AI Trajectory

null

{
  "EnableConfigs": [
    "MAC80211",
    "MAC80211_DEBUGFS",
    "CFG80211_DEBUGFS",
    "DEBUG_FS"
  ],
  "FocusSymbols": [
    "ieee80211_debugfs_remove_netdev",
    "ieee80211_debugfs_recreate_netdev",
    "ieee80211_debugfs_key_update_default"
  ],
  "KMSANReasoning": "The patch addresses debugfs lifetime management in mac80211 by zeroing dangling debugfs dentry pointers (default_unicast_key and default_multicast_key) upon interface debugfs removal and re-creating default key symlinks during interface debugfs recreation. \n\nThis change does not introduce or modify any uninitialized memory paths, heap/stack allocations, or kernel-to-user info leaks (e.g., via copy_to_user or netlink). Any potential memory management issues related to stale debugfs dentries or use-after-free conditions are addressed and detectable by KASAN. Therefore, a dedicated KMSAN fuzzing session is not warranted.",
  "NeedsKMSAN": false,
  "Reasoning": "The patch modifies mac80211's debugfs netdev handling by properly clearing default key debugfs pointers upon removal (ieee80211_debugfs_remove_netdev) and rebuilding default key debugfs links upon interface recreation (ieee80211_debugfs_recreate_netdev). This code is reachable and testable in virtual environments using mac80211_hwsim and nl80211 netlink commands. Fuzzing helps ensure that interface setup, link updates, and key updates do not produce stale or dangling dentry references or race conditions.",
  "WorthFuzzing": true
}

null

{
  "PatchDiff": "commit 1e48ac890db0558c114a5d6e2e48e3d5e3cdde65\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Mon Sep 7 17:15:07 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c\nindex f3c6a41e49119..a00b0776fdb1d 100644\n--- a/net/mac80211/debugfs_netdev.c\n+++ b/net/mac80211/debugfs_netdev.c\n@@ -20,6 +20,7 @@\n #include \"ieee80211_i.h\"\n #include \"rate.h\"\n #include \"debugfs.h\"\n+#include \"debugfs_key.h\"\n #include \"debugfs_netdev.h\"\n #include \"driver-ops.h\"\n \n@@ -1020,6 +1021,8 @@ void ieee80211_debugfs_remove_netdev(struct ieee80211_sub_if_data *sdata)\n \tdebugfs_remove_recursive(sdata-\u003evif.debugfs_dir);\n \tsdata-\u003evif.debugfs_dir = NULL;\n \tsdata-\u003edebugfs.subdir_stations = NULL;\n+\tsdata-\u003edebugfs.default_unicast_key = NULL;\n+\tsdata-\u003edebugfs.default_multicast_key = NULL;\n }\n \n void ieee80211_debugfs_rename_netdev(struct ieee80211_sub_if_data *sdata)\n@@ -1032,6 +1035,7 @@ void ieee80211_debugfs_recreate_netdev(struct ieee80211_sub_if_data *sdata,\n {\n \tieee80211_debugfs_remove_netdev(sdata);\n \tieee80211_debugfs_add_netdev(sdata, mld_vif);\n+\tieee80211_debugfs_key_update_default(sdata);\n \n \tif (sdata-\u003eflags \u0026 IEEE80211_SDATA_IN_DRIVER) {\n \t\tdrv_vif_add_debugfs(sdata-\u003elocal, sdata);\n"
}

core

null

{
  "EnableConfigs": [
    "MAC80211",
    "MAC80211_DEBUGFS",
    "CFG80211_DEBUGFS",
    "DEBUG_FS"
  ],
  "FocusSymbols": [
    "ieee80211_debugfs_remove_netdev",
    "ieee80211_debugfs_recreate_netdev",
    "ieee80211_debugfs_key_update_default"
  ],
  "Reasoning": "The patch modifies mac80211's debugfs netdev handling by properly clearing default key debugfs pointers upon removal (ieee80211_debugfs_remove_netdev) and rebuilding default key debugfs links upon interface recreation (ieee80211_debugfs_recreate_netdev). This code is reachable and testable in virtual environments using mac80211_hwsim and nl80211 netlink commands. Fuzzing helps ensure that interface setup, link updates, and key updates do not produce stale or dangling dentry references or race conditions.",
  "WorthFuzzing": true
}

You are an expert Linux kernel maintainer and security engineer.
Your job is to review a provided patch series and evaluate whether it warrants fuzzing with syzkaller.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on internal assumptions. You must actively use your code access
tools to inspect the actual source code, callers, and surrounding context.

================================================================================
1. CORE TRIAGE PHILOSOPHY
================================================================================
The goal of patch fuzzing is to discover crashes, regressions, exposed latent bugs,
and newly triggered assertions introduced by the patch series.

- REACHABILITY IS THE PRIMARY GATE:
  Fuzzing can only discover bugs in code that can actually execute in standard virtualized
  environments (GCE or QEMU, utilizing software-emulated devices like USB gadgets, netdev, tun/tap).
  If the modified code is structurally unreachable (see Section 2), it MUST NOT be fuzzed,
  regardless of whether it adds assertions or complex logic.

- DO NOT BLINDLY TRUST "NO FUNCTIONAL CHANGE" (NFCI) OR "REFACTORING" CLAIMS:
  Patch authors routinely label changes as "cleanups", "refactorings", or state
  "No functional change intended". Do NOT take these claims at face value.
  Code refactorings that rearrange logic, introduce helper functions, or alter state management
  in core subsystems frequently introduce subtle semantic shifts or uncover latent kernel bugs.
  If reachable executable code is modified or refactored, it MUST be fuzzed.

- NEW OR MODIFIED ASSERTIONS IN REACHABLE CODE MUST BE FUZZED:
  When a patch introduces or modifies runtime checks or assertions (e.g., WARN_ON*, VM_WARN_ON*,
  BUG_ON*, lockdep_assert*) in reachable code paths, it enforces new or stricter invariants.
  Even if the author believes the invariant always holds, fuzzing is essential to verify whether
  an unusual sequence of operations can violate it.

================================================================================
2. WHEN TO RETURN WorthFuzzing=false (NEGATIVE CRITERIA)
================================================================================
Return WorthFuzzing=false ONLY IF all modified code falls strictly into one or more of these categories:

- Non-kernel and non-executable changes:
  * Modifications to Documentation/, comments, or spelling fixes.
  * User-space directories, self-tests, samples, or scripts (e.g., tools/, samples/, scripts/, usr/)
    that do not affect the compiled kernel image (vmlinux) or kernel modules.
  * Purely decorative logging (e.g., message strings in pr_err, printk, dev_info) or tracepoints
    that do not alter control flow or data structures.
  * Build system or Kconfig changes that do not alter compiled C logic.
- Structurally unreachable hardware:
  * Vendor-specific PCIe switches, SmartNICs, or GPU drivers (e.g., mlxsw, pds_core, qed,
    ionic, amdgpu) requiring physical ASIC/PCIe cards not emulated in standard QEMU.
- Unreachable execution paths:
  * Driver teardown callbacks (.remove, .shutdown, pci_unregister_driver) executed only during
    physical PCI hot-unplug or manual sysfs driver unbinding.
  * Code paths exclusive to architectures other than the target architecture.

================================================================================
3. WHEN TO RETURN WorthFuzzing=true (POSITIVE CRITERIA)
================================================================================
Return WorthFuzzing=true whenever the patch touches reachable executable code, including:
- Core Subsystems:
  * Any logic modifications in memory management (mm/), synchronization/locking (kernel/locking/),
    BPF, scheduler, core networking, VFS, or syscall handling.
- Refactorings and Code Cleanups:
  * Any restructuring of reachable data structures, helper abstractions, or algorithm flows.
- Runtime Assertions and Defensive Checks:
  * Any introduction or alteration of assertions (WARN_ON*, VM_WARN_ON*, BUG_ON*, etc.) in reachable paths.
- Reachable Drivers and Protocols:
  * Drivers accessible via virtual buses (virtio, USB gadget, loopback, netlink, binder, sockets, etc.).

================================================================================
4. EXTRACTING FocusSymbols (PREVENTING DILUTION)
================================================================================
When WorthFuzzing=true, you must extract specific kernel functions into FocusSymbols to guide the fuzzer:

- AVOID UBIQUITOUS LIFECYCLE HOT-PATHS:
  Do NOT list generic, ubiquitous functions called by almost every program in the corpus
  (including, but not limited to: general memory allocators and deallocators, page fault
  and trap handlers, or core synchronization primitives; this is not an exhaustive list).
  Listing ubiquitous functions causes the fuzzer to classify thousands of unrelated tests as "focused",
  which severely dilutes fuzzing effort away from the actual changes.

- TARGET SPECIFIC FEATURE LOGIC AND ENTRYPOINTS:
  List functions that specifically implement the logic being added or altered, or direct API entrypoints
  for the subsystem feature under review.

- HANDLING STATIC INLINE FUNCTIONS IN HEADERS (.h):
  Compiler-inlined static functions (such as static inlines in mm/*.h or include/linux/*.h) lack
  distinct symbol addresses in vmlinux and cannot be targeted directly by symbol coverage filters.
  If the changes are primarily in static inline helpers, identify non-static, feature-specific caller
  functions in .c files that exercise them (avoiding ubiquitous lifecycle wrappers).

================================================================================
5. IDENTIFYING EnableConfigs
================================================================================
Identify any specific CONFIG_ options required to properly compile and reach the modified code:
- Inspect Kconfig files and #ifdef guards; do not make assumptions.
- Check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed.
- Strip any 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

Target architecture: amd64

For your convenience, here is the diff of the changes:
commit 1e48ac890db0558c114a5d6e2e48e3d5e3cdde65
Author: syz-cluster <triage@syzkaller.com>
Date:   Mon Sep 7 17:15:07 2026 +0000

    syz-cluster: applied patch under review

diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
index f3c6a41e49119..a00b0776fdb1d 100644
--- a/net/mac80211/debugfs_netdev.c
+++ b/net/mac80211/debugfs_netdev.c
@@ -20,6 +20,7 @@
 #include "ieee80211_i.h"
 #include "rate.h"
 #include "debugfs.h"
+#include "debugfs_key.h"
 #include "debugfs_netdev.h"
 #include "driver-ops.h"
 
@@ -1020,6 +1021,8 @@ void ieee80211_debugfs_remove_netdev(struct ieee80211_sub_if_data *sdata)
 	debugfs_remove_recursive(sdata->vif.debugfs_dir);
 	sdata->vif.debugfs_dir = NULL;
 	sdata->debugfs.subdir_stations = NULL;
+	sdata->debugfs.default_unicast_key = NULL;
+	sdata->debugfs.default_multicast_key = NULL;
 }
 
 void ieee80211_debugfs_rename_netdev(struct ieee80211_sub_if_data *sdata)
@@ -1032,6 +1035,7 @@ void ieee80211_debugfs_recreate_netdev(struct ieee80211_sub_if_data *sdata,
 {
 	ieee80211_debugfs_remove_netdev(sdata);
 	ieee80211_debugfs_add_netdev(sdata, mld_vif);
+	ieee80211_debugfs_key_update_default(sdata);
 
 	if (sdata->flags & IEEE80211_SDATA_IN_DRIVER) {
 		drv_vif_add_debugfs(sdata->local, sdata);

gemini-3.7-flash

null

null

							input: 3213
							output: 30
							thoughts: 641
						

**Fuzzing Suitability Evaluation**

Okay, so I'm looking at this patch and trying to decide if it's worth fuzzing with syzkaller. First, let's take a step back and do a quick risk assessment. This is a QA/triage task, evaluating a Linux kernel patch. Seems like a benign, defensive effort. Good.

