,\n--\nnet/mac80211/tx.c-1661-\nnet/mac80211/tx.c:1662:\tif (sdata-\u003evif.type == NL80211_IFTYPE_AP_VLAN)\n\n"
}

gemini-3.1-pro-preview

null

null

							input: 25819
							output: 34
							thoughts: 191
						

**Investigating AP_VLAN Configuration**

Okay, so I'm looking at this and the interface type being used is AP_VLAN. My initial thought is, "Alright, does this AP_VLAN type have any specific configuration options I need to be aware of?" My mind immediately jumps to checking for a dedicated config. Hang on, *NL80211_IFTYPE_AP_VLAN*...that's just an enum value, isn't it? Right. Okay, so I should be looking at the actual configuration files. I'll need to dig into `net/wireless/Kconfig` or maybe even `net/mac80211/Kconfig`.

Wait a minute, AP_VLAN support is pretty standard in mac80211, *if* AP support is enabled to begin with, so I don't think there's a unique setting. Let me just confirm that by going back and checking `net/mac80211/Kconfig`. Ah, nope, nothing specific for AP_VLAN. Interesting. So, does *AP* itself have a configuration option? No, mac80211 supports AP mode by default. Hmm.

Right, so what's the core here? *MAC80211* is the primary configuration, obviously. But are there any other settings that might indirectly affect AP_VLAN behavior? I should probably broaden my search. Let me scan `net/wireless/Kconfig` and see if anything else jumps out.

{
  "Expression": "config CFG80211",
  "PathPrefix": "net/wireless/Kconfig"
}

{
  "Output": "net/wireless/Kconfig=14=config WEXT_PRIV\n--\nnet/wireless/Kconfig-16-\nnet/wireless/Kconfig:17:config CFG80211\nnet/wireless/Kconfig-18-\ttristate \"cfg80211 - wireless configuration API\"\n--\nnet/wireless/Kconfig=38=config NL80211_TESTMODE\n--\nnet/wireless/Kconfig-51-\nnet/wireless/Kconfig:52:config CFG80211_DEVELOPER_WARNINGS\nnet/wireless/Kconfig-53-\tbool \"enable developer warnings\"\n--\nnet/wireless/Kconfig-67-\nnet/wireless/Kconfig:68:config CFG80211_CERTIFICATION_ONUS\nnet/wireless/Kconfig-69-\tbool \"cfg80211 certification onus\"\n--\nnet/wireless/Kconfig-88-\nnet/wireless/Kconfig:89:config CFG80211_REQUIRE_SIGNED_REGDB\nnet/wireless/Kconfig-90-\tbool \"require regdb signature\" if CFG80211_CERTIFICATION_ONUS\n--\nnet/wireless/Kconfig-98-\nnet/wireless/Kconfig:99:config CFG80211_USE_KERNEL_REGDB_KEYS\nnet/wireless/Kconfig-100-\tbool \"allow regdb keys shipped with the kernel\" if CFG80211_CERTIFICATION_ONUS\n--\nnet/wireless/Kconfig-110-\nnet/wireless/Kconfig:111:config CFG80211_EXTRA_REGDB_KEYDIR\nnet/wireless/Kconfig-112-\tstring \"additional regdb key directory\" if CFG80211_CERTIFICATION_ONUS\n--\nnet/wireless/Kconfig-121-\nnet/wireless/Kconfig:122:config CFG80211_REG_CELLULAR_HINTS\nnet/wireless/Kconfig-123-\tbool \"cfg80211 regulatory support for cellular base station hints\"\n--\nnet/wireless/Kconfig-134-\nnet/wireless/Kconfig:135:config CFG80211_REG_RELAX_NO_IR\nnet/wireless/Kconfig-136-\tbool \"cfg80211 support for NO_IR relaxation\"\n--\nnet/wireless/Kconfig-158-\nnet/wireless/Kconfig:159:config CFG80211_DEFAULT_PS\nnet/wireless/Kconfig-160-\tbool \"enable powersave by default\"\n--\nnet/wireless/Kconfig-168-\nnet/wireless/Kconfig:169:config CFG80211_DEBUGFS\nnet/wireless/Kconfig-170-\tbool \"cfg80211 DebugFS entries\"\n--\nnet/wireless/Kconfig-176-\nnet/wireless/Kconfig:177:config CFG80211_CRDA_SUPPORT\nnet/wireless/Kconfig-178-\tbool \"support CRDA\" if EXPERT\n--\nnet/wireless/Kconfig-186-\nnet/wireless/Kconfig:187:config CFG80211_WEXT\nnet/wireless/Kconfig-188-\tbool \"cfg80211 wireless extensions compatibility\"\n--\nnet/wireless/Kconfig-193-\nnet/wireless/Kconfig:194:config CFG80211_KUNIT_TEST\nnet/wireless/Kconfig-195-\ttristate \"KUnit tests for cfg80211\" if !KUNIT_ALL_TESTS\n"
}

gemini-3.1-pro-preview

null

null

							input: 27288
							output: 134
							thoughts: 243
						

**My Analysis of MAC80211 and Potential Fuzzing Targets**

Okay, so I'm diving into the `MAC80211` configuration, and my initial thought is that `ieee80211_do_stop` is a key focus point. It feels like this could be an interesting function to investigate. Hold on... it's a static function. That initially throws a wrench in the works, but then I remember netlink commands can be used to stop the interface, potentially triggering it. So, that's promising; it *could* be fuzzed.

Now, let's explore this further. Is there another function directly related? Ah, yes, `ieee80211_stop` calls `ieee80211_do_stop`. But, again, because `ieee80211_do_stop` is static, inlining is a possibility. However, it looks fairly substantial. Given its size, it probably isn't.

I need to make sure I'm on the right track here. Is `ieee80211_do_stop` really the best focus symbol? Let's check where it's called. Okay, it's called from `ieee80211_stop`, `ieee80211_runtime_change_iftype`, and `ieee80211_sdata_stop`. I think I will list `ieee80211_do_stop` and `ieee80211_stop` as potential fuzzing targets.

{
  "EnableConfigs": [
    "MAC80211"
  ],
  "FocusSymbols": [
    "ieee80211_do_stop",
    "ieee80211_stop"
  ],
  "Reasoning": "The patch modifies the interface stop logic for AP_VLAN interfaces in mac80211, changing how packets are freed to avoid doing so under a spinlock. This is a functional change in the core mac80211 stack that is reachable via netlink commands (e.g., stopping an AP_VLAN interface).",
  "WorthFuzzing": true
}

{
  "EnableConfigs": [
    "MAC80211"
  ],
  "FocusSymbols": [
    "ieee80211_do_stop",
    "ieee80211_stop"
  ],
  "Reasoning": "The patch modifies the interface stop logic for AP_VLAN interfaces in mac80211, changing how packets are freed to avoid doing so under a spinlock. This is a functional change in the core mac80211 stack that is reachable via netlink commands (e.g., stopping an AP_VLAN interface).",
  "WorthFuzzing": true
}