AI Trajectory

null

{
  "EnableConfigs": [
    "BRCMFMAC",
    "BRCMFMAC_USB"
  ],
  "FocusSymbols": [
    "brcmf_cfg80211_connect",
    "brcmf_set_key_mgmt",
    "brcmf_configure_wpaie",
    "brcmf_p2p_send_action_frame"
  ],
  "Reasoning": "The patch adds support for the WFA DPP AKM suite and DPP public action frames to the Broadcom FullMAC driver (brcmfmac). It modifies connection and AP setup paths to parse the new AKM and handle SAE/FWSUP correctly, as well as the P2P action frame transmission path. These changes are reachable from user space via nl80211 commands (e.g., connect, start_ap, mgmt_tx) when the driver is bound to an emulated USB device.",
  "WorthFuzzing": true
}

null

{
  "PatchDiff": "commit 5561d5a1f6fe5faa3eba7d552cd50ceb49159a17\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Wed Jul 15 15:47:27 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c\nindex 4b70845e1a2643..d61c3e03a106a5 100644\n--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c\n+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c\n@@ -8,6 +8,7 @@\n #include \u003clinux/kernel.h\u003e\n #include \u003clinux/etherdevice.h\u003e\n #include \u003clinux/module.h\u003e\n+#include \u003clinux/unaligned.h\u003e\n #include \u003clinux/vmalloc.h\u003e\n #include \u003cnet/cfg80211.h\u003e\n #include \u003cnet/netlink.h\u003e\n@@ -2154,6 +2155,9 @@ brcmf_set_key_mgmt(struct net_device *ndev, struct cfg80211_connect_params *sme)\n \t\t\tval = WPA2_AUTH_PSK | WPA2_AUTH_FT;\n \t\t\tprofile-\u003eis_ft = true;\n \t\t\tbreak;\n+\t\tcase WLAN_AKM_SUITE_WFA_DPP:\n+\t\t\tval = WFA_AUTH_DPP;\n+\t\t\tbreak;\n \t\tdefault:\n \t\t\tbphy_err(drvr, \"invalid akm suite (%d)\\n\",\n \t\t\t\t sme-\u003ecrypto.akm_suites[0]);\n@@ -2466,43 +2470,50 @@ brcmf_cfg80211_connect(struct wiphy *wiphy, struct net_device *ndev,\n \t\tgoto done;\n \t}\n \n-\tif (sme-\u003ecrypto.psk \u0026\u0026\n-\t    profile-\u003euse_fwsup != BRCMF_PROFILE_FWSUP_SAE) {\n-\t\tif (WARN_ON(profile-\u003euse_fwsup != BRCMF_PROFILE_FWSUP_NONE)) {\n-\t\t\terr = -EINVAL;\n-\t\t\tgoto done;\n-\t\t}\n-\t\tbrcmf_dbg(INFO, \"using PSK offload\\n\");\n-\t\tprofile-\u003euse_fwsup = BRCMF_PROFILE_FWSUP_PSK;\n-\t}\n-\n-\tif (profile-\u003euse_fwsup != BRCMF_PROFILE_FWSUP_NONE) {\n-\t\t/* enable firmware supplicant for this interface */\n-\t\terr = brcmf_fil_iovar_int_set(ifp, \"sup_wpa\", 1);\n-\t\tif (err \u003c 0) {\n-\t\t\tbphy_err(drvr, \"failed to enable fw supplicant\\n\");\n-\t\t\tgoto done;\n+\tif (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_FWSUP)) {\n+\t\tu32 akm = sme-\u003ecrypto.n_akm_suites ? sme-\u003ecrypto.akm_suites[0] : 0;\n+\t\tbool is_sae_akm = akm == WLAN_AKM_SUITE_SAE ||\n+\t\t\takm == WLAN_AKM_SUITE_FT_OVER_SAE;\n+\n+\t\tif (sme-\u003ecrypto.psk \u0026\u0026 !is_sae_akm \u0026\u0026\n+\t\t    profile-\u003euse_fwsup != BRCMF_PROFILE_FWSUP_SAE) {\n+\t\t\tif (WARN_ON(profile-\u003euse_fwsup !=\n+\t\t\t\t    BRCMF_PROFILE_FWSUP_NONE)) {\n+\t\t\t\terr = -EINVAL;\n+\t\t\t\tgoto done;\n+\t\t\t}\n+\t\t\tbrcmf_dbg(INFO, \"using PSK offload\\n\");\n+\t\t\tprofile-\u003euse_fwsup = BRCMF_PROFILE_FWSUP_PSK;\n \t\t}\n-\t}\n-\n-\tif (profile-\u003euse_fwsup == BRCMF_PROFILE_FWSUP_PSK)\n-\t\terr = brcmf_set_pmk(ifp, sme-\u003ecrypto.psk,\n-\t\t\t\t    BRCMF_WSEC_MAX_PSK_LEN);\n-\telse if (profile-\u003euse_fwsup == BRCMF_PROFILE_FWSUP_SAE) {\n-\t\t/* clean up user-space RSNE */\n-\t\terr = brcmf_fil_iovar_data_set(ifp, \"wpaie\", NULL, 0);\n-\t\tif (err) {\n-\t\t\tbphy_err(drvr, \"failed to clean up user-space RSNE\\n\");\n-\t\t\tgoto done;\n+\t\tif (profile-\u003euse_fwsup != BRCMF_PROFILE_FWSUP_NONE) {\n+\t\t\t/* enable firmware supplicant for this interface */\n+\t\t\terr = brcmf_fil_iovar_int_set(ifp, \"sup_wpa\", 1);\n+\t\t\tif (err \u003c 0) {\n+\t\t\t\tbphy_err(drvr, \"failed to enable fw supplicant\\n\");\n+\t\t\t\tgoto done;\n+\t\t\t}\n+\t\t} else {\n+\t\t\terr = brcmf_fil_iovar_int_set(ifp, \"sup_wpa\", 0);\n \t\t}\n-\t\terr = brcmf_fwvid_set_sae_password(ifp, \u0026sme-\u003ecrypto);\n-\t\tif (!err \u0026\u0026 sme-\u003ecrypto.psk)\n+\t\tif (profile-\u003euse_fwsup == BRCMF_PROFILE_FWSUP_PSK)\n \t\t\terr = brcmf_set_pmk(ifp, sme-\u003ecrypto.psk,\n \t\t\t\t\t    BRCMF_WSEC_MAX_PSK_LEN);\n+\t\telse if (profile-\u003euse_fwsup == BRCMF_PROFILE_FWSUP_SAE \u0026\u0026\n+\t\t\t sme-\u003ecrypto.sae_pwd \u0026\u0026\n+\t\t\t brcmf_feat_is_enabled(ifp, BRCMF_FEAT_SAE)) {\n+\t\t\t/* clean up user-space RSNE */\n+\t\t\tif (brcmf_fil_iovar_data_set(ifp, \"wpaie\", NULL, 0)) {\n+\t\t\t\tbphy_err(drvr, \"failed to clean up user-space RSNE\\n\");\n+\t\t\t\tgoto done;\n+\t\t\t}\n+\t\t\terr = brcmf_fwvid_set_sae_password(ifp, \u0026sme-\u003ecrypto);\n+\t\t\tif (!err \u0026\u0026 sme-\u003ecrypto.psk)\n+\t\t\t\terr = brcmf_set_pmk(ifp, sme-\u003ecrypto.psk,\n+\t\t\t\t\t\t    BRCMF_WSEC_MAX_PSK_LEN);\n+\t\t}\n+\t\tif (err)\n+\t\t\tgoto done;\n \t}\n-\tif (err)\n-\t\tgoto done;\n-\n \t/* Join with specific BSSID and cached SSID\n \t * If SSID is zero join based on BSSID only\n \t */\n@@ -4519,6 +4530,11 @@ static bool brcmf_valid_wpa_oui(u8 *oui, bool is_rsn_ie)\n \treturn (memcmp(oui, WPA_OUI, TLV_OUI_LEN) == 0);\n }\n \n+static bool brcmf_valid_dpp_suite(u8 *oui)\n+{\n+\treturn get_unaligned_be32(oui) == WLAN_AKM_SUITE_WFA_DPP;\n+}\n+\n static s32\n brcmf_configure_wpaie(struct brcmf_if *ifp,\n \t\t      const struct brcmf_vs_tlv *wpa_ie,\n@@ -4632,42 +4648,47 @@ brcmf_configure_wpaie(struct brcmf_if *ifp,\n \t\tgoto exit;\n \t}\n \tfor (i = 0; i \u003c count; i++) {\n-\t\tif (!brcmf_valid_wpa_oui(\u0026data[offset], is_rsn_ie)) {\n+\t\tif (brcmf_valid_dpp_suite(\u0026data[offset])) {\n+\t\t\twpa_auth |= WFA_AUTH_DPP;\n+\t\t\toffset += TLV_OUI_LEN;\n+\t\t} else if (brcmf_valid_wpa_oui(\u0026data[offset], is_rsn_ie)) {\n+\t\t\toffset += TLV_OUI_LEN;\n+\t\t\tswitch (data[offset]) {\n+\t\t\tcase RSN_AKM_NONE:\n+\t\t\t\tbrcmf_dbg(TRACE, \"RSN_AKM_NONE\\n\");\n+\t\t\t\twpa_auth |= WPA_AUTH_NONE;\n+\t\t\t\tbreak;\n+\t\t\tcase RSN_AKM_UNSPECIFIED:\n+\t\t\t\tbrcmf_dbg(TRACE, \"RSN_AKM_UNSPECIFIED\\n\");\n+\t\t\t\tis_rsn_ie ?