Now, I'll dive into the code. I've got the diff here, and it looks like it's touching `net/mac80211/debugfs_netdev.c`. Specifically, it's adding a new include, `"debugfs_key.h"`, and modifying the `ieee80211_debugfs_remove_netdev`, `ieee80211_debugfs_recreate_netdev` functions. I see it's removing and setting a couple of debugfs pointers (`default_unicast_key`, `default_multicast_key`), and there's a new call to `ieee80211_debugfs_key_update_default`. So, clearly, this has something to do with default keys within the mac80211 debugfs interface.

I'll need to dig deeper. I need to understand what `debugfs_key.h` is all about. I'll need to search the codebase with grep (or maybe just read the file directly!) to see how these keys are used, what the update function does, and where the potential new code paths are introduced. Understanding the surrounding code, especially the key update, will be key to deciding if this opens up new areas for fuzzing. Are we setting up new entry points, new data structures, new ways to interact with the kernel? Or is this just a clean up of a memory leak? Only time will tell!

{
  "Expression": "ieee80211_debugfs_recreate_netdev"
}

{
  "Output": "net/mac80211/debugfs_netdev.c=1028=void ieee80211_debugfs_rename_netdev(struct ieee80211_sub_if_data *sdata)\n--\nnet/mac80211/debugfs_netdev.c-1032-\nnet/mac80211/debugfs_netdev.c:1033:void ieee80211_debugfs_recreate_netdev(struct ieee80211_sub_if_data *sdata,\nnet/mac80211/debugfs_netdev.c-1034-\t\t\t\t       bool mld_vif)\n--\nnet/mac80211/debugfs_netdev.h=15=void ieee80211_debugfs_rename_netdev(struct ieee80211_sub_if_data *sdata);\nnet/mac80211/debugfs_netdev.h:16:void ieee80211_debugfs_recreate_netdev(struct ieee80211_sub_if_data *sdata,\nnet/mac80211/debugfs_netdev.h-17-\t\t\t\t       bool mld_vif);\n--\nnet/mac80211/debugfs_netdev.h=28=static inline void ieee80211_debugfs_rename_netdev(\n--\nnet/mac80211/debugfs_netdev.h-30-{}\nnet/mac80211/debugfs_netdev.h:31:static inline void ieee80211_debugfs_recreate_netdev(\nnet/mac80211/debugfs_netdev.h-32-\tstruct ieee80211_sub_if_data *sdata, bool mld_vif)\n--\nnet/mac80211/driver-ops.c=108=void drv_remove_interface(struct ieee80211_local *local,\n--\nnet/mac80211/driver-ops.c-124-\tif (sdata != rcu_access_pointer(local-\u003emonitor_sdata))\nnet/mac80211/driver-ops.c:125:\t\tieee80211_debugfs_recreate_netdev(sdata,\nnet/mac80211/driver-ops.c-126-\t\t\t\t\t\t  sdata-\u003evif.valid_links);\n--\nnet/mac80211/iface.c=1878=static void ieee80211_setup_sdata(struct ieee80211_sub_if_data *sdata,\n--\nnet/mac80211/iface.c-1976-\nnet/mac80211/iface.c:1977:\tieee80211_debugfs_recreate_netdev(sdata, false);\nnet/mac80211/iface.c-1978-}\n--\nnet/mac80211/link.c=287=static int ieee80211_vif_update_links(struct ieee80211_sub_if_data *sdata,\n--\nnet/mac80211/link.c-352-\tif (!old_links)\nnet/mac80211/link.c:353:\t\tieee80211_debugfs_recreate_netdev(sdata, true);\nnet/mac80211/link.c-354-\n--\nnet/mac80211/link.c-384-\t\tif (!new_links)\nnet/mac80211/link.c:385:\t\t\tieee80211_debugfs_recreate_netdev(sdata, false);\nnet/mac80211/link.c-386-\n"
}

gemini-3.7-flash

null

null

							input: 5286
							output: 45
							thoughts: 66
						

Here's my take on those files...

**Diving into mac80211 DebugFS**

Okay, so I'm looking at `mac80211`'s debug filesystem implementations – specifically, `debugfs_key.c` and `debugfs_netdev.c`. I'm going to want to understand how they hook into the existing debugfs framework. The goal here is to get a handle on how these mechanisms are designed for inspection and potential manipulation of wireless keys and network device states within the mac80211 context. I'll need to see how they've structured the file hierarchy, the permissions, and the actual read/write handlers they've implemented. My expectation is the framework will allow for examination of key data, association parameters, and driver-specific statistics, and probably the ability to enable/disable certain debugging flags. I'll also check how these debugfs entries interact with the mac80211 core and its associated network devices, looking for specific functions they use to register and unregister their debugfs entries in the device lifecycle.

{
  "File": "net/mac80211/debugfs_netdev.c",
  "FirstLine": 1010,
  "LineCount": 40
}

{
  "Contents": "1010:\t\t\t\t\t\t\t\tsdata-\u003evif.debugfs_dir);\n1011:\t\tadd_files(sdata);\n1012:\t\tif (!mld_vif)\n1013:\t\t\tadd_link_files(\u0026sdata-\u003edeflink, sdata-\u003evif.debugfs_dir);\n1014:\t}\n1015:\t\n1016:\tvoid ieee80211_debugfs_remove_netdev(struct ieee80211_sub_if_data *sdata)\n1017:\t{\n1018:\t\tif (!sdata-\u003evif.debugfs_dir)\n1019:\t\t\treturn;\n1020:\t\n1021:\t\tdebugfs_remove_recursive(sdata-\u003evif.debugfs_dir);\n1022:\t\tsdata-\u003evif.debugfs_dir = NULL;\n1023:\t\tsdata-\u003edebugfs.subdir_stations = NULL;\n1024:\t\tsdata-\u003edebugfs.default_unicast_key = NULL;\n1025:\t\tsdata-\u003edebugfs.default_multicast_key = NULL;\n1026:\t}\n1027:\t\n1028:\tvoid ieee80211_debugfs_rename_netdev(struct ieee80211_sub_if_data *sdata)\n1029:\t{\n1030:\t\tdebugfs_change_name(sdata-\u003evif.debugfs_dir, \"netdev:%s\", sdata-\u003ename);\n1031:\t}\n1032:\t\n1033:\tvoid ieee80211_debugfs_recreate_netdev(struct ieee80211_sub_if_data *sdata,\n1034:\t\t\t\t\t       bool mld_vif)\n1035:\t{\n1036:\t\tieee80211_debugfs_remove_netdev(sdata);\n1037:\t\tieee80211_debugfs_add_netdev(sdata, mld_vif);\n1038:\t\tieee80211_debugfs_key_update_default(sdata);\n1039:\t\n1040:\t\tif (sdata-\u003eflags \u0026 IEEE80211_SDATA_IN_DRIVER) {\n1041:\t\t\tdrv_vif_add_debugfs(sdata-\u003elocal, sdata);\n1042:\t\t\tif (!mld_vif)\n1043:\t\t\t\tieee80211_link_debugfs_drv_add(\u0026sdata-\u003edeflink);\n1044:\t\t}\n1045:\t}\n1046:\t\n1047:\tvoid ieee80211_link_debugfs_add(struct ieee80211_link_data *link)\n1048:\t{\n1049:\t\tchar link_dir_name[10];\n"
}

gemini-3.7-flash

null

null

							input: 6386
							output: 37
							thoughts: 65
						

Here's my take on those thoughts:

**Dissecting the Debugfs Key Update Process**

Okay, so I need to get a handle on how this `ieee80211_debugfs_key_update_default` function operates and, crucially, how debugfs key files are actually generated within the system. My first instinct is always to dig into the code and see exactly what it's doing. I'll need to know where the default unicast key is defined and how this update function interacts with it. To do that, I'm going to start with a targeted grep. I'll look for both `default_unicast_key` and, of course, the `ieee80211_debugfs_key_update_default` function itself. That should give me a good jumping-off point to trace the code and see what's happening. I expect I'll be able to quickly identify the relevant file paths and variables, then dive deeper if the initial results warrant it.

{
  "Expression": "ieee80211_debugfs_key_update_default|default_unicast_key"
}

{
  "Output": "drivers/net/wireless/ath/ath10k/mac.c=6560=static int ath10k_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,\n--\ndrivers/net/wireless/ath/ath10k/mac.c-6650-\t\t *\ndrivers/net/wireless/ath/ath10k/mac.c:6651:\t\t * Static WEP sets def_wep_key_idx via .set_default_unicast_key\ndrivers/net/wireless/ath/ath10k/mac.c-6652-\t\t * after first set_key().\n--\ndrivers/net/wireless/ath/ath10k/mac.c-6714-\ndrivers/net/wireless/ath/ath10k/mac.c:6715:static void ath10k_set_default_unicast_key(struct ieee80211_hw *hw,\ndrivers/net/wireless/ath/ath10k/mac.c-6716-\t\t\t\t\t   struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/ath/ath10k/mac.c=9472=static const struct ieee80211_ops ath10k_ops = {\n--\ndrivers/net/wireless/ath/ath10k/mac.c-9486-\t.set_key\t\t\t= ath10k_set_key,\ndrivers/net/wireless/ath/ath10k/mac.c:9487:\t.set_default_unicast_key        = ath10k_set_default_unicast_key,\ndrivers/net/wireless/ath/ath10k/mac.c-9488-\t.sta_state\t\t\t= ath10k_sta_state,\n--\ndrivers/net/wireless/intel/iwlwifi/mvm/d3.c=41=void iwl_mvm_ipv6_addr_change(struct ieee80211_hw *hw,\n--\ndrivers/net/wireless/intel/iwlwifi/mvm/d3.c-65-\ndrivers/net/wireless/intel/iwlwifi/mvm/d3.c:66:void iwl_mvm_set_default_unicast_key(struct ieee80211_hw *hw,\ndrivers/net/wireless/intel/iwlwifi/mvm/d3.c-67-\t\t\t\t     struct ieee80211_vif *vif, int idx)\n--\ndrivers/net/wireless/intel/iwlwifi/mvm/mac80211.c=6351=const struct ieee80211_ops iwl_mvm_hw_ops = {\n--\ndrivers/net/wireless/intel/iwlwifi/mvm/mac80211.c-6426-#endif\ndrivers/net/wireless/intel/iwlwifi/mvm/mac80211.c:6427:\t.set_default_unicast_key = iwl_mvm_set_default_unicast_key,\ndrivers/net/wireless/intel/iwlwifi/mvm/mac80211.c-6428-#endif\n--\ndrivers/net/wireless/intel/iwlwifi/mvm/mld-mac80211.c=889=const struct ieee80211_ops iwl_mvm_mld_hw_ops = {\n--\ndrivers/net/wireless/intel/iwlwifi/mvm/mld-mac80211.c-963-#endif\ndrivers/net/wireless/intel/iwlwifi/mvm/mld-mac80211.c:964:\t.set_default_unicast_key = iwl_mvm_set_default_unicast_key,\ndrivers/net/wireless/intel/iwlwifi/mvm/mld-mac80211.c-965-#endif\n--\ndrivers/net/wireless/intel/iwlwifi/mvm/mvm.h=2147=void iwl_mvm_ipv6_addr_change(struct ieee80211_hw *hw,\n--\ndrivers/net/wireless/intel/iwlwifi/mvm/mvm.h-2149-\t\t\t      struct inet6_dev *idev);\ndrivers/net/wireless/intel/iwlwifi/mvm/mvm.h:2150:void iwl_mvm_set_default_unicast_key(struct ieee80211_hw *hw,\ndrivers/net/wireless/intel/iwlwifi/mvm/mvm.h-2151-\t\t\t\t     struct ieee80211_vif *vif, int idx);\n--\ndrivers/net/wireless/silabs/wfx/main.c=130=static const struct ieee80211_ops wfx_ops = {\n--\ndrivers/net/wireless/silabs/wfx/main.c-149-\t.set_rts_threshold       = wfx_set_rts_threshold,\ndrivers/net/wireless/silabs/wfx/main.c:150:\t.set_default_unicast_key = wfx_set_default_unicast_key,\ndrivers/net/wireless/silabs/wfx/main.c-151-\t.bss_info_changed        = wfx_bss_info_changed,\n--\ndrivers/net/wireless/silabs/wfx/sta.c=250=static void wfx_beacon_loss_work(struct work_struct *work)\n--\ndrivers/net/wireless/silabs/wfx/sta.c-260-\ndrivers/net/wireless/silabs/wfx/sta.c:261:void wfx_set_default_unicast_key(struct ieee80211_hw *hw, struct ieee80211_vif *vif, int idx)\ndrivers/net/wireless/silabs/wfx/sta.c-262-{\n--\ndrivers/net/wireless/silabs/wfx/sta.h=25=int wfx_set_rts_threshold(struct ieee80211_hw *hw, int radio_idx, u32 value);\ndrivers/net/wireless/silabs/wfx/sta.h:26:void wfx_set_default_unicast_key(struct ieee80211_hw *hw, struct ieee80211_vif *vif, int idx);\ndrivers/net/wireless/silabs/wfx/sta.h-27-void wfx_configure_filter(struct ieee80211_hw *hw, unsigned int changed_flags,\n--\ndrivers/net/wireless/ti/wlcore/main.c=6000=static const struct ieee80211_ops wl1271_ops = {\n--\ndrivers/net/wireless/ti/wlcore/main.c-6029-\t.set_bitrate_mask = wl12xx_set_bitrate_mask,\ndrivers/net/wireless/ti/wlcore/main.c:6030:\t.set_default_unicast_key = wl1271_op_set_default_key_idx,\ndrivers/net/wireless/ti/wlcore/main.c-6031-\t.channel_switch = wl12xx_op_channel_switch,\n--\ninclude/net/mac80211.h=3460=void ieee80211_purge_tx_queue(struct ieee80211_hw *hw,\n--\ninclude/net/mac80211.h-3512- *\ninclude/net/mac80211.h:3513: * The set_default_unicast_key() call updates the default WEP key index\ninclude/net/mac80211.h-3514- * configured to the hardware for WEP encryption type. This is required\n--\ninclude/net/mac80211.h=4068=struct ieee80211_prep_tx_info {\n--\ninclude/net/mac80211.h-4217- *\ninclude/net/mac80211.h:4218: * @set_default_unicast_key: Set the default (unicast) key index, useful for\ninclude/net/mac80211.h-4219- *\tWEP when the device sends data packets autonomously, e.g. for ARP\n--\ninclude/net/mac80211.h=4742=struct ieee80211_ops {\n--\ninclude/net/mac80211.h-4800-\t\t\t       struct cfg80211_gtk_rekey_data *data);\ninclude/net/mac80211.h:4801:\tvoid (*set_default_unicast_key)(struct ieee80211_hw *hw,\ninclude/net/mac80211.h-4802-\t\t\t\t\tstruct ieee80211_vif *vif, int idx);\n--\nnet/mac80211/debugfs_key.c=361=void ieee80211_debugfs_key_remove(struct ieee80211_key *key)\n--\nnet/mac80211/debugfs_key.c-369-\nnet/mac80211/debugfs_key.c:370:void ieee80211_debugfs_key_update_default(struct ieee80211_sub_if_data *sdata)\nnet/mac80211/debugfs_key.c-371-{\n--\nnet/mac80211/debugfs_key.c-379-\nnet/mac80211/debugfs_key.c:380:\tdebugfs_remove(sdata-\u003edebugfs.default_unicast_key);\nnet/mac80211/debugfs_key.c:381:\tsdata-\u003edebugfs.default_unicast_key = NULL;\nnet/mac80211/debugfs_key.c-382-\nnet/mac80211/debugfs_key.c:383:\tif (sdata-\u003edefault_unicast_key) {\nnet/mac80211/debugfs_key.c-384-\t\tkey = wiphy_dereference(sdata-\u003elocal-\u003ehw.wiphy,\nnet/mac80211/debugfs_key.c:385:\t\t\t\t\tsdata-\u003edefault_unicast_key);\nnet/mac80211/debugfs_key.c-386-\t\tsprintf(buf, \"../keys/%d\", key-\u003edebugfs.cnt);\nnet/mac80211/debugfs_key.c:387:\t\tsdata-\u003edebugfs.default_unicast_key =\nnet/mac80211/debugfs_key.c:388:\t\t\tdebugfs_create_symlink(\"default_unicast_key\",\nnet/mac80211/debugfs_key.c-389-\t\t\t\t\t       sdata-\u003evif.debugfs_dir, buf);\n--\nnet/mac80211/debugfs_key.h=7=void ieee80211_debugfs_key_remove(struct ieee80211_key *key);\nnet/mac80211/debugfs_key.h:8:void ieee80211_debugfs_key_update_default(struct ieee80211_sub_if_data *sdata);\nnet/mac80211/debugfs_key.h-9-void ieee80211_debugfs_key_remove_mgmt_default(\n--\nnet/mac80211/debugfs_key.h=16=static inline void ieee80211_debugfs_key_remove(struct ieee80211_key *key)\nnet/mac80211/debugfs_key.h-17-{}\nnet/mac80211/debugfs_key.h:18:static inline void ieee80211_debugfs_key_update_default(\nnet/mac80211/debugfs_key.h-19-\tstruct ieee80211_sub_if_data *sdata)\n--\nnet/mac80211/debugfs_netdev.c=1016=void ieee80211_debugfs_remove_netdev(struct ieee80211_sub_if_data *sdata)\n--\nnet/mac80211/debugfs_netdev.c-1023-\tsdata-\u003edebugfs.subdir_stations = NULL;\nnet/mac80211/debugfs_netdev.c:1024:\tsdata-\u003edebugfs.default_unicast_key = NULL;\nnet/mac80211/debugfs_netdev.c-1025-\tsdata-\u003edebugfs.default_multicast_key = NULL;\n--\nnet/mac80211/debugfs_netdev.c=1033=void ieee80211_debugfs_recreate_netdev(struct ieee80211_sub_if_data *sdata,\n--\nnet/mac80211/debugfs_netdev.c-1037-\tieee80211_debugfs_add_netdev(sdata, mld_vif);\nnet/mac80211/debugfs_netdev.c:1038:\tieee80211_debugfs_key_update_default(sdata);\nnet/mac80211/debugfs_netdev.c-1039-\n--\nnet/mac80211/driver-ops.h=1123=static inline void\nnet/mac80211/driver-ops.h:1124:drv_set_default_unicast_key(struct ieee80211_local *local,\nnet/mac80211/driver-ops.h-1125-\t\t\t    struct ieee80211_sub_if_data *sdata,\n--\nnet/mac80211/driver-ops.h-1135-\nnet/mac80211/driver-ops.h:1136:\ttrace_drv_set_default_unicast_key(local, sdata, key_idx);\nnet/mac80211/driver-ops.h:1137:\tif (local-\u003eops-\u003eset_default_unicast_key)\nnet/mac80211/driver-ops.h:1138:\t\tlocal-\u003eops-\u003eset_default_unicast_key(\u0026local-\u003ehw, \u0026sdata-\u003evif,\nnet/mac80211/driver-ops.h-1139-\t\t\t\t\t\t    key_idx);\n--\nnet/mac80211/ieee80211_i.h=1166=struct ieee80211_sub_if_data {\n--\nnet/mac80211/ieee80211_i.h-1196-\tstruct ieee80211_key __rcu *keys[NUM_DEFAULT_KEYS];\nnet/mac80211/ieee80211_i.h:1197:\tstruct ieee80211_key __rcu *default_unicast_key;\nnet/mac80211/ieee80211_i.h-1198-\n--\nnet/mac80211/ieee80211_i.h-1256-\t\tstruct dentry *subdir_stations;\nnet/mac80211/ieee80211_i.h:1257:\t\tstruct dentry *default_unicast_key;\nnet/mac80211/ieee80211_i.h-1258-\t\tstruct dentry *default_multicast_key;\n--\nnet/mac80211/key.c=350=static void __ieee80211_set_default_key(struct ieee80211_link_data *link,\n--\nnet/mac80211/key.c-366-\tif (uni) {\nnet/mac80211/key.c:367:\t\trcu_assign_pointer(sdata-\u003edefault_unicast_key, key);\nnet/mac80211/key.c-368-\t\tieee80211_check_fast_xmit_iface(sdata);\nnet/mac80211/key.c-369-\t\tif (sdata-\u003evif.type != NL80211_IFTYPE_AP_VLAN)\nnet/mac80211/key.c:370:\t\t\tdrv_set_default_unicast_key(sdata-\u003elocal, sdata, idx);\nnet/mac80211/key.c-371-\t}\n--\nnet/mac80211/key.c-375-\nnet/mac80211/key.c:376:\tieee80211_debugfs_key_update_default(sdata);\nnet/mac80211/key.c-377-}\n--\nnet/mac80211/key.c=388=__ieee80211_set_default_mgmt_key(struct ieee80211_link_data *link, int idx)\n--\nnet/mac80211/key.c-401-\nnet/mac80211/key.c:402:\tieee80211_debugfs_key_update_default(sdata);\nnet/mac80211/key.c-403-}\n--\nnet/mac80211/key.c=414=__ieee80211_set_default_beacon_key(struct ieee80211_link_data *link, int idx)\n--\nnet/mac80211/key.c-428-\nnet/mac80211/key.c:429:\tieee80211_debugfs_key_update_default(sdata);\nnet/mac80211/key.c-430-}\n--\nnet/mac80211/key.c=440=static int ieee80211_key_replace(struct ieee80211_sub_if_data *sdata,\n--\nnet/mac80211/key.c-549-\t\t\told == wiphy_dereference(sdata-\u003elocal-\u003ehw.wiphy,\nnet/mac80211/key.c:550:\t\t\t\t\t\t sdata-\u003edefault_unicast_key);\nnet/mac80211/key.c-551-\t\tdefmultikey = old \u0026\u0026\n--\nnet/mac80211/key.c=1087=static void ieee80211_free_keys_iface(struct ieee80211_sub_if_data *sdata,\n--\nnet/mac80211/key.c-1105-\nnet/mac80211/key.c:1106:\tieee80211_debugfs_key_update_default(sdata);\nnet/mac80211/key.c-1107-}\n--\nnet/mac80211/mesh_pathtbl.c=463=void mesh_fast_tx_cache(struct ieee80211_sub_if_data *sdata,\n--\nnet/mac80211/mesh_pathtbl.c-523-\tif (!key)\nnet/mac80211/mesh_pathtbl.c:524:\t\tkey = rcu_access_pointer(sdata-\u003edefault_unicast_key);\nnet/mac80211/mesh_pathtbl.c-525-\tbuild.fast_tx.key = key;\n--\nnet/mac80211/rx.c=4720=void ieee80211_check_fast_rx(struct sta_info *sta)\n--\nnet/mac80211/rx.c-4820-\tif (!key)\nnet/mac80211/rx.c:4821:\t\tkey = rcu_dereference(sdata-\u003edefault_unicast_key);\nnet/mac80211/rx.c-4822-\tif (key) {\n--\nnet/mac80211/trace.h=2151=DEFINE_EVENT(local_sdata_evt, drv_abort_pmsr,\n--\nnet/mac80211/trace.h-2156-\nnet/mac80211/trace.h:2157:TRACE_EVENT(drv_set_default_unicast_key,\nnet/mac80211/trace.h-2158-\tTP_PROTO(struct ieee80211_local *local,\n--\nnet/mac80211/tx.c=599=ieee80211_select_key_8023(struct ieee80211_tx_data *tx)\n--\nnet/mac80211/tx.c-608-\t\tif (!tx-\u003ekey)\nnet/mac80211/tx.c:609:\t\t\ttx-\u003ekey = rcu_dereference(tx-\u003esdata-\u003edefault_unicast_key);\nnet/mac80211/tx.c-610-\n--\nnet/mac80211/tx.c=630=ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)\n--\nnet/mac80211/tx.c-649-\telse if (!is_multicast_ether_addr(hdr-\u003eaddr1) \u0026\u0026\nnet/mac80211/tx.c:650:\t\t (key = rcu_dereference(tx-\u003esdata-\u003edefault_unicast_key)))\nnet/mac80211/tx.c-651-\t\ttx-\u003ekey = key;\n--\nnet/mac80211/tx.c=3072=void ieee80211_check_fast_xmit(struct sta_info *sta)\n--\nnet/mac80211/tx.c-3235-\tif (!build.key)\nnet/mac80211/tx.c:3236:\t\tbuild.key = rcu_access_pointer(sdata-\u003edefault_unicast_key);\nnet/mac80211/tx.c-3237-\tif (build.key) {\n--\nnet/mac80211/tx.c=4815=static void __ieee80211_subif_start_xmit_8023(struct sk_buff *skb,\n--\nnet/mac80211/tx.c-4852-\t\tif (!key)\nnet/mac80211/tx.c:4853:\t\t\tkey = rcu_dereference(sdata-\u003edefault_unicast_key);\nnet/mac80211/tx.c-4854-\t}\n"
}