\n+\t\t\t\t\t(wpa_auth |= WPA2_AUTH_UNSPECIFIED) :\n+\t\t\t\t\t(wpa_auth |= WPA_AUTH_UNSPECIFIED);\n+\t\t\t\tbreak;\n+\t\t\tcase RSN_AKM_PSK:\n+\t\t\t\tbrcmf_dbg(TRACE, \"RSN_AKM_PSK\\n\");\n+\t\t\t\tis_rsn_ie ? (wpa_auth |= WPA2_AUTH_PSK) :\n+\t\t\t\t\t    (wpa_auth |= WPA_AUTH_PSK);\n+\t\t\t\tbreak;\n+\t\t\tcase RSN_AKM_SHA256_PSK:\n+\t\t\t\tbrcmf_dbg(TRACE, \"RSN_AKM_MFP_PSK\\n\");\n+\t\t\t\twpa_auth |= WPA2_AUTH_PSK_SHA256;\n+\t\t\t\tbreak;\n+\t\t\tcase RSN_AKM_SHA256_1X:\n+\t\t\t\tbrcmf_dbg(TRACE, \"RSN_AKM_MFP_1X\\n\");\n+\t\t\t\twpa_auth |= WPA2_AUTH_1X_SHA256;\n+\t\t\t\tbreak;\n+\t\t\tcase RSN_AKM_SAE:\n+\t\t\t\tbrcmf_dbg(TRACE, \"RSN_AKM_SAE\\n\");\n+\t\t\t\twpa_auth |= WPA3_AUTH_SAE_PSK;\n+\t\t\t\tbreak;\n+\t\t\tdefault:\n+\t\t\t\tbphy_err(drvr, \"Invalid key mgmt info\\n\");\n+\t\t\t}\n+\t\t} else {\n \t\t\terr = -EINVAL;\n \t\t\tbphy_err(drvr, \"invalid OUI\\n\");\n \t\t\tgoto exit;\n \t\t}\n-\t\toffset += TLV_OUI_LEN;\n-\t\tswitch (data[offset]) {\n-\t\tcase RSN_AKM_NONE:\n-\t\t\tbrcmf_dbg(TRACE, \"RSN_AKM_NONE\\n\");\n-\t\t\twpa_auth |= WPA_AUTH_NONE;\n-\t\t\tbreak;\n-\t\tcase RSN_AKM_UNSPECIFIED:\n-\t\t\tbrcmf_dbg(TRACE, \"RSN_AKM_UNSPECIFIED\\n\");\n-\t\t\tis_rsn_ie ? (wpa_auth |= WPA2_AUTH_UNSPECIFIED) :\n-\t\t\t\t    (wpa_auth |= WPA_AUTH_UNSPECIFIED);\n-\t\t\tbreak;\n-\t\tcase RSN_AKM_PSK:\n-\t\t\tbrcmf_dbg(TRACE, \"RSN_AKM_PSK\\n\");\n-\t\t\tis_rsn_ie ? (wpa_auth |= WPA2_AUTH_PSK) :\n-\t\t\t\t    (wpa_auth |= WPA_AUTH_PSK);\n-\t\t\tbreak;\n-\t\tcase RSN_AKM_SHA256_PSK:\n-\t\t\tbrcmf_dbg(TRACE, \"RSN_AKM_MFP_PSK\\n\");\n-\t\t\twpa_auth |= WPA2_AUTH_PSK_SHA256;\n-\t\t\tbreak;\n-\t\tcase RSN_AKM_SHA256_1X:\n-\t\t\tbrcmf_dbg(TRACE, \"RSN_AKM_MFP_1X\\n\");\n-\t\t\twpa_auth |= WPA2_AUTH_1X_SHA256;\n-\t\t\tbreak;\n-\t\tcase RSN_AKM_SAE:\n-\t\t\tbrcmf_dbg(TRACE, \"RSN_AKM_SAE\\n\");\n-\t\t\twpa_auth |= WPA3_AUTH_SAE_PSK;\n-\t\t\tbreak;\n-\t\tdefault:\n-\t\t\tbphy_err(drvr, \"Invalid key mgmt info\\n\");\n-\t\t}\n \t\toffset++;\n \t}\n \n@@ -4687,10 +4708,12 @@ brcmf_configure_wpaie(struct brcmf_if *ifp,\n \t\t\t\t */\n \t\t\t\tif (!(wpa_auth \u0026 (WPA2_AUTH_PSK_SHA256 |\n \t\t\t\t\t\t  WPA2_AUTH_1X_SHA256 |\n+\t\t\t\t\t\t  WFA_AUTH_DPP |\n \t\t\t\t\t\t  WPA3_AUTH_SAE_PSK))) {\n \t\t\t\t\terr = -EINVAL;\n \t\t\t\t\tgoto exit;\n \t\t\t\t}\n+\n \t\t\t\t/* Firmware has requirement that WPA2_AUTH_PSK/\n \t\t\t\t * WPA2_AUTH_UNSPECIFIED be set, if SHA256 OUI\n \t\t\t\t * is to be included in the rsn ie.\ndiff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c\nindex 6e0c90f4718b58..58a9738e81ace4 100644\n--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c\n+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c\n@@ -6,6 +6,7 @@\n #include \u003clinux/netdevice.h\u003e\n #include \u003clinux/etherdevice.h\u003e\n #include \u003clinux/rtnetlink.h\u003e\n+#include \u003clinux/unaligned.h\u003e\n #include \u003cnet/cfg80211.h\u003e\n \n #include \u003cbrcmu_wifi.h\u003e\n@@ -44,9 +45,6 @@\n \n #define BRCMF_SCB_TIMEOUT_VALUE\t20\n \n-#define P2P_VER\t\t\t9\t/* P2P version: 9=WiFi P2P v1.0 */\n-#define P2P_PUB_AF_CATEGORY\t0x04\n-#define P2P_PUB_AF_ACTION\t0x09\n #define P2P_AF_CATEGORY\t\t0x7f\n #define P2P_OUI\t\t\t\"\\x50\\x6F\\x9A\"\t/* P2P OUI */\n #define P2P_OUI_LEN\t\t3\t\t/* P2P OUI length */\n@@ -143,10 +141,10 @@ struct brcmf_p2p_scan_le {\n /**\n  * struct brcmf_p2p_pub_act_frame - WiFi P2P Public Action Frame\n  *\n- * @category: P2P_PUB_AF_CATEGORY\n- * @action: P2P_PUB_AF_ACTION\n+ * @category: WLAN_CATEGORY_PUBLIC\n+ * @action: WLAN_PUB_ACTION_VENDOR_SPECIFIC\n  * @oui: P2P_OUI\n- * @oui_type: OUI type - P2P_VER\n+ * @oui_type: OUI type - WLAN_OUI_TYPE_WFA_P2P\n  * @subtype: OUI subtype - P2P_TYPE_*\n  * @dialog_token: nonzero, identifies req/rsp transaction\n  * @elts: Variable length information elements.\n@@ -166,7 +164,7 @@ struct brcmf_p2p_pub_act_frame {\n  *\n  * @category: P2P_AF_CATEGORY\n  * @oui: OUI - P2P_OUI\n- * @type: OUI Type - P2P_VER\n+ * @type: OUI Type - WLAN_OUI_TYPE_WFA_P2P\n  * @subtype: OUI Subtype - P2P_AF_*\n  * @dialog_token: nonzero, identifies req/resp tranaction\n  * @elts: Variable length information elements.\n@@ -228,10 +226,38 @@ static bool brcmf_p2p_is_pub_action(void *frame, u32 frame_len)\n \tif (frame_len \u003c sizeof(*pact_frm))\n \t\treturn false;\n \n-\tif (pact_frm-\u003ecategory == P2P_PUB_AF_CATEGORY \u0026\u0026\n-\t    pact_frm-\u003eaction == P2P_PUB_AF_ACTION \u0026\u0026\n-\t    pact_frm-\u003eoui_type == P2P_VER \u0026\u0026\n-\t    memcmp(pact_frm-\u003eoui, P2P_OUI, P2P_OUI_LEN) == 0)\n+\tif (pact_frm-\u003ecategory == WLAN_CATEGORY_PUBLIC \u0026\u0026\n+\t    pact_frm-\u003eaction == WLAN_PUB_ACTION_VENDOR_SPECIFIC \u0026\u0026\n+\t    pact_frm-\u003eoui_type == WLAN_OUI_TYPE_WFA_P2P \u0026\u0026\n+\t    get_unaligned_be24(pact_frm-\u003eoui) == WLAN_OUI_WFA)\n+\t\treturn true;\n+\n+\treturn false;\n+}\n+\n+/**\n+ * brcmf_p2p_is_dpp_pub_action() - true if dpp public type frame.\n+ *\n+ * @frame: action frame data.\n+ * @frame_len: length of action frame data.\n+ *\n+ * Determine if action frame is dpp public action type\n+ */\n+static bool brcmf_p2p_is_dpp_pub_action(void *frame, u32 frame_len)\n+{\n+\tstruct brcmf_p2p_pub_act_frame *pact_frm;\n+\n+\tif (!frame)\n+\t\treturn false;\n+\n+\tpact_frm = (struct brcmf_p2p_pub_act_frame *)frame;\n+\tif (frame_len \u003c sizeof(struct brcmf_p2p_pub_act_frame) - 1)\n+\t\treturn false;\n+\n+\tif (pact_frm-\u003ecategory == WLAN_CATEGORY_PUBLIC \u0026\u0026\n+\t    pact_frm-\u003eaction == WLAN_PUB_ACTION_VENDOR_SPECIFIC \u0026\u0026\n+\t    pact_frm-\u003eoui_type == WLAN_OUI_TYPE_WFA_DPP \u0026\u0026\n+\t    get_unaligned_be24(pact_frm-\u003eoui) == WLAN_OUI_WFA)\n \t\treturn true;\n \n \treturn false;\n@@ -257,7 +283,7 @@ static bool brcmf_p2p_is_p2p_action(void *frame, u32 frame_len)\n \t\treturn false;\n \n \tif (act_frm-\u003ecategory == P2P_AF_CATEGORY \u0026\u0026\n-\t    act_frm-\u003etype  == P2P_VER \u0026\u0026\n+\t    act_frm-\u003etype  == WLAN_OUI_TYPE_WFA_P2P \u0026\u0026\n \t    memcmp(act_frm-\u003eoui, P2P_OUI, P2P_OUI_LEN) == 0)\n \t\treturn true;\n \n@@ -1789,7 +1815,9 @@ bool brcmf_p2p_send_action_frame(struct brcmf_cfg80211_info *cfg,\n \t\t\tgoto exit;\n \t\t}\n \t} else if (brcmf_p2p_is_p2p_action(action_frame-\u003edata,\n-\t\t\t\t\t   action_frame_len)) {\n+\t\t\t\t\t   action_frame_len) ||\n+\t\t   brcmf_p2p_is_dpp_pub_action(action_frame-\u003edata,\n+\t\t\t\t\t       action_frame_len)) {\n \t\t/* do not configure anything. it will be */\n \t\t/* sent with a default configuration     */\n \t} else {\ndiff --git a/drivers/net/wireless/broadcom/brcm80211/include/brcmu_wifi.h b/drivers/net/wireless/broadcom/brcm80211/include/brcmu_wifi.h\nindex 7552bdb91991ce..c465208c433182 100644\n--- a/drivers/net/wireless/broadcom/brcm80211/include/brcmu_wifi.h\n+++ b/drivers/net/wireless/broadcom/brcm80211/include/brcmu_wifi.h\n@@ -233,6 +233,8 @@ static inline bool ac_bitmap_tst(u8 bitmap, int prec)\n \n #define WPA3_AUTH_SAE_PSK\t0x40000\t/* SAE with 4-way handshake */\n \n+#define WFA_AUTH_DPP\t\t0x200000 /* WFA DPP AUTH */\n+\n #define DOT11_DEFAULT_RTS_LEN\t\t2347\n #define DOT11_DEFAULT_FRAG_LEN\t\t2346\n \n"
}

gemini-3.1-pro-preview

null

{
  "EnableConfigs": [
    "BRCMFMAC",
    "BRCMFMAC_USB"
  ],
  "FocusSymbols": [
    "brcmf_cfg80211_connect",
    "brcmf_set_key_mgmt",
    "brcmf_configure_wpaie",
    "brcmf_p2p_send_action_frame"
  ],
  "Reasoning": "The patch adds support for the WFA DPP AKM suite and DPP public action frames to the Broadcom FullMAC driver (brcmfmac). It modifies connection and AP setup paths to parse the new AKM and handle SAE/FWSUP correctly, as well as the P2P action frame transmission path. These changes are reachable from user space via nl80211 commands (e.g., connect, start_ap, mgmt_tx) when the driver is bound to an emulated USB device.",
  "WorthFuzzing": true
}

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Do not list too generic configs (we already have them enabled). Only list those that
   specifically cover the modified code. List them in the EnableConfigs output array,
   and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit 5561d5a1f6fe5faa3eba7d552cd50ceb49159a17
Author: syz-cluster <triage@syzkaller.com>
Date:   Wed Jul 15 15:47:27 2026 +0000

    syz-cluster: applied patch under review

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
index 4b70845e1a2643..d61c3e03a106a5 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
@@ -8,6 +8,7 @@
 #include <linux/kernel.h>
 #include <linux/etherdevice.h>
 #include <linux/module.h>
+#include <linux/unaligned.h>
 #include <linux/vmalloc.h>
 #include <net/cfg80211.h>
 #include <net/netlink.h>
@@ -2154,6 +2155,9 @@ brcmf_set_key_mgmt(struct net_device *ndev, struct cfg80211_connect_params *sme)
 			val = WPA2_AUTH_PSK | WPA2_AUTH_FT;
 			profile->is_ft = true;
 			break;
+		case WLAN_AKM_SUITE_WFA_DPP:
+			val = WFA_AUTH_DPP;
+			break;
 		default:
 			bphy_err(drvr, "invalid akm suite (%d)\n",
 				 sme->crypto.akm_suites[0]);
@@ -2466,43 +2470,50 @@ brcmf_cfg80211_connect(struct wiphy *wiphy, struct net_device *ndev,
 		goto done;
 	}
 
-	if (sme->crypto.psk &&
-	    profile->use_fwsup != BRCMF_PROFILE_FWSUP_SAE) {
-		if (WARN_ON(profile->use_fwsup != BRCMF_PROFILE_FWSUP_NONE)) {
-			err = -EINVAL;
-			goto done;
-		}
-		brcmf_dbg(INFO, "using PSK offload\n");
-		profile->use_fwsup = BRCMF_PROFILE_FWSUP_PSK;
-	}
-
-	if (profile->use_fwsup != BRCMF_PROFILE_FWSUP_NONE) {
-		/* enable firmware supplicant for this interface */
-		err = brcmf_fil_iovar_int_set(ifp, "sup_wpa", 1);
-		if (err < 0) {
-			bphy_err(drvr, "failed to enable fw supplicant\n");
-			goto done;
+	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_FWSUP)) {
+		u32 akm = sme->crypto.n_akm_suites ? sme->crypto.akm_suites[0] : 0;
+		bool is_sae_akm = akm == WLAN_AKM_SUITE_SAE ||
+			akm == WLAN_AKM_SUITE_FT_OVER_SAE;
+
+		if (sme->crypto.psk && !is_sae_akm &&
+		    profile->use_fwsup != BRCMF_PROFILE_FWSUP_SAE) {
+			if (WARN_ON(profile->use_fwsup !=
+				    BRCMF_PROFILE_FWSUP_NONE)) {
+				err = -EINVAL;
+				goto done;
+			}
+			brcmf_dbg(INFO, "using PSK offload\n");
+			profile->use_fwsup = BRCMF_PROFILE_FWSUP_PSK;
 		}
-	}
-
-	if (profile->use_fwsup == BRCMF_PROFILE_FWSUP_PSK)
-		err = brcmf_set_pmk(ifp, sme->crypto.psk,
-				    BRCMF_WSEC_MAX_PSK_LEN);
-	else if (profile->use_fwsup == BRCMF_PROFILE_FWSUP_SAE) {
-		/* clean up user-space RSNE */
-		err = brcmf_fil_iovar_data_set(ifp, "wpaie", NULL, 0);
-		if (err) {
-			bphy_err(drvr, "failed to clean up user-space RSNE\n");
-			goto done;
+		if (profile->use_fwsup != BRCMF_PROFILE_FWSUP_NONE) {
+			/* enable firmware supplicant for this interface */
+			err = brcmf_fil_iovar_int_set(ifp, "sup_wpa", 1);
+			if (err < 0) {
+				bphy_err(drvr, "failed to enable fw supplicant\n");
+				goto done;
+			}
+		} else {
+			err = brcmf_fil_iovar_int_set(ifp, "sup_wpa", 0);
 		}
-		err = brcmf_fwvid_set_sae_password(ifp, &sme->crypto);
-		if (!err && sme->crypto.psk)
+		if (profile->use_fwsup == BRCMF_PROFILE_FWSUP_PSK)
 			err = brcmf_set_pmk(ifp, sme->crypto.psk,
 					    BRCMF_WSEC_MAX_PSK_LEN);
+		else if (profile->use_fwsup == BRCMF_PROFILE_FWSUP_SAE &&
+			 sme->crypto.sae_pwd &&
+			 brcmf_feat_is_enabled(ifp, BRCMF_FEAT_SAE)) {
+			/* clean up user-space RSNE */
+			if (brcmf_fil_iovar_data_set(ifp, "wpaie", NULL, 0)) {
+				bphy_err(drvr, "failed to clean up user-space RSNE\n");
+				goto done;
+			}
+			err = brcmf_fwvid_set_sae_password(ifp, &sme->crypto);
+			if (!err && sme->crypto.psk)
+				err = brcmf_set_pmk(ifp, sme->crypto.psk,
+						    BRCMF_WSEC_MAX_PSK_LEN);
+		}
+		if (err)
+			goto done;
 	}
-	if (err)
-		goto done;
-
 	/* Join with specific BSSID and cached SSID
 	 * If SSID is zero join based on BSSID only
 	 */
@@ -4519,6 +4530,11 @@ static bool brcmf_valid_wpa_oui(u8 *oui, bool is_rsn_ie)
 	return (memcmp(oui, WPA_OUI, TLV_OUI_LEN) == 0);
 }
 