gemini-3.7-flash

null

null

							input: 12617
							output: 43
							thoughts: 44
						

Okay, here's my summary, taking on the persona you requested:

**Diving into `debugfs_key.c` for Default Key Updates**

Alright, let's get down to brass tacks. I need to understand exactly how the `ieee80211_debugfs_key_update_default` function operates within `net/mac80211/debugfs_key.c`. I'm familiar with mac80211's overall architecture, so I expect this function plays a crucial role in managing default encryption keys, likely through the debugfs interface. I anticipate this function is responsible for the actual mechanism of setting, updating, and potentially removing the default key configuration that the wireless stack uses. Given the location within the `debugfs_key.c` file, I'll be looking for how this function interacts with debugfs entries - likely to expose key manipulation to developers and debugging.
I'll pay close attention to the data structures it manipulates, any error handling it implements, and how it interacts with the underlying key management system of mac80211. Specifically, I'll be considering the interface, input and output of this function. Given my current project, I'm thinking about edge cases, security, and possible race conditions that may come up.

{
  "File": "net/mac80211/debugfs_key.c",
  "FirstLine": 365,
  "LineCount": 60
}

{
  "Contents": " 365:\t\n 366:\t\tdebugfs_remove_recursive(key-\u003edebugfs.dir);\n 367:\t\tkey-\u003edebugfs.dir = NULL;\n 368:\t}\n 369:\t\n 370:\tvoid ieee80211_debugfs_key_update_default(struct ieee80211_sub_if_data *sdata)\n 371:\t{\n 372:\t\tchar buf[50];\n 373:\t\tstruct ieee80211_key *key;\n 374:\t\n 375:\t\tif (!sdata-\u003evif.debugfs_dir)\n 376:\t\t\treturn;\n 377:\t\n 378:\t\tlockdep_assert_wiphy(sdata-\u003elocal-\u003ehw.wiphy);\n 379:\t\n 380:\t\tdebugfs_remove(sdata-\u003edebugfs.default_unicast_key);\n 381:\t\tsdata-\u003edebugfs.default_unicast_key = NULL;\n 382:\t\n 383:\t\tif (sdata-\u003edefault_unicast_key) {\n 384:\t\t\tkey = wiphy_dereference(sdata-\u003elocal-\u003ehw.wiphy,\n 385:\t\t\t\t\t\tsdata-\u003edefault_unicast_key);\n 386:\t\t\tsprintf(buf, \"../keys/%d\", key-\u003edebugfs.cnt);\n 387:\t\t\tsdata-\u003edebugfs.default_unicast_key =\n 388:\t\t\t\tdebugfs_create_symlink(\"default_unicast_key\",\n 389:\t\t\t\t\t\t       sdata-\u003evif.debugfs_dir, buf);\n 390:\t\t}\n 391:\t\n 392:\t\tdebugfs_remove(sdata-\u003edebugfs.default_multicast_key);\n 393:\t\tsdata-\u003edebugfs.default_multicast_key = NULL;\n 394:\t\n 395:\t\tif (sdata-\u003edeflink.default_multicast_key) {\n 396:\t\t\tkey = wiphy_dereference(sdata-\u003elocal-\u003ehw.wiphy,\n 397:\t\t\t\t\t\tsdata-\u003edeflink.default_multicast_key);\n 398:\t\t\tsprintf(buf, \"../keys/%d\", key-\u003edebugfs.cnt);\n 399:\t\t\tsdata-\u003edebugfs.default_multicast_key =\n 400:\t\t\t\tdebugfs_create_symlink(\"default_multicast_key\",\n 401:\t\t\t\t\t\t       sdata-\u003evif.debugfs_dir, buf);\n 402:\t\t}\n 403:\t}\n 404:\t\n 405:\tvoid ieee80211_debugfs_key_remove_mgmt_default(struct ieee80211_sub_if_data *sdata)\n 406:\t{\n 407:\t\tif (!sdata)\n 408:\t\t\treturn;\n 409:\t\n 410:\t\tdebugfs_remove(sdata-\u003edebugfs.default_mgmt_key);\n 411:\t\tsdata-\u003edebugfs.default_mgmt_key = NULL;\n 412:\t}\n 413:\t\n 414:\tvoid\n 415:\tieee80211_debugfs_key_remove_beacon_default(struct ieee80211_sub_if_data *sdata)\n 416:\t{\n 417:\t\tif (!sdata)\n 418:\t\t\treturn;\n 419:\t\n 420:\t\tdebugfs_remove(sdata-\u003edebugfs.default_beacon_key);\n 421:\t\tsdata-\u003edebugfs.default_beacon_key = NULL;\n 422:\t}\n"
}

gemini-3.7-flash

null

null

							input: 13943
							output: 22
							thoughts: 426
						

**My Analysis of the mac80211 Debugfs Issue**

Okay, so let's break this down. `ieee80211_debugfs_remove_netdev` removes the entire debugfs directory associated with a specific station data (`sdata->vif.debugfs_dir`) recursively. The core problem was that, before this patch, we were potentially left with dangling pointers in `sdata->debugfs.default_unicast_key` and `sdata->debugfs.default_multicast_key` if we removed the debugfs directory recursively.

The problematic scenario arose when `ieee80211_debugfs_recreate_netdev` was called. It would correctly remove the old netdev and then add a new one, but crucially, it *wasn't* updating the default keys. This meant `default_unicast_key` and `default_multicast_key` could become stale, pointing to memory that had been freed, or be entirely lost as the new netdev came into existence.

The fix is straightforward. In `ieee80211_debugfs_remove_netdev`, we now explicitly set `sdata->debugfs.default_unicast_key` and `sdata->debugfs.default_multicast_key` to `NULL`. This cleans up the old key pointers on removal. And in `ieee80211_debugfs_recreate_netdev`, we've added a call to `ieee80211_debugfs_key_update_default(sdata)` after the recreate to re-initialize the default keys for the new netdev. This ensures that the default keys are always kept consistent.