+static bool brcmf_valid_dpp_suite(u8 *oui)
+{
+	return get_unaligned_be32(oui) == WLAN_AKM_SUITE_WFA_DPP;
+}
+
 static s32
 brcmf_configure_wpaie(struct brcmf_if *ifp,
 		      const struct brcmf_vs_tlv *wpa_ie,
@@ -4632,42 +4648,47 @@ brcmf_configure_wpaie(struct brcmf_if *ifp,
 		goto exit;
 	}
 	for (i = 0; i < count; i++) {
-		if (!brcmf_valid_wpa_oui(&data[offset], is_rsn_ie)) {
+		if (brcmf_valid_dpp_suite(&data[offset])) {
+			wpa_auth |= WFA_AUTH_DPP;
+			offset += TLV_OUI_LEN;
+		} else if (brcmf_valid_wpa_oui(&data[offset], is_rsn_ie)) {
+			offset += TLV_OUI_LEN;
+			switch (data[offset]) {
+			case RSN_AKM_NONE:
+				brcmf_dbg(TRACE, "RSN_AKM_NONE\n");
+				wpa_auth |= WPA_AUTH_NONE;
+				break;
+			case RSN_AKM_UNSPECIFIED:
+				brcmf_dbg(TRACE, "RSN_AKM_UNSPECIFIED\n");
+				is_rsn_ie ?
+					(wpa_auth |= WPA2_AUTH_UNSPECIFIED) :
+					(wpa_auth |= WPA_AUTH_UNSPECIFIED);
+				break;
+			case RSN_AKM_PSK:
+				brcmf_dbg(TRACE, "RSN_AKM_PSK\n");
+				is_rsn_ie ? (wpa_auth |= WPA2_AUTH_PSK) :
+					    (wpa_auth |= WPA_AUTH_PSK);
+				break;
+			case RSN_AKM_SHA256_PSK:
+				brcmf_dbg(TRACE, "RSN_AKM_MFP_PSK\n");
+				wpa_auth |= WPA2_AUTH_PSK_SHA256;
+				break;
+			case RSN_AKM_SHA256_1X:
+				brcmf_dbg(TRACE, "RSN_AKM_MFP_1X\n");
+				wpa_auth |= WPA2_AUTH_1X_SHA256;
+				break;
+			case RSN_AKM_SAE:
+				brcmf_dbg(TRACE, "RSN_AKM_SAE\n");
+				wpa_auth |= WPA3_AUTH_SAE_PSK;
+				break;
+			default:
+				bphy_err(drvr, "Invalid key mgmt info\n");
+			}
+		} else {
 			err = -EINVAL;
 			bphy_err(drvr, "invalid OUI\n");
 			goto exit;
 		}
-		offset += TLV_OUI_LEN;
-		switch (data[offset]) {
-		case RSN_AKM_NONE:
-			brcmf_dbg(TRACE, "RSN_AKM_NONE\n");
-			wpa_auth |= WPA_AUTH_NONE;
-			break;
-		case RSN_AKM_UNSPECIFIED:
-			brcmf_dbg(TRACE, "RSN_AKM_UNSPECIFIED\n");
-			is_rsn_ie ? (wpa_auth |= WPA2_AUTH_UNSPECIFIED) :
-				    (wpa_auth |= WPA_AUTH_UNSPECIFIED);
-			break;
-		case RSN_AKM_PSK:
-			brcmf_dbg(TRACE, "RSN_AKM_PSK\n");
-			is_rsn_ie ? (wpa_auth |= WPA2_AUTH_PSK) :
-				    (wpa_auth |= WPA_AUTH_PSK);
-			break;
-		case RSN_AKM_SHA256_PSK:
-			brcmf_dbg(TRACE, "RSN_AKM_MFP_PSK\n");
-			wpa_auth |= WPA2_AUTH_PSK_SHA256;
-			break;
-		case RSN_AKM_SHA256_1X:
-			brcmf_dbg(TRACE, "RSN_AKM_MFP_1X\n");
-			wpa_auth |= WPA2_AUTH_1X_SHA256;
-			break;
-		case RSN_AKM_SAE:
-			brcmf_dbg(TRACE, "RSN_AKM_SAE\n");
-			wpa_auth |= WPA3_AUTH_SAE_PSK;
-			break;
-		default:
-			bphy_err(drvr, "Invalid key mgmt info\n");
-		}
 		offset++;
 	}
 
@@ -4687,10 +4708,12 @@ brcmf_configure_wpaie(struct brcmf_if *ifp,
 				 */
 				if (!(wpa_auth & (WPA2_AUTH_PSK_SHA256 |
 						  WPA2_AUTH_1X_SHA256 |
+						  WFA_AUTH_DPP |
 						  WPA3_AUTH_SAE_PSK))) {
 					err = -EINVAL;
 					goto exit;
 				}
+
 				/* Firmware has requirement that WPA2_AUTH_PSK/
 				 * WPA2_AUTH_UNSPECIFIED be set, if SHA256 OUI
 				 * is to be included in the rsn ie.
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
index 6e0c90f4718b58..58a9738e81ace4 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
@@ -6,6 +6,7 @@
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
 #include <linux/rtnetlink.h>
+#include <linux/unaligned.h>
 #include <net/cfg80211.h>
 
 #include <brcmu_wifi.h>
@@ -44,9 +45,6 @@
 
 #define BRCMF_SCB_TIMEOUT_VALUE	20
 
-#define P2P_VER			9	/* P2P version: 9=WiFi P2P v1.0 */
-#define P2P_PUB_AF_CATEGORY	0x04
-#define P2P_PUB_AF_ACTION	0x09
 #define P2P_AF_CATEGORY		0x7f
 #define P2P_OUI			"\x50\x6F\x9A"	/* P2P OUI */
 #define P2P_OUI_LEN		3		/* P2P OUI length */
@@ -143,10 +141,10 @@ struct brcmf_p2p_scan_le {
 /**
  * struct brcmf_p2p_pub_act_frame - WiFi P2P Public Action Frame
  *
- * @category: P2P_PUB_AF_CATEGORY
- * @action: P2P_PUB_AF_ACTION
+ * @category: WLAN_CATEGORY_PUBLIC
+ * @action: WLAN_PUB_ACTION_VENDOR_SPECIFIC
  * @oui: P2P_OUI
- * @oui_type: OUI type - P2P_VER
+ * @oui_type: OUI type - WLAN_OUI_TYPE_WFA_P2P
  * @subtype: OUI subtype - P2P_TYPE_*
  * @dialog_token: nonzero, identifies req/rsp transaction
  * @elts: Variable length information elements.
@@ -166,7 +164,7 @@ struct brcmf_p2p_pub_act_frame {
  *
  * @category: P2P_AF_CATEGORY
  * @oui: OUI - P2P_OUI
- * @type: OUI Type - P2P_VER
+ * @type: OUI Type - WLAN_OUI_TYPE_WFA_P2P
  * @subtype: OUI Subtype - P2P_AF_*
  * @dialog_token: nonzero, identifies req/resp tranaction
  * @elts: Variable length information elements.
@@ -228,10 +226,38 @@ static bool brcmf_p2p_is_pub_action(void *frame, u32 frame_len)
 	if (frame_len < sizeof(*pact_frm))
 		return false;
 