Now, as an aside, I'm thinking about the real-world implications, specifically regarding fuzzing. Let's consider reachability. Given that syzkaller is heavily fuzzed by the `mac80211_hwsim` which creates virtual mac80211 devices in virtualized environments like QEMU and GCE kernels, then yes, mac80211 is *definitely* reachable in syzkaller. That's excellent news. Given the popularity of nl80211, mac80211 is one of the most heavily fuzzed areas in syzkaller. This particular area of code will be getting tested a lot. And, as a double-check, it's worth reviewing the Kconfig settings to confirm that debugfs support is enabled.

{
  "Expression": "MAC80211_DEBUGFS"
}

{
  "Output": "arch/mips/configs/ath25_defconfig=34=CONFIG_MAC80211=m\narch/mips/configs/ath25_defconfig:35:CONFIG_MAC80211_DEBUGFS=y\narch/mips/configs/ath25_defconfig-36-CONFIG_MTD=y\n--\narch/mips/configs/ath79_defconfig=28=CONFIG_MAC80211=m\narch/mips/configs/ath79_defconfig:29:CONFIG_MAC80211_DEBUGFS=y\narch/mips/configs/ath79_defconfig-30-CONFIG_MTD=y\n--\narch/powerpc/configs/ppc6xx_defconfig=288=CONFIG_MAC80211_LEDS=y\narch/powerpc/configs/ppc6xx_defconfig:289:CONFIG_MAC80211_DEBUGFS=y\narch/powerpc/configs/ppc6xx_defconfig-290-CONFIG_NET_9P=m\n--\ndrivers/net/wireless/ath/ath10k/Makefile=22=ath10k_core-$(CONFIG_ATH10K_LEDS) += leds.o\ndrivers/net/wireless/ath/ath10k/Makefile:23:ath10k_core-$(CONFIG_MAC80211_DEBUGFS) += debugfs_sta.o\ndrivers/net/wireless/ath/ath10k/Makefile-24-ath10k_core-$(CONFIG_PM) += wow.o\n--\ndrivers/net/wireless/ath/ath10k/core.h=523=struct ath10k_sta {\n--\ndrivers/net/wireless/ath/ath10k/core.h-546-\ndrivers/net/wireless/ath/ath10k/core.h:547:#ifdef CONFIG_MAC80211_DEBUGFS\ndrivers/net/wireless/ath/ath10k/core.h-548-\t/* protected by conf_mutex */\n--\ndrivers/net/wireless/ath/ath10k/debug.c=2524=int ath10k_debug_register(struct ath10k *ar)\n--\ndrivers/net/wireless/ath/ath10k/debug.c-2623-\ndrivers/net/wireless/ath/ath10k/debug.c:2624:\tif (IS_ENABLED(CONFIG_MAC80211_DEBUGFS))\ndrivers/net/wireless/ath/ath10k/debug.c-2625-\t\tdebugfs_create_file(\"sta_tid_stats_mask\", 0600,\n--\ndrivers/net/wireless/ath/ath10k/debug.h=199=static inline int ath10k_debug_fw_stats_request(struct ath10k *ar)\n--\ndrivers/net/wireless/ath/ath10k/debug.h-210-#endif /* CONFIG_ATH10K_DEBUGFS */\ndrivers/net/wireless/ath/ath10k/debug.h:211:#ifdef CONFIG_MAC80211_DEBUGFS\ndrivers/net/wireless/ath/ath10k/debug.h-212-void ath10k_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/ath/ath10k/debug.h=246=void ath10k_sta_update_rx_tid_stats_ampdu(struct ath10k *ar,\n--\ndrivers/net/wireless/ath/ath10k/debug.h-251-}\ndrivers/net/wireless/ath/ath10k/debug.h:252:#endif /* CONFIG_MAC80211_DEBUGFS */\ndrivers/net/wireless/ath/ath10k/debug.h-253-\n--\ndrivers/net/wireless/ath/ath10k/mac.c=9472=static const struct ieee80211_ops ath10k_ops = {\n--\ndrivers/net/wireless/ath/ath10k/mac.c-9525-#endif\ndrivers/net/wireless/ath/ath10k/mac.c:9526:#ifdef CONFIG_MAC80211_DEBUGFS\ndrivers/net/wireless/ath/ath10k/mac.c-9527-\t.sta_add_debugfs\t\t= ath10k_sta_add_debugfs,\n--\ndrivers/net/wireless/ath/ath11k/Kconfig=38=config ATH11K_DEBUGFS\ndrivers/net/wireless/ath/ath11k/Kconfig-39-\tbool \"QCA ath11k debugfs support\"\ndrivers/net/wireless/ath/ath11k/Kconfig:40:\tdepends on ATH11K \u0026\u0026 DEBUG_FS \u0026\u0026 MAC80211_DEBUGFS\ndrivers/net/wireless/ath/ath11k/Kconfig-41-\thelp\n--\ndrivers/net/wireless/ath/ath11k/core.h=542=struct ath11k_sta {\n--\ndrivers/net/wireless/ath/ath11k/core.h-565-\ndrivers/net/wireless/ath/ath11k/core.h:566:#ifdef CONFIG_MAC80211_DEBUGFS\ndrivers/net/wireless/ath/ath11k/core.h-567-\t/* protected by conf_mutex */\n--\ndrivers/net/wireless/ath/ath12k/Kconfig=35=config ATH12K_DEBUGFS\ndrivers/net/wireless/ath/ath12k/Kconfig-36-\tbool \"Qualcomm ath12k debugfs support\"\ndrivers/net/wireless/ath/ath12k/Kconfig:37:\tdepends on ATH12K \u0026\u0026 MAC80211_DEBUGFS\ndrivers/net/wireless/ath/ath12k/Kconfig-38-\thelp\n--\ndrivers/net/wireless/ath/ath9k/Kconfig=58=config ATH9K_DEBUGFS\ndrivers/net/wireless/ath/ath9k/Kconfig-59-\tbool \"Atheros ath9k debugging\"\ndrivers/net/wireless/ath/ath9k/Kconfig:60:\tdepends on ATH9K \u0026\u0026 DEBUG_FS \u0026\u0026 MAC80211_DEBUGFS\ndrivers/net/wireless/ath/ath9k/Kconfig-61-\tselect ATH9K_COMMON_DEBUG\n--\ndrivers/net/wireless/ath/ath9k/main.c=2790=struct ieee80211_ops ath9k_ops = {\n--\ndrivers/net/wireless/ath/ath9k/main.c-2834-\ndrivers/net/wireless/ath/ath9k/main.c:2835:#if defined(CONFIG_MAC80211_DEBUGFS) \u0026\u0026 defined(CONFIG_ATH9K_STATION_STATISTICS)\ndrivers/net/wireless/ath/ath9k/main.c-2836-\t.sta_add_debugfs    = ath9k_sta_add_debugfs,\n--\ndrivers/net/wireless/ath/carl9170/Kconfig=27=config CARL9170_DEBUGFS\ndrivers/net/wireless/ath/carl9170/Kconfig-28-\tbool \"DebugFS Support\"\ndrivers/net/wireless/ath/carl9170/Kconfig:29:\tdepends on CARL9170 \u0026\u0026 DEBUG_FS \u0026\u0026 MAC80211_DEBUGFS\ndrivers/net/wireless/ath/carl9170/Kconfig-30-\tdefault n\n--\ndrivers/net/wireless/intel/iwlegacy/3945-rs.c=600=il3945_rs_get_rate(void *il_r, struct ieee80211_sta *sta, void *il_sta,\n--\ndrivers/net/wireless/intel/iwlegacy/3945-rs.c-796-\ndrivers/net/wireless/intel/iwlegacy/3945-rs.c:797:#ifdef CONFIG_MAC80211_DEBUGFS\ndrivers/net/wireless/intel/iwlegacy/3945-rs.c-798-\n--\ndrivers/net/wireless/intel/iwlegacy/3945-rs.c=859=static const struct rate_control_ops rs_ops = {\n--\ndrivers/net/wireless/intel/iwlegacy/3945-rs.c-867-\t.free_sta = il3945_rs_free_sta,\ndrivers/net/wireless/intel/iwlegacy/3945-rs.c:868:#ifdef CONFIG_MAC80211_DEBUGFS\ndrivers/net/wireless/intel/iwlegacy/3945-rs.c-869-\t.add_sta_debugfs = il3945_add_debugfs,\n--\ndrivers/net/wireless/intel/iwlegacy/4965-rs.c=2263=il4965_rs_rate_init(struct il_priv *il, struct ieee80211_sta *sta, u8 sta_id)\n--\ndrivers/net/wireless/intel/iwlegacy/4965-rs.c-2341-\ndrivers/net/wireless/intel/iwlegacy/4965-rs.c:2342:#ifdef CONFIG_MAC80211_DEBUGFS\ndrivers/net/wireless/intel/iwlegacy/4965-rs.c-2343-\tlq_sta-\u003edbg_fixed_rate = 0;\n--\ndrivers/net/wireless/intel/iwlegacy/4965-rs.c=2493=il4965_rs_dbgfs_set_mcs(struct il_lq_sta *lq_sta, u32 * rate_n_flags, int idx)\n--\ndrivers/net/wireless/intel/iwlegacy/4965-rs.c-2498-\ndrivers/net/wireless/intel/iwlegacy/4965-rs.c:2499:\tif (!IS_ENABLED(CONFIG_MAC80211_DEBUGFS))\ndrivers/net/wireless/intel/iwlegacy/4965-rs.c-2500-\t\treturn;\n--\ndrivers/net/wireless/intel/iwlegacy/4965-rs.c=2769=static const struct rate_control_ops rs_4965_ops = {\n--\ndrivers/net/wireless/intel/iwlegacy/4965-rs.c-2777-\t.free_sta = il4965_rs_free_sta,\ndrivers/net/wireless/intel/iwlegacy/4965-rs.c:2778:\t.add_sta_debugfs = PTR_IF(IS_ENABLED(CONFIG_MAC80211_DEBUGFS),\ndrivers/net/wireless/intel/iwlegacy/4965-rs.c-2779-\t\t\t\t  il4965_rs_add_debugfs),\n--\ndrivers/net/wireless/intel/iwlegacy/Kconfig=93=config IWLEGACY_DEBUGFS\ndrivers/net/wireless/intel/iwlegacy/Kconfig-94-\tbool \"iwlegacy (iwl 3945/4965) debugfs support\"\ndrivers/net/wireless/intel/iwlegacy/Kconfig:95:\tdepends on IWLEGACY \u0026\u0026 MAC80211_DEBUGFS\ndrivers/net/wireless/intel/iwlegacy/Kconfig-96-\thelp\n--\ndrivers/net/wireless/intel/iwlwifi/Kconfig=131=config IWLWIFI_DEBUGFS\ndrivers/net/wireless/intel/iwlwifi/Kconfig-132-\tbool \"iwlwifi debugfs support\"\ndrivers/net/wireless/intel/iwlwifi/Kconfig:133:\tdepends on MAC80211_DEBUGFS\ndrivers/net/wireless/intel/iwlwifi/Kconfig-134-\thelp\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/rs.c=137=static void rs_stay_in_table(struct iwl_lq_sta *lq_sta, bool force_search);\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/rs.c-139-\ndrivers/net/wireless/intel/iwlwifi/dvm/rs.c:140:#ifdef CONFIG_MAC80211_DEBUGFS\ndrivers/net/wireless/intel/iwlwifi/dvm/rs.c-141-static void rs_dbgfs_set_mcs(struct iwl_lq_sta *lq_sta,\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/rs.c=248=static u8 rs_tl_add_packet(struct iwl_lq_sta *lq_data,\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/rs.c-297-\ndrivers/net/wireless/intel/iwlwifi/dvm/rs.c:298:#ifdef CONFIG_MAC80211_DEBUGFS\ndrivers/net/wireless/intel/iwlwifi/dvm/rs.c-299-/*\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/rs.c=2740=void iwl_rs_rate_init(struct iwl_priv *priv, struct ieee80211_sta *sta, u8 sta_id)\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/rs.c-2830-\tlq_sta-\u003eis_agg = 0;\ndrivers/net/wireless/intel/iwlwifi/dvm/rs.c:2831:#ifdef CONFIG_MAC80211_DEBUGFS\ndrivers/net/wireless/intel/iwlwifi/dvm/rs.c-2832-\tlq_sta-\u003edbg_fixed_rate = 0;\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/rs.c=2996=static void rs_free_sta(void *priv_r, struct ieee80211_sta *sta,\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/rs.c-3005-\ndrivers/net/wireless/intel/iwlwifi/dvm/rs.c:3006:#ifdef CONFIG_MAC80211_DEBUGFS\ndrivers/net/wireless/intel/iwlwifi/dvm/rs.c-3007-static void rs_dbgfs_set_mcs(struct iwl_lq_sta *lq_sta,\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/rs.c=3267=static const struct rate_control_ops rs_ops = {\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/rs.c-3275-\t.free_sta = rs_free_sta,\ndrivers/net/wireless/intel/iwlwifi/dvm/rs.c:3276:#ifdef CONFIG_MAC80211_DEBUGFS\ndrivers/net/wireless/intel/iwlwifi/dvm/rs.c-3277-\t.add_sta_debugfs = rs_add_debugfs,\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/rs.h=319=struct iwl_lq_sta {\n--\ndrivers/net/wireless/intel/iwlwifi/dvm/rs.h-352-\tu8 tx_agg_tid_en;\ndrivers/net/wireless/intel/iwlwifi/dvm/rs.h:353:#ifdef CONFIG_MAC80211_DEBUGFS\ndrivers/net/wireless/intel/iwlwifi/dvm/rs.h-354-\tu32 dbg_fixed_rate;\n--\ndrivers/net/wireless/intel/iwlwifi/mvm/rs-fw.c=705=void iwl_mvm_rs_add_sta_link(struct iwl_mvm *mvm,\n--\ndrivers/net/wireless/intel/iwlwifi/mvm/rs-fw.c-719-\ndrivers/net/wireless/intel/iwlwifi/mvm/rs-fw.c:720:#ifdef CONFIG_MAC80211_DEBUGFS\ndrivers/net/wireless/intel/iwlwifi/mvm/rs-fw.c-721-\tlq_sta-\u003epers.dbg_fixed_rate = 0;\n--\ndrivers/net/wireless/intel/iwlwifi/mvm/rs.c=1960=static bool rs_tpc_perform(struct iwl_mvm *mvm,\n--\ndrivers/net/wireless/intel/iwlwifi/mvm/rs.c-1977-\ndrivers/net/wireless/intel/iwlwifi/mvm/rs.c:1978:#ifdef CONFIG_MAC80211_DEBUGFS\ndrivers/net/wireless/intel/iwlwifi/mvm/rs.c-1979-\tif (lq_sta-\u003epers.dbg_fixed_txp_reduction \u003c= TPC_MAX_REDUCTION) {\n--\ndrivers/net/wireless/intel/iwlwifi/mvm/rs.c=2723=static void *rs_drv_alloc_sta(void *mvm_rate, struct ieee80211_sta *sta,\n--\ndrivers/net/wireless/intel/iwlwifi/mvm/rs.c-2733-\tlq_sta-\u003epers.drv = mvm;\ndrivers/net/wireless/intel/iwlwifi/mvm/rs.c:2734:#ifdef CONFIG_MAC80211_DEBUGFS\ndrivers/net/wireless/intel/iwlwifi/mvm/rs.c-2735-\tlq_sta-\u003epers.dbg_fixed_rate = 0;\n--\ndrivers/net/wireless/intel/iwlwifi/mvm/rs.c=3036=static void __iwl_mvm_rs_tx_status(struct iwl_mvm *mvm,\n--\ndrivers/net/wireless/intel/iwlwifi/mvm/rs.c-3070-\ndrivers/net/wireless/intel/iwlwifi/mvm/rs.c:3071:#ifdef CONFIG_MAC80211_DEBUGFS\ndrivers/net/wireless/intel/iwlwifi/mvm/rs.c-3072-\t/* Disable last tx check if we are debugging with fixed rate but\n--\ndrivers/net/wireless/intel/iwlwifi/mvm/rs.c=3269=void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta,\n--\ndrivers/net/wireless/intel/iwlwifi/mvm/rs.c-3283-\ndrivers/net/wireless/intel/iwlwifi/mvm/rs.c:3284:#ifdef CONFIG_MAC80211_DEBUGFS\ndrivers/net/wireless/intel/iwlwifi/mvm/rs.c-3285-static void rs_build_rates_table_from_fixed(struct iwl_mvm *mvm,\n--\ndrivers/net/wireless/intel/iwlwifi/mvm/rs.c-3319-}\ndrivers/net/wireless/intel/iwlwifi/mvm/rs.c:3320:#endif /* CONFIG_MAC80211_DEBUGFS */\ndrivers/net/wireless/intel/iwlwifi/mvm/rs.c-3321-\n--\ndrivers/net/wireless/intel/iwlwifi/mvm/rs.c=3510=static void rs_set_lq_ss_params(struct iwl_mvm *mvm,\n--\ndrivers/net/wireless/intel/iwlwifi/mvm/rs.c-3526-\ndrivers/net/wireless/intel/iwlwifi/mvm/rs.c:3527:#ifdef CONFIG_MAC80211_DEBUGFS\ndrivers/net/wireless/intel/iwlwifi/mvm/rs.c-3528-\t/* Check if forcing the decision is configured.\n--\ndrivers/net/wireless/intel/iwlwifi/mvm/rs.c=3587=static void rs_fill_lq_cmd(struct iwl_mvm *mvm,\n--\ndrivers/net/wireless/intel/iwlwifi/mvm/rs.c-3599-\ndrivers/net/wireless/intel/iwlwifi/mvm/rs.c:3600:#ifdef CONFIG_MAC80211_DEBUGFS\ndrivers/net/wireless/intel/iwlwifi/mvm/rs.c-3601-\tif (lq_sta-\u003epers.dbg_fixed_rate) {\n--\ndrivers/net/wireless/intel/iwlwifi/mvm/rs.c=3660=int rs_pretty_print_rate_v1(char *buf, int bufsz, const u32 rate)\n--\ndrivers/net/wireless/intel/iwlwifi/mvm/rs.c-3705-\ndrivers/net/wireless/intel/iwlwifi/mvm/rs.c:3706:#ifdef CONFIG_MAC80211_DEBUGFS\ndrivers/net/wireless/intel/iwlwifi/mvm/rs.c-3707-/*\n--\ndrivers/net/wireless/intel/iwlwifi/mvm/rs.c=4100=static const struct rate_control_ops rs_mvm_ops_drv = {\n--\ndrivers/net/wireless/intel/iwlwifi/mvm/rs.c-4109-\t.rate_update = rs_drv_rate_update,\ndrivers/net/wireless/intel/iwlwifi/mvm/rs.c:4110:#ifdef CONFIG_MAC80211_DEBUGFS\ndrivers/net/wireless/intel/iwlwifi/mvm/rs.c-4111-\t.add_sta_debugfs = rs_drv_add_sta_debugfs,\n--\ndrivers/net/wireless/intel/iwlwifi/mvm/rs.h=208=struct iwl_lq_sta_rs_fw {\n--\ndrivers/net/wireless/intel/iwlwifi/mvm/rs.h-214-\t\tu32 sta_id;\ndrivers/net/wireless/intel/iwlwifi/mvm/rs.h:215:#ifdef CONFIG_MAC80211_DEBUGFS\ndrivers/net/wireless/intel/iwlwifi/mvm/rs.h-216-\t\t/**\n--\ndrivers/net/wireless/intel/iwlwifi/mvm/rs.h=301=struct iwl_lq_sta {\n--\ndrivers/net/wireless/intel/iwlwifi/mvm/rs.h-361-\tstruct lq_sta_pers {\ndrivers/net/wireless/intel/iwlwifi/mvm/rs.h:362:#ifdef CONFIG_MAC80211_DEBUGFS\ndrivers/net/wireless/intel/iwlwifi/mvm/rs.h-363-\t\tu32 dbg_fixed_rate;\n--\ndrivers/net/wireless/mediatek/mt76/mt7915/debugfs.c=1376=bool mt7915_debugfs_rx_log(struct mt7915_dev *dev, const void *data, int len)\n--\ndrivers/net/wireless/mediatek/mt76/mt7915/debugfs.c-1386-\ndrivers/net/wireless/mediatek/mt76/mt7915/debugfs.c:1387:#ifdef CONFIG_MAC80211_DEBUGFS\ndrivers/net/wireless/mediatek/mt76/mt7915/debugfs.c-1388-/** per-station debugfs **/\n--\ndrivers/net/wireless/mediatek/mt76/mt7915/main.c=1776=const struct ieee80211_ops mt7915_ops = {\n--\ndrivers/net/wireless/mediatek/mt76/mt7915/main.c-1825-\tCFG80211_TESTMODE_DUMP(mt76_testmode_dump)\ndrivers/net/wireless/mediatek/mt76/mt7915/main.c:1826:#ifdef CONFIG_MAC80211_DEBUGFS\ndrivers/net/wireless/mediatek/mt76/mt7915/main.c-1827-\t.sta_add_debugfs = mt7915_sta_add_debugfs,\n--\ndrivers/net/wireless/mediatek/mt76/mt7915/mt7915.h=637=bool mt7915_debugfs_rx_log(struct mt7915_dev *dev, const void *data, int len);\ndrivers/net/wireless/mediatek/mt76/mt7915/mt7915.h:638:#ifdef CONFIG_MAC80211_DEBUGFS\ndrivers/net/wireless/mediatek/mt76/mt7915/mt7915.h-639-void mt7915_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c=959=bool mt7996_debugfs_rx_log(struct mt7996_dev *dev, const void *data, int len)\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-969-\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c:970:#ifdef CONFIG_MAC80211_DEBUGFS\ndrivers/net/wireless/mediatek/mt76/mt7996/debugfs.c-971-/** per-station debugfs **/\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/main.c=2545=const struct ieee80211_ops mt7996_ops = {\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/main.c-2593-\t.twt_teardown_request = mt7996_twt_teardown_request,\ndrivers/net/wireless/mediatek/mt76/mt7996/main.c:2594:#ifdef CONFIG_MAC80211_DEBUGFS\ndrivers/net/wireless/mediatek/mt76/mt7996/main.c-2595-\t.sta_add_debugfs = mt7996_sta_add_debugfs,\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/mt7996.h=934=int mt7996_mcu_set_emlsr_mode(struct mt7996_dev *dev,\n--\ndrivers/net/wireless/mediatek/mt76/mt7996/mt7996.h-937-\t\t\t      struct ieee80211_eml_params *eml_params);\ndrivers/net/wireless/mediatek/mt76/mt7996/mt7996.h:938:#ifdef CONFIG_MAC80211_DEBUGFS\ndrivers/net/wireless/mediatek/mt76/mt7996/mt7996.h-939-void mt7996_sta_add_debugfs(struct ieee80211_hw *hw, struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/ralink/rt2x00/Kconfig=251=config RT2X00_LIB_DEBUGFS\ndrivers/net/wireless/ralink/rt2x00/Kconfig-252-\tbool \"Ralink debugfs support\"\ndrivers/net/wireless/ralink/rt2x00/Kconfig:253:\tdepends on RT2X00_LIB \u0026\u0026 MAC80211_DEBUGFS\ndrivers/net/wireless/ralink/rt2x00/Kconfig-254-\thelp\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c=2342=static int mac80211_hwsim_add_interface(struct ieee80211_hw *hw,\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-2361-\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:2362:#ifdef CONFIG_MAC80211_DEBUGFS\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-2363-static void\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c=4274=static int mac80211_hwsim_set_radar_background(struct ieee80211_hw *hw,\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-4291-\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:4292:#ifdef CONFIG_MAC80211_DEBUGFS\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-4293-#define HWSIM_DEBUGFS_OPS\t\t\t\t\t\\\n--\ninclude/net/mac80211.h=2233=struct ieee80211_vif {\n--\ninclude/net/mac80211.h-2253-\ninclude/net/mac80211.h:2254:#ifdef CONFIG_MAC80211_DEBUGFS\ninclude/net/mac80211.h-2255-\tstruct dentry *debugfs_dir;\n--\ninclude/net/mac80211.h=4068=struct ieee80211_prep_tx_info {\n--\ninclude/net/mac80211.h-4297- *\tdirectory with its files. This callback should be within a\ninclude/net/mac80211.h:4298: *\tCONFIG_MAC80211_DEBUGFS conditional. This callback can sleep.\ninclude/net/mac80211.h-4299- *\n--\ninclude/net/mac80211.h-4301- *\twhen a link is added to a mac80211 vif. This callback should be within\ninclude/net/mac80211.h:4302: *\ta CONFIG_MAC80211_DEBUGFS conditional. This callback can sleep.\ninclude/net/mac80211.h-4303- *\tFor non-MLO the callback will be called once for the default bss_conf\n--\ninclude/net/mac80211.h-4307- *\twhen a station is added to mac80211's station list. This callback\ninclude/net/mac80211.h:4308: *\tshould be within a CONFIG_MAC80211_DEBUGFS conditional. This\ninclude/net/mac80211.h-4309- *\tcallback can sleep.\n--\ninclude/net/mac80211.h-4312- *\twhen a link is added to a mac80211 station. This callback\ninclude/net/mac80211.h:4313: *\tshould be within a CONFIG_MAC80211_DEBUGFS conditional. This\ninclude/net/mac80211.h-4314- *\tcallback can sleep.\n--\ninclude/net/mac80211.h=4742=struct ieee80211_ops {\n--\ninclude/net/mac80211.h-4830-\t\t\t  struct ieee80211_sta *sta);\ninclude/net/mac80211.h:4831:#ifdef CONFIG_MAC80211_DEBUGFS\ninclude/net/mac80211.h-4832-\tvoid (*vif_add_debugfs)(struct ieee80211_hw *hw,\n--\nnet/mac80211/Kconfig=79=config MAC80211_LEDS\n--\nnet/mac80211/Kconfig-87-\nnet/mac80211/Kconfig:88:config MAC80211_DEBUGFS\nnet/mac80211/Kconfig-89-\tbool \"Export mac80211 internals in DebugFS\"\n--\nnet/mac80211/Kconfig=293=config MAC80211_DEBUG_COUNTERS\n--\nnet/mac80211/Kconfig-295-\tdepends on MAC80211_DEBUG_MENU\nnet/mac80211/Kconfig:296:\tdepends on MAC80211_DEBUGFS\nnet/mac80211/Kconfig-297-\thelp\n--\nnet/mac80211/Makefile=40=mac80211-$(CONFIG_MAC80211_LEDS) += led.o\nnet/mac80211/Makefile:41:mac80211-$(CONFIG_MAC80211_DEBUGFS) += \\\nnet/mac80211/Makefile-42-\tdebugfs.o \\\n--\nnet/mac80211/Makefile=59=rc80211_minstrel-y := \\\n--\nnet/mac80211/Makefile-61-\nnet/mac80211/Makefile:62:rc80211_minstrel-$(CONFIG_MAC80211_DEBUGFS) += \\\nnet/mac80211/Makefile-63-\trc80211_minstrel_ht_debugfs.o\n--\nnet/mac80211/debugfs.h-1-/* SPDX-License-Identifier: GPL-2.0 */\nnet/mac80211/debugfs.h:2:#ifndef __MAC80211_DEBUGFS_H\nnet/mac80211/debugfs.h:3:#define __MAC80211_DEBUGFS_H\nnet/mac80211/debugfs.h-4-\n--\nnet/mac80211/debugfs.h-6-\nnet/mac80211/debugfs.h:7:#ifdef CONFIG_MAC80211_DEBUGFS\nnet/mac80211/debugfs.h-8-void debugfs_hw_add(struct ieee80211_local *local);\n--\nnet/mac80211/debugfs.h=12=static inline void debugfs_hw_add(struct ieee80211_local *local)\n--\nnet/mac80211/debugfs.h-16-\nnet/mac80211/debugfs.h:17:#endif /* __MAC80211_DEBUGFS_H */\n--\nnet/mac80211/debugfs_key.h-1-/* SPDX-License-Identifier: GPL-2.0 */\nnet/mac80211/debugfs_key.h:2:#ifndef __MAC80211_DEBUGFS_KEY_H\nnet/mac80211/debugfs_key.h:3:#define __MAC80211_DEBUGFS_KEY_H\nnet/mac80211/debugfs_key.h-4-\nnet/mac80211/debugfs_key.h:5:#ifdef CONFIG_MAC80211_DEBUGFS\nnet/mac80211/debugfs_key.h-6-void ieee80211_debugfs_key_add(struct ieee80211_key *key);\n--\nnet/mac80211/debugfs_key.h=24=static inline void ieee80211_debugfs_key_remove_beacon_default(\n--\nnet/mac80211/debugfs_key.h-28-\nnet/mac80211/debugfs_key.h:29:#endif /* __MAC80211_DEBUGFS_KEY_H */\n--\nnet/mac80211/debugfs_netdev.h-12-\nnet/mac80211/debugfs_netdev.h:13:#ifdef CONFIG_MAC80211_DEBUGFS\nnet/mac80211/debugfs_netdev.h-14-void ieee80211_debugfs_remove_netdev(struct ieee80211_sub_if_data *sdata);\n--\nnet/mac80211/debugfs_sta.h-1-/* SPDX-License-Identifier: GPL-2.0 */\nnet/mac80211/debugfs_sta.h:2:#ifndef __MAC80211_DEBUGFS_STA_H\nnet/mac80211/debugfs_sta.h:3:#define __MAC80211_DEBUGFS_STA_H\nnet/mac80211/debugfs_sta.h-4-\n--\nnet/mac80211/debugfs_sta.h-6-\nnet/mac80211/debugfs_sta.h:7:#ifdef CONFIG_MAC80211_DEBUGFS\nnet/mac80211/debugfs_sta.h-8-void ieee80211_sta_debugfs_add(struct sta_info *sta);\n--\nnet/mac80211/debugfs_sta.h=24=static inline void ieee80211_link_sta_debugfs_drv_remove(struct link_sta_info *link_sta) {}\n--\nnet/mac80211/debugfs_sta.h-26-\nnet/mac80211/debugfs_sta.h:27:#endif /* __MAC80211_DEBUGFS_STA_H */\n--\nnet/mac80211/driver-ops.h=477=static inline void drv_sta_remove(struct ieee80211_local *local,\n--\nnet/mac80211/driver-ops.h-494-\nnet/mac80211/driver-ops.h:495:#ifdef CONFIG_MAC80211_DEBUGFS\nnet/mac80211/driver-ops.h-496-static inline void drv_vif_add_debugfs(struct ieee80211_local *local,\n--\nnet/mac80211/ieee80211_i.h=1108=struct ieee80211_link_data {\n--\nnet/mac80211/ieee80211_i.h-1160-\nnet/mac80211/ieee80211_i.h:1161:#ifdef CONFIG_MAC80211_DEBUGFS\nnet/mac80211/ieee80211_i.h-1162-\tstruct dentry *debugfs_dir;\n--\nnet/mac80211/ieee80211_i.h=1166=struct ieee80211_sub_if_data {\n--\nnet/mac80211/ieee80211_i.h-1253-\nnet/mac80211/ieee80211_i.h:1254:#ifdef CONFIG_MAC80211_DEBUGFS\nnet/mac80211/ieee80211_i.h-1255-\tstruct {\n--\nnet/mac80211/ieee80211_i.h=1457=struct ieee80211_local {\n--\nnet/mac80211/ieee80211_i.h-1706-\nnet/mac80211/ieee80211_i.h:1707:#ifdef CONFIG_MAC80211_DEBUGFS\nnet/mac80211/ieee80211_i.h-1708-\tstruct local_debugfsdentries {\n--\nnet/mac80211/key.h=59=struct ieee80211_key {\n--\nnet/mac80211/key.h-122-\nnet/mac80211/key.h:123:#ifdef CONFIG_MAC80211_DEBUGFS\nnet/mac80211/key.h-124-\tstruct {\n--\nnet/mac80211/rate.c=215=ieee80211_rate_control_ops_get(const char *name)\n--\nnet/mac80211/rate.c-240-\nnet/mac80211/rate.c:241:#ifdef CONFIG_MAC80211_DEBUGFS\nnet/mac80211/rate.c-242-static ssize_t rcname_read(struct file *file, char __user *userbuf,\n--\nnet/mac80211/rate.c=280=static void rate_control_free(struct ieee80211_local *local,\n--\nnet/mac80211/rate.c-284-\nnet/mac80211/rate.c:285:#ifdef CONFIG_MAC80211_DEBUGFS\nnet/mac80211/rate.c-286-\tdebugfs_remove_recursive(local-\u003edebugfs.rcdir);\n--\nnet/mac80211/rate.h=55=static inline void rate_control_add_sta_debugfs(struct sta_info *sta)\nnet/mac80211/rate.h-56-{\nnet/mac80211/rate.h:57:#ifdef CONFIG_MAC80211_DEBUGFS\nnet/mac80211/rate.h-58-\tstruct rate_control_ref *ref = sta-\u003erate_ctrl;\n--\nnet/mac80211/rate.h=67=static inline void rate_control_add_debugfs(struct ieee80211_local *local)\nnet/mac80211/rate.h-68-{\nnet/mac80211/rate.h:69:#ifdef CONFIG_MAC80211_DEBUGFS\nnet/mac80211/rate.h-70-\tstruct dentry *debugfsdir;\n--\nnet/mac80211/rc80211_minstrel_ht.c=1059=minstrel_ht_update_stats(struct minstrel_priv *mp, struct minstrel_ht_sta *mi)\n--\nnet/mac80211/rc80211_minstrel_ht.c-1181-\nnet/mac80211/rc80211_minstrel_ht.c:1182:#ifdef CONFIG_MAC80211_DEBUGFS\nnet/mac80211/rc80211_minstrel_ht.c-1183-\t/* use fixed index if set */\n--\nnet/mac80211/rc80211_minstrel_ht.c=1595=minstrel_ht_get_rate(void *priv, struct ieee80211_sta *sta, void *priv_sta,\n--\nnet/mac80211/rc80211_minstrel_ht.c-1606-\nnet/mac80211/rc80211_minstrel_ht.c:1607:#ifdef CONFIG_MAC80211_DEBUGFS\nnet/mac80211/rc80211_minstrel_ht.c-1608-\tif (mp-\u003efixed_rate_idx != -1)\n--\nnet/mac80211/rc80211_minstrel_ht.c=1915=minstrel_ht_alloc(struct ieee80211_hw *hw)\n--\nnet/mac80211/rc80211_minstrel_ht.c-1948-\nnet/mac80211/rc80211_minstrel_ht.c:1949:#ifdef CONFIG_MAC80211_DEBUGFS\nnet/mac80211/rc80211_minstrel_ht.c-1950-static void minstrel_ht_add_debugfs(struct ieee80211_hw *hw, void *priv,\n--\nnet/mac80211/rc80211_minstrel_ht.c=1983=static const struct rate_control_ops mac80211_minstrel_ht = {\n--\nnet/mac80211/rc80211_minstrel_ht.c-1993-\t.free = minstrel_ht_free,\nnet/mac80211/rc80211_minstrel_ht.c:1994:#ifdef CONFIG_MAC80211_DEBUGFS\nnet/mac80211/rc80211_minstrel_ht.c-1995-\t.add_debugfs = minstrel_ht_add_debugfs,\n--\nnet/mac80211/rc80211_minstrel_ht.h=75=struct minstrel_priv {\n--\nnet/mac80211/rc80211_minstrel_ht.h-85-\nnet/mac80211/rc80211_minstrel_ht.h:86:#ifdef CONFIG_MAC80211_DEBUGFS\nnet/mac80211/rc80211_minstrel_ht.h-87-\t/*\n--\nnet/mac80211/sta_info.h=526=struct link_sta_info {\n--\nnet/mac80211/sta_info.h-577-\nnet/mac80211/sta_info.h:578:#ifdef CONFIG_MAC80211_DEBUGFS\nnet/mac80211/sta_info.h-579-\tstruct dentry *debugfs_dir;\n--\nnet/mac80211/sta_info.h=715=struct sta_info {\n--\nnet/mac80211/sta_info.h-773-\nnet/mac80211/sta_info.h:774:#ifdef CONFIG_MAC80211_DEBUGFS\nnet/mac80211/sta_info.h-775-\tstruct dentry *debugfs_dir;\n--\nnet/mac80211/tx.c=2676=static struct sk_buff *ieee80211_build_hdr(struct ieee80211_sub_if_data *sdata,\n--\nnet/mac80211/tx.c-2701-\nnet/mac80211/tx.c:2702:#ifdef CONFIG_MAC80211_DEBUGFS\nnet/mac80211/tx.c-2703-\tif (local-\u003eforce_tx_status)\n--\nnet/mac80211/tx.c=3713=void __ieee80211_xmit_fast(struct ieee80211_sub_if_data *sdata,\n--\nnet/mac80211/tx.c-3759-\nnet/mac80211/tx.c:3760:#ifdef CONFIG_MAC80211_DEBUGFS\nnet/mac80211/tx.c-3761-\tif (local-\u003eforce_tx_status)\n"
}