-	if (pact_frm->category == P2P_PUB_AF_CATEGORY &&
-	    pact_frm->action == P2P_PUB_AF_ACTION &&
-	    pact_frm->oui_type == P2P_VER &&
-	    memcmp(pact_frm->oui, P2P_OUI, P2P_OUI_LEN) == 0)
+	if (pact_frm->category == WLAN_CATEGORY_PUBLIC &&
+	    pact_frm->action == WLAN_PUB_ACTION_VENDOR_SPECIFIC &&
+	    pact_frm->oui_type == WLAN_OUI_TYPE_WFA_P2P &&
+	    get_unaligned_be24(pact_frm->oui) == WLAN_OUI_WFA)
+		return true;
+
+	return false;
+}
+
+/**
+ * brcmf_p2p_is_dpp_pub_action() - true if dpp public type frame.
+ *
+ * @frame: action frame data.
+ * @frame_len: length of action frame data.
+ *
+ * Determine if action frame is dpp public action type
+ */
+static bool brcmf_p2p_is_dpp_pub_action(void *frame, u32 frame_len)
+{
+	struct brcmf_p2p_pub_act_frame *pact_frm;
+
+	if (!frame)
+		return false;
+
+	pact_frm = (struct brcmf_p2p_pub_act_frame *)frame;
+	if (frame_len < sizeof(struct brcmf_p2p_pub_act_frame) - 1)
+		return false;
+
+	if (pact_frm->category == WLAN_CATEGORY_PUBLIC &&
+	    pact_frm->action == WLAN_PUB_ACTION_VENDOR_SPECIFIC &&
+	    pact_frm->oui_type == WLAN_OUI_TYPE_WFA_DPP &&
+	    get_unaligned_be24(pact_frm->oui) == WLAN_OUI_WFA)
 		return true;
 
 	return false;
@@ -257,7 +283,7 @@ static bool brcmf_p2p_is_p2p_action(void *frame, u32 frame_len)
 		return false;
 
 	if (act_frm->category == P2P_AF_CATEGORY &&
-	    act_frm->type  == P2P_VER &&
+	    act_frm->type  == WLAN_OUI_TYPE_WFA_P2P &&
 	    memcmp(act_frm->oui, P2P_OUI, P2P_OUI_LEN) == 0)
 		return true;
 
@@ -1789,7 +1815,9 @@ bool brcmf_p2p_send_action_frame(struct brcmf_cfg80211_info *cfg,
 			goto exit;
 		}
 	} else if (brcmf_p2p_is_p2p_action(action_frame->data,
-					   action_frame_len)) {
+					   action_frame_len) ||
+		   brcmf_p2p_is_dpp_pub_action(action_frame->data,
+					       action_frame_len)) {
 		/* do not configure anything. it will be */
 		/* sent with a default configuration     */
 	} else {
diff --git a/drivers/net/wireless/broadcom/brcm80211/include/brcmu_wifi.h b/drivers/net/wireless/broadcom/brcm80211/include/brcmu_wifi.h
index 7552bdb91991ce..c465208c433182 100644
--- a/drivers/net/wireless/broadcom/brcm80211/include/brcmu_wifi.h
+++ b/drivers/net/wireless/broadcom/brcm80211/include/brcmu_wifi.h
@@ -233,6 +233,8 @@ static inline bool ac_bitmap_tst(u8 bitmap, int prec)
 
 #define WPA3_AUTH_SAE_PSK	0x40000	/* SAE with 4-way handshake */
 
+#define WFA_AUTH_DPP		0x200000 /* WFA DPP AUTH */
+
 #define DOT11_DEFAULT_RTS_LEN		2347
 #define DOT11_DEFAULT_FRAG_LEN		2346
 

gemini-3.1-pro-preview

null

null

							input: 6883
							output: 42
							thoughts: 260
						

**Analyzing the DPP Support Patch in brcmfmac**

Okay, so I've got this patch that adds DPP (Device Provisioning Protocol) AKM suite support and public action frame handling to the `brcmfmac` driver, specifically within the `drivers/net/wireless/broadcom/brcm80211/brcmfmac/` directory. It also seems to be making adjustments to `brcmf_cfg80211_connect` to better handle SAE AKM and the firmware supplicant (FWSUP), which is interesting.

My immediate focus is on reachability and fuzzing potential. I need to figure out how this patch is activated and identify the key functions that are now modified or introduced. A quick scan reveals that the primary functions touched are `brcmf_set_key_mgmt`, `brcmf_cfg80211_connect`, `brcmf_configure_wpaie`, `brcmf_p2p_is_dpp_pub_action`, and `brcmf_p2p_send_action_frame`. These are all clearly part of the `brcmfmac` driver.

Next, I'll need to locate the `Kconfig` file for `brcmfmac`. It's likely in `drivers/net/wireless/broadcom/brcm80211/brcmfmac/Kconfig` or somewhere similar. I'll use `codesearch-dir-index` and `grepper` to locate it quickly. This Kconfig will be crucial to understand the driver's build-time configuration options and how the DPP functionality is conditionally enabled. Understanding the Kconfig will likely give me key insights for building a test environment that can reach and exercise the DPP functionality.

{
  "Expression": "config BRCMFMAC",
  "PathPrefix": "drivers/net/wireless/broadcom/brcm80211/"
}

{
  "Output": "drivers/net/wireless/broadcom/brcm80211/brcmfmac/Kconfig:1:config BRCMFMAC\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/Kconfig-2-\ttristate \"Broadcom FullMAC WLAN driver\"\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/Kconfig-10-\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/Kconfig:11:config BRCMFMAC_PROTO_BCDC\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/Kconfig-12-\tbool\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/Kconfig-13-\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/Kconfig:14:config BRCMFMAC_PROTO_MSGBUF\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/Kconfig-15-\tbool\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/Kconfig-16-\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/Kconfig:17:config BRCMFMAC_SDIO\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/Kconfig-18-\tbool \"SDIO bus interface support for FullMAC driver\"\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/Kconfig-28-\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/Kconfig:29:config BRCMFMAC_USB\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/Kconfig-30-\tbool \"USB bus interface support for FullMAC driver\"\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/Kconfig-39-\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/Kconfig:40:config BRCMFMAC_PCIE\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/Kconfig-41-\tbool \"PCIE bus interface support for FullMAC driver\"\n"
}

gemini-3.1-pro-preview

null

null

							input: 8178
							output: 55
							thoughts: 426
						

**Fuzzing the BRCMFMAC Driver: A Strategic Approach**

Okay, so I've got this `BRCMFMAC` driver in my sights. It's got support for SDIO, USB, and PCIE, which immediately opens up fuzzing avenues. Because it supports USB, that means I can leverage USB emulation techniques – either a dummy HCD setup or, even better, Syzkaller's USB fuzzing capabilities. Wait, Syzkaller *does* have USB fuzzing, right? Excellent. That means `BRCMFMAC_USB` is definitely within reach.

Now, let's make sure it's actually worth the effort. Can I get at it through `mac80211_hwsim`? No, it's a FullMAC driver, registering its own `wiphy` and `netdev`. It talks to the firmware over SDIO, USB, or PCIE – which confirms that USB path. Syzkaller's USB fuzzing will be my best bet. So yeah, `BRCMFMAC_USB` is looking like a solid candidate.

Digging deeper, I see that the patch modifies some crucial `cfg80211` callbacks: `brcmf_cfg80211_connect`, `brcmf_set_key_mgmt`, and `brcmf_configure_wpaie`, and that these are called from within `brcmf_cfg80211_connect` or similar. These are reachable from user space via the `nl80211` interface (which leverages `cfg80211`), which is another really good sign. Clearly, this is reachable, and absolutely worth fuzzing.

Now, let's pinpoint the specific functions I want to focus on:
*   `brcmf_cfg80211_connect`
*   `brcmf_set_key_mgmt`
*   `brcmf_configure_wpaie`
*   `brcmf_p2p_is_dpp_pub_action`
*   `brcmf_p2p_send_action_frame`

I'll check the source of each function. `brcmf_p2p_is_dpp_pub_action` is static, which limits its accessibility but still doesn't rule it out. And I should double check `brcmf_p2p_send_action_frame` and its usage in `p2p.c`.

{
  "Expression": "brcmf_p2p_send_action_frame",
  "PathPrefix": "drivers/net/wireless/broadcom/brcm80211/brcmfmac/"
}

{
  "Output": "drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c=5536=brcmf_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c-5627-\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:5628:\t\tack = brcmf_p2p_send_action_frame(cfg, cfg_to_ndev(cfg),\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c-5629-\t\t\t\t\t\t  af_params);\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c=1726=static bool brcmf_p2p_check_dwell_overflow(u32 requested_dwell,\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c-1737-/**\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c:1738: * brcmf_p2p_send_action_frame() - send action frame .\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c-1739- *\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c-1743- */\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c:1744:bool brcmf_p2p_send_action_frame(struct brcmf_cfg80211_info *cfg,\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c-1745-\t\t\t\t struct net_device *ndev,\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h=168=int brcmf_p2p_notify_action_tx_complete(struct brcmf_if *ifp,\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h-170-\t\t\t\t\tvoid *data);\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h:171:bool brcmf_p2p_send_action_frame(struct brcmf_cfg80211_info *cfg,\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h-172-\t\t\t\t struct net_device *ndev,\n"
}

gemini-3.1-pro-preview

null

null

							input: 9965
							output: 54
							thoughts: 51
						

Okay, here's my take on those thoughts, framed as my own:

**Analyzing `brcmf_p2p_send_action_frame` and `brcmf_cfg80211_connect`**

Alright, let's see... the `brcmf_p2p_send_action_frame` function - I'm pretty sure I've seen that one kicking around. It rings a bell as a global function, meaning it's accessible from various parts of the driver. Now, the next one, `brcmf_cfg80211_connect`... that one seems a bit less familiar. My initial hunch is that it might be a static function. That would mean it's only visible within a specific compilation unit, maybe `cfg80211.c`, if memory serves. I'd better double-check to confirm that hunch. Time to crack open the source code for `cfg80211.c` and verify if my initial assumption about its scope is correct. Gotta be precise about these kinds of details, especially when dealing with the core of the networking stack.

{
  "Expression": "brcmf_cfg80211_connect",
  "PathPrefix": "drivers/net/wireless/broadcom/brcm80211/brcmfmac/"
}

{
  "Output": "drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c=2363=static s32\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:2364:brcmf_cfg80211_connect(struct wiphy *wiphy, struct net_device *ndev,\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c-2365-\t\t       struct cfg80211_connect_params *sme)\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c=5957=static struct cfg80211_ops brcmf_cfg80211_ops = {\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c-5974-\t.set_power_mgmt = brcmf_cfg80211_set_power_mgmt,\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:5975:\t.connect = brcmf_cfg80211_connect,\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c-5976-\t.disconnect = brcmf_cfg80211_disconnect,\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c=6146=static void brcmf_clear_assoc_ies(struct brcmf_cfg80211_info *cfg)\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c-6147-{\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:6148:\tstruct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c-6149-\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c=6296=static s32 brcmf_get_assoc_ies(struct brcmf_cfg80211_info *cfg,\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c-6300-\tstruct brcmf_cfg80211_assoc_ielen_le *assoc_info;\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:6301:\tstruct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c-6302-\tstruct brcmf_cfg80211_edcf_acparam edcf_acparam_info[EDCF_AC_COUNT];\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c=6378=brcmf_bss_roaming_done(struct brcmf_cfg80211_info *cfg,\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c-6383-\tstruct brcmf_cfg80211_profile *profile = \u0026ifp-\u003evif-\u003eprofile;\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:6384:\tstruct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c-6385-\tstruct wiphy *wiphy = cfg_to_wiphy(cfg);\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c=6451=brcmf_bss_connect_done(struct brcmf_cfg80211_info *cfg,\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c-6456-\tstruct brcmf_cfg80211_profile *profile = \u0026ifp-\u003evif-\u003eprofile;\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:6457:\tstruct brcmf_cfg80211_connect_info *conn_info = cfg_to_conn(cfg);\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c-6458-\tstruct cfg80211_connect_resp_params conn_params;\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h=220=struct brcmf_cfg80211_vif {\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h-235-/* association inform */\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h:236:struct brcmf_cfg80211_connect_info {\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h-237-\tu8 *req_ie;\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h=342=struct brcmf_cfg80211_info {\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h-349-\tstruct wl_cfg80211_bss_info *bss_info;\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h:350:\tstruct brcmf_cfg80211_connect_info conn_info;\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h-351-\tstruct brcmf_pmk_list_le pmk_list;\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h=433=static inline struct\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h:434:brcmf_cfg80211_connect_info *cfg_to_conn(struct brcmf_cfg80211_info *cfg)\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h-435-{\n"
}

gemini-3.1-pro-preview

null

null

							input: 12256
							output: 49
							thoughts: 878
						

**Reaching the New DPP Support in BRCMFMAC via Syzkaller**

Okay, so I'm looking at this patch and how it relates to fuzzing with syzkaller. The patch adds support for DPP (Device Provisioning Protocol) within the `BRCMFMAC` driver, specifically by modifying `brcmf_set_key_mgmt` and `brcmf_configure_wpaie` to handle `WLAN_AKM_SUITE_WFA_DPP`, and by updating `brcmf_p2p_send_action_frame` for DPP public action frames.  These functions are all called from `cfg80211` callbacks: `brcmf_cfg80211_connect` and `brcmf_cfg80211_mgmt_tx` respectively, which are themselves registered within `brcmf_cfg80211_ops`.  This means they're ultimately triggered by `nl80211` commands.

The crucial question is whether syzkaller can trigger these code paths. Syzkaller has USB fuzzing capabilities via `syz_usb_connect` and `syz_usb_disconnect`, which can emulate USB devices, and potentially, the `BRCMFMAC_USB` device.  Syzkaller also understands `nl80211` through `syz_genetlink_get_family_id`, making it a potential route to these functions.

The problem, though, is that `BRCMFMAC` is a FullMAC driver and depends on a specific USB device emulation for wiphy registration.  If the USB emulation provided by syzkaller is good enough, the driver should probe and register its wiphy, making `nl80211` commands available and thus reaching these modified functions.  But, can syzkaller's USB fuzzing emulate the Broadcom USB device *and* the firmware sufficiently to allow the driver to load and initialize? The driver *requires* the firmware to load and respond correctly; otherwise, the wiphy registration will fail.

So, while the probe function *itself* is reachable even with a failed initialization, the *modified* functions are callbacks that only get called if the wiphy registers successfully. The real bottleneck is likely that the initialization and firmware interaction have to be correct. If syzkaller just spews random USB responses, the driver will probably fail during initialization, and the wiphy will not be registered. However, the driver might be "reachable" in theory by some other means.

The documentation is clear:  if it's a USB driver, the functions *are* reachable via USB emulation. The firmware loading and initialization phase might be a challenge, but it's not an *impossibility* in the virtualization environment. Now, let me check the kernel config (`drivers/net/wireless/broadcom/brcm80211/brcmfmac/Kconfig`) and see if there are any specific USB device configurations I need to be aware of to guide syzkaller. Let's see if syzkaller needs any specific parameters for emulating the `BRCMFMAC_USB` device... that might unlock it all.

{
  "Expression": "config BRCMFMAC_USB",
  "PathPrefix": "drivers/net/wireless/broadcom/brcm80211/brcmfmac/"
}

{
  "Output": "drivers/net/wireless/broadcom/brcm80211/brcmfmac/Kconfig=17=config BRCMFMAC_SDIO\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/Kconfig-28-\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/Kconfig:29:config BRCMFMAC_USB\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/Kconfig-30-\tbool \"USB bus interface support for FullMAC driver\"\n"
}

gemini-3.1-pro-preview

null

null

							input: 14024
							output: 47
							thoughts: 87
						

Okay, let's see what we're dealing with.

**Examining the BRCMFMAC Driver Configuration**

Right, so I'm looking at `BRCMFMAC` and `BRCMFMAC_USB` as the relevant configs here. My initial thought is to quickly verify the core dependencies. Hang on, is `BRCMFMAC` dependent on *both* `CFG80211` and `MAC80211`? No, that doesn't make sense. It's a FullMAC driver, which means it should only require the regulatory and control aspects, handled by `CFG80211`. `MAC80211` is part of the mac layer, which is handled directly by `BRCMFMAC`. I need to confirm this assumption, so I will now check the specific dependencies of `BRCMFMAC` to be absolutely certain.

{
  "Expression": "config BRCMFMAC",
  "PathPrefix": "drivers/net/wireless/broadcom/brcm80211/brcmfmac/"
}

{
  "Output": "drivers/net/wireless/broadcom/brcm80211/brcmfmac/Kconfig:1:config BRCMFMAC\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/Kconfig-2-\ttristate \"Broadcom FullMAC WLAN driver\"\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/Kconfig-10-\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/Kconfig:11:config BRCMFMAC_PROTO_BCDC\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/Kconfig-12-\tbool\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/Kconfig-13-\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/Kconfig:14:config BRCMFMAC_PROTO_MSGBUF\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/Kconfig-15-\tbool\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/Kconfig-16-\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/Kconfig:17:config BRCMFMAC_SDIO\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/Kconfig-18-\tbool \"SDIO bus interface support for FullMAC driver\"\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/Kconfig-28-\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/Kconfig:29:config BRCMFMAC_USB\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/Kconfig-30-\tbool \"USB bus interface support for FullMAC driver\"\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/Kconfig-39-\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/Kconfig:40:config BRCMFMAC_PCIE\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/Kconfig-41-\tbool \"PCIE bus interface support for FullMAC driver\"\n"
}

gemini-3.1-pro-preview

null

null

							input: 14964
							output: 50
							thoughts: 37
						

Okay, here's my interpretation of that thought process, as if I'm the one having it, and considering I'm an expert in the field:

**Initial Kconfig Scan**

Alright, time to get to it. Let's see... the `brcm80211` driver, specifically its `Kconfig` file. I'm going to start with the first ten lines. This gives me a quick initial feel for the configuration options and dependencies. I'm looking for the overall structure – what are the top-level sections or features? What are the immediate prerequisites? I'm hoping to get a quick grasp of the general configuration approach used by this driver, a birds-eye view before diving deeper into any specific section. I'm anticipating some familiar `bool` or `tristate` options, likely grouped thematically. Let's see what we can glean. It'll be interesting to see what the configuration dependencies are, and whether it's straightforward, or if there's some complex legacy stuff involved.

{
  "File": "drivers/net/wireless/broadcom/brcm80211/brcmfmac/Kconfig",
  "FirstLine": 1,
  "LineCount": 10
}

{
  "Contents": "   1:\tconfig BRCMFMAC\n   2:\t\ttristate \"Broadcom FullMAC WLAN driver\"\n   3:\t\tdepends on CFG80211\n   4:\t\tselect BRCMUTIL\n   5:\t\thelp\n   6:\t\t  This module adds support for wireless adapters based on Broadcom\n   7:\t\t  FullMAC chipsets. It has to work with at least one of the bus\n   8:\t\t  interface support. If you choose to build a module, it'll be called\n   9:\t\t  brcmfmac.ko.\n  10:\t\n"
}

gemini-3.1-pro-preview

null

null

							input: 15420
							output: 51
							thoughts: 294
						

**Fuzzing the BRCMFMAC Driver**

Okay, so I'm thinking about how to effectively fuzz the `BRCMFMAC` driver. It's pretty clear that it has a dependency on `CFG80211`, so that's something to keep in mind. To get started with the fuzzing setup, it looks like I'll need both `BRCMFMAC` and `BRCMFMAC_USB` available to me.

Now, focusing on the target functions, initially, I was looking at: `brcmf_set_key_mgmt`, `brcmf_cfg80211_connect`, `brcmf_configure_wpaie`, and `brcmf_p2p_send_action_frame`. But, hang on a second, I see that `brcmf_p2p_send_action_frame` is actually called from `brcmf_cfg80211_mgmt_tx`. Hmmm, I think `brcmf_cfg80211_mgmt_tx` might be a more strategic point to focus on, given that it acts as a central point of entry.

Right, `brcmf_cfg80211_mgmt_tx` is a `cfg80211` callback. That makes it attractive because I can trigger it in a controlled manner. I'll check `brcmf_cfg80211_connect` too, as that's also a `cfg80211` callback. Ah, and I see that `brcmf_set_key_mgmt` and `brcmf_configure_wpaie` are called from `brcmf_cfg80211_connect` or similar functions, so that path seems pretty important too. I should check specifically where `brcmf_configure_wpaie` is called from. That will give me more context.

{
  "Expression": "brcmf_configure_wpaie",
  "PathPrefix": "drivers/net/wireless/broadcom/brcm80211/brcmfmac/"
}

{
  "Output": "drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c=4538=static s32\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:4539:brcmf_configure_wpaie(struct brcmf_if *ifp,\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c-4540-\t\t      const struct brcmf_vs_tlv *wpa_ie,\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c=5084=brcmf_parse_configure_security(struct brcmf_if *ifp,\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c-5103-\t\t\t/* WPA IE */\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:5104:\t\t\terr = brcmf_configure_wpaie(ifp, wpa_ie, false);\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c-5105-\t\t\tif (err \u003c 0)\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c-5112-\t\t\t/* RSN IE */\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:5113:\t\t\terr = brcmf_configure_wpaie(ifp, tmp_ie, true);\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c-5114-\t\t\tif (err \u003c 0)\n"
}

gemini-3.1-pro-preview

null

null

							input: 16709
							output: 51
							thoughts: 40
						

Okay, here's my interpretation of that thought process, assuming I'm an expert in this area and thinking this through:

**Investigating the Configuration Sequence: `brcmf_parse_configure_security`**

Right, so I'm looking at this `brcmf_parse_configure_security` function and the first thing that jumps out is that it calls `brcmf_configure_wpaie`. This likely indicates that the primary purpose of `brcmf_parse_configure_security` revolves around setting up security protocols, and that setting up WPA/WPA2/WPA3 information elements is a key part of that process.

Now, the natural question that immediately arises is, where is *this* function, `brcmf_parse_configure_security`, being called from? Understanding the call stack is crucial. Knowing the caller tells me the *context* in which security configurations are parsed and applied. Is it during the initial driver load? When a new network is joined? Perhaps during an explicit reconfiguration command? Knowing that will provide key insights into how the security settings are actually established and updated within the system. That's where I need to start my debugging.

{
  "Expression": "brcmf_parse_configure_security",
  "PathPrefix": "drivers/net/wireless/broadcom/brcm80211/brcmfmac/"
}

{
  "Output": "drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c=5083=static s32\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:5084:brcmf_parse_configure_security(struct brcmf_if *ifp,\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c-5085-\t\t\t       struct cfg80211_ap_settings *settings,\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c=5126=brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c-5292-\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:5293:\t\terr = brcmf_parse_configure_security(ifp, settings,\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c-5294-\t\t\t\t\t\t     NL80211_IFTYPE_AP);\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c-5295-\t\tif (err \u003c 0) {\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:5296:\t\t\tbphy_err(drvr, \"brcmf_parse_configure_security error\\n\");\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c-5297-\t\t\tgoto exit;\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c-5334-\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:5335:\t\terr = brcmf_parse_configure_security(ifp, settings,\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c-5336-\t\t\t\t\t\t     NL80211_IFTYPE_P2P_GO);\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c-5337-\t\tif (err \u003c 0) {\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:5338:\t\t\tbrcmf_err(\"brcmf_parse_configure_security error\\n\");\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c-5339-\t\t\tgoto exit;\n"
}

gemini-3.1-pro-preview

null

null

							input: 17869
							output: 51
							thoughts: 210
						

**Fuzzing Target Identification**

Okay, so I've traced the call path – `brcmf_parse_configure_security` gets invoked by `brcmf_cfg80211_start_ap`. This is significant because the modified functions stemming from that call are reachable in AP mode (through `start_ap`), STA mode (via `connect`), and even P2P mode (from `mgmt_tx`). That's a wide attack surface, and a definite signal to prioritize this for fuzzing.

My next step is to nail down the configurations. I need to make sure I'm targeting the right builds. I have `BRCMFMAC` and `BRCMFMAC_USB` in mind.

Now for the core symbols. I'm focusing on:

*   `brcmf_cfg80211_connect`
*   `brcmf_set_key_mgmt`
*   `brcmf_configure_wpaie`
*   `brcmf_p2p_send_action_frame`

Wait a minute... I see that `brcmf_set_key_mgmt` is definitely called from `brcmf_cfg80211_connect`. That makes it a high-value target. I'll need to dig into `brcmf_set_key_mgmt` directly to assess its vulnerability potential.

{
  "Expression": "brcmf_set_key_mgmt",
  "PathPrefix": "drivers/net/wireless/broadcom/brcm80211/brcmfmac/"
}

{
  "Output": "drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c=2087=static s32\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:2088:brcmf_set_key_mgmt(struct net_device *ndev, struct cfg80211_connect_params *sme)\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c-2089-{\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c=2364=brcmf_cfg80211_connect(struct wiphy *wiphy, struct net_device *ndev,\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c-2460-\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:2461:\terr = brcmf_set_key_mgmt(ndev, sme);\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c-2462-\tif (err) {\n"
}

gemini-3.1-pro-preview

null

null

							input: 18797
							output: 49
							thoughts: 196
						

**My Analysis of the `brcmf` Driver's Connection and Security Handlers**

Okay, so `brcmf_set_key_mgmt` is definitely called from `brcmf_cfg80211_connect`. That's the starting point. I need to focus on these symbols: `brcmf_cfg80211_connect`, `brcmf_set_key_mgmt`, `brcmf_configure_wpaie`, and `brcmf_p2p_send_action_frame`. These are the key functions to examine for potential vulnerabilities or interesting interaction points.

Now, let me broaden the scope a bit. Are there any other configuration options or dependencies I should be aware of? I know that `BRCMFMAC_SDIO` and `BRCMFMAC_PCIE` might be enabled, but realistically, `BRCMFMAC_USB` is the most probable target for fuzzing, especially given how syzkaller is likely set up. I'll include `BRCMFMAC` and `BRCMFMAC_USB` in my mental model, just to be thorough.

It's a good idea to double check that `BRCMFMAC_USB` doesn't have any hidden dependencies. It would be a silly oversight.

{
  "Expression": "config BRCMFMAC_USB",
  "PathPrefix": "drivers/net/wireless/broadcom/brcm80211/brcmfmac/"
}

{
  "Output": "drivers/net/wireless/broadcom/brcm80211/brcmfmac/Kconfig=17=config BRCMFMAC_SDIO\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/Kconfig-28-\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/Kconfig:29:config BRCMFMAC_USB\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/Kconfig-30-\tbool \"USB bus interface support for FullMAC driver\"\n"
}

gemini-3.1-pro-preview

null

null

							input: 19479
							output: 51
							thoughts: 15
						

Here's my analysis of the situation:

**BRCMFMAC_USB Dependency Deep Dive**

Okay, so we're looking at the dependencies of `BRCMFMAC_USB`. My first instinct is to drill down, understand what this module *relies* on. I need to figure out the architectural implications. Is it a core driver, a specific interface implementation, or something more peripheral? Knowing the dependencies will tell me a lot. Are we talking about basic USB stack calls, or are there low-level hardware abstractions involved?

I'm thinking:
*   **Identify Critical Dependencies:** What are the absolute bare minimum components required for `BRCMFMAC_USB` to even load?
*   **Trace the Hierarchy:** Are there dependencies on other specific Broadcom components?
*   **Performance Considerations:** Could any dependencies introduce latency or bottlenecks?
*   **Potential Conflicts:** What are the chances this module shares resources with other components?
*   **Porting/Integration Challenges:** Knowing this is a "USB" implementation, I'll be keeping any eye on the interface, in case the platform has an unusual USB implementation.
*   **Versioning and Compatibility:** Does this module have dependencies on specific versions of libraries or other components?
*   **Maintainability and Testing:** Can I easily mock or simulate these dependencies for testing and debugging?

This is where the fun starts. Time to get my hands dirty and start exploring those dependency graphs!

{
  "File": "drivers/net/wireless/broadcom/brcm80211/brcmfmac/Kconfig",
  "FirstLine": 29,
  "LineCount": 10
}

{
  "Contents": "  29:\tconfig BRCMFMAC_USB\n  30:\t\tbool \"USB bus interface support for FullMAC driver\"\n  31:\t\tdepends on (USB = y || USB = BRCMFMAC)\n  32:\t\tdepends on BRCMFMAC\n  33:\t\tselect BRCMFMAC_PROTO_BCDC\n  34:\t\tselect FW_LOADER\n  35:\t\thelp\n  36:\t\t  This option enables the USB bus interface support for Broadcom\n  37:\t\t  IEEE802.11n embedded FullMAC WLAN driver. Say Y if you want to\n  38:\t\t  use the driver for an USB wireless card.\n"
}

gemini-3.1-pro-preview

null

null

							input: 20020
							output: 55
							thoughts: 357
						

**My Analysis of the Broadcom FullMAC Driver Patch**

Okay, let's break this down. From what I'm seeing, this patch hinges on a few key components: specifically, the `USB` dependency and the `BRCMFMAC` driver itself. Therefore, I need to make sure `BRCMFMAC` and `BRCMFMAC_USB` are accounted for in my assessment. They are the core of this.

Now, let's zero in on the modified functions. It looks like the primary focus here is on these: `brcmf_cfg80211_connect`, `brcmf_set_key_mgmt`, `brcmf_configure_wpaie`, and `brcmf_p2p_send_action_frame`.

Are there any other ancillary functions that got touched? Hmm, yes, I see a couple of static, inline functions – `brcmf_valid_dpp_suite` and `brcmf_p2p_is_dpp_pub_action`. They're probably related, but I'll focus on the main players for now. I'll include the main ones: `brcmf_cfg80211_connect`, `brcmf_set_key_mgmt`, `brcmf_configure_wpaie`, and `brcmf_p2p_send_action_frame`.

The reasoning is pretty clear: This patch is introducing support for the Wi-Fi Alliance DPP AKM suite and DPP public action frames within the Broadcom FullMAC driver. It's essentially reworking both the connection and AP setup paths, which means I need to pay close attention to how it parses this new AKM and handles SAE/FWSUP. Also, the P2P action frame transmission path is involved.

Crucially, these changes are reachable from user space through nl80211 commands, things like `connect`, `start_ap`, and `mgmt_tx`, especially when the driver's bound to an emulated USB device. It's a connection via USB that matters.

I should verify the implications to `brcmf_p2p_send_action_frame`.

{
  "Expression": "brcmf_p2p_send_action_frame",
  "PathPrefix": "drivers/net/wireless/broadcom/brcm80211/brcmfmac/"
}

{
  "Output": "drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c=5536=brcmf_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c-5627-\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:5628:\t\tack = brcmf_p2p_send_action_frame(cfg, cfg_to_ndev(cfg),\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c-5629-\t\t\t\t\t\t  af_params);\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c=1726=static bool brcmf_p2p_check_dwell_overflow(u32 requested_dwell,\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c-1737-/**\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c:1738: * brcmf_p2p_send_action_frame() - send action frame .\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c-1739- *\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c-1743- */\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c:1744:bool brcmf_p2p_send_action_frame(struct brcmf_cfg80211_info *cfg,\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c-1745-\t\t\t\t struct net_device *ndev,\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h=168=int brcmf_p2p_notify_action_tx_complete(struct brcmf_if *ifp,\n--\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h-170-\t\t\t\t\tvoid *data);\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h:171:bool brcmf_p2p_send_action_frame(struct brcmf_cfg80211_info *cfg,\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h-172-\t\t\t\t struct net_device *ndev,\n"
}

gemini-3.1-pro-preview

null

null

							input: 21666
							output: 207
							thoughts: 33
						

Okay, here's my interpretation of those thoughts, tailored for an expert audience, presented in the first person:

**Ready to Finalize the Mgmt Frame Transmission Results**

Right, so this is confirmation – the function being called is indeed `brcmf_cfg80211_mgmt_tx`. Good, that's the entry point I was expecting and confirms the correct control flow.

Now that I have confirmation of the function call, I can proceed with confidence. My focus is now shifted to populating and setting the appropriate result values and returning the corresponding state. I understand the surrounding context. It’s time to finalize the transaction.

{
  "EnableConfigs": [
    "BRCMFMAC",
    "BRCMFMAC_USB"
  ],
  "FocusSymbols": [
    "brcmf_cfg80211_connect",
    "brcmf_set_key_mgmt",
    "brcmf_configure_wpaie",
    "brcmf_p2p_send_action_frame"
  ],
  "Reasoning": "The patch adds support for the WFA DPP AKM suite and DPP public action frames to the Broadcom FullMAC driver (brcmfmac). It modifies connection and AP setup paths to parse the new AKM and handle SAE/FWSUP correctly, as well as the P2P action frame transmission path. These changes are reachable from user space via nl80211 commands (e.g., connect, start_ap, mgmt_tx) when the driver is bound to an emulated USB device.",
  "WorthFuzzing": true
}

{
  "EnableConfigs": [
    "BRCMFMAC",
    "BRCMFMAC_USB"
  ],
  "FocusSymbols": [
    "brcmf_cfg80211_connect",
    "brcmf_set_key_mgmt",
    "brcmf_configure_wpaie",
    "brcmf_p2p_send_action_frame"
  ],
  "Reasoning": "The patch adds support for the WFA DPP AKM suite and DPP public action frames to the Broadcom FullMAC driver (brcmfmac). It modifies connection and AP setup paths to parse the new AKM and handle SAE/FWSUP correctly, as well as the P2P action frame transmission path. These changes are reachable from user space via nl80211 commands (e.g., connect, start_ap, mgmt_tx) when the driver is bound to an emulated USB device.",
  "WorthFuzzing": true
}