gemini-3.7-flash

null

null

							input: 26942
							output: 38
							thoughts: 82
						

**Analyzing the mac80211 Debug Filesystem Configuration**

Okay, so I'm looking at `net/mac80211/debugfs_netdev.c` right now. My initial thought is to figure out when this file is even compiled into the kernel. It seems pretty clear that `CONFIG_MAC80211_DEBUGFS` has to be enabled for that to happen. Of course, that setting is going to be conditional, too. I'm pretty sure `MAC80211` itself is a prerequisite, and I'd bet `DEBUG_FS` is involved as well. To confirm this, I should probably check the `net/mac80211/Kconfig` file. I'll take a look around line 88 and see what the exact dependencies are to be sure. This should give me a good handle on how the debug filesystem support is integrated.

{
  "File": "net/mac80211/Kconfig",
  "FirstLine": 80,
  "LineCount": 20
}

{
  "Contents": "  80:\t\tbool \"Enable LED triggers\"\n  81:\t\tdepends on MAC80211\n  82:\t\tdepends on LEDS_CLASS=y || LEDS_CLASS=MAC80211\n  83:\t\tselect LEDS_TRIGGERS\n  84:\t\thelp\n  85:\t\t  This option enables a few LED triggers for different\n  86:\t\t  packet receive/transmit events.\n  87:\t\n  88:\tconfig MAC80211_DEBUGFS\n  89:\t\tbool \"Export mac80211 internals in DebugFS\"\n  90:\t\tdepends on MAC80211 \u0026\u0026 CFG80211_DEBUGFS\n  91:\t\thelp\n  92:\t\t  Select this to see extensive information about\n  93:\t\t  the internal state of mac80211 in debugfs.\n  94:\t\n  95:\t\t  Say N unless you know you need this.\n  96:\t\n  97:\tconfig MAC80211_MESSAGE_TRACING\n  98:\t\tbool \"Trace all mac80211 debug messages\"\n  99:\t\tdepends on MAC80211 \u0026\u0026 TRACING\n"
}

gemini-3.7-flash

null

null

							input: 27561
							output: 24
							thoughts: 24
						

Here's my take on those thoughts:

**Checking the Kconfig for CFG80211_DEBUGFS**

Okay, so I need to quickly see if `CFG80211_DEBUGFS` is enabled, or at least available, within the kernel's wireless configuration. The best place to find that is, of course, the `net/wireless/Kconfig` file. I'm thinking, this debug feature is a critical tool, so I want to be certain about its current status. I'm probably looking at a specific issue or a new feature implementation, and knowing if this debugging option is enabled will affect my next steps. Need to make sure it's set up correctly. Let's see what's in there.

{
  "Expression": "config CFG80211_DEBUGFS"
}

{
  "Output": "net/wireless/Kconfig=159=config CFG80211_DEFAULT_PS\n--\nnet/wireless/Kconfig-168-\nnet/wireless/Kconfig:169:config CFG80211_DEBUGFS\nnet/wireless/Kconfig-170-\tbool \"cfg80211 DebugFS entries\"\n"
}

gemini-3.7-flash

null

null

							input: 27866
							output: 34
							thoughts: 19
						

Here's my attempt at summarizing the thought process, tailored for an expert audience:

**Diving into the Wireless Configuration**

Okay, so I need to understand this wireless configuration better. Right now, I'm thinking I should start by looking at `net/wireless/Kconfig` around line 169. That area is usually where they define the core options related to the wireless subsystem. Hopefully, I'll find the basic knobs and levers in there. This is likely where the foundational features are controlled, and potentially where I can start tracing dependencies if something isn't working as I expect. Grabbing the relevant definitions will give me a solid base to go on.

{
  "File": "net/wireless/Kconfig",
  "FirstLine": 165,
  "LineCount": 20
}

{
  "Contents": " 165:\t\t  If this causes your applications to misbehave you should fix your\n 166:\t\t  applications instead -- they need to register their network\n 167:\t\t  latency requirement, see Documentation/power/pm_qos_interface.rst.\n 168:\t\n 169:\tconfig CFG80211_DEBUGFS\n 170:\t\tbool \"cfg80211 DebugFS entries\"\n 171:\t\tdepends on DEBUG_FS\n 172:\t\thelp\n 173:\t\t  You can enable this if you want debugfs entries for cfg80211.\n 174:\t\n 175:\t\t  If unsure, say N.\n 176:\t\n 177:\tconfig CFG80211_CRDA_SUPPORT\n 178:\t\tbool \"support CRDA\" if EXPERT\n 179:\t\tdefault y\n 180:\t\thelp\n 181:\t\t  You should enable this option unless you know for sure you have no\n 182:\t\t  need for it, for example when using the regulatory database loaded as\n 183:\t\t  a firmware file.\n 184:\t\n"
}

gemini-3.7-flash

null

null

							input: 28366
							output: 25
							thoughts: 97
						

Okay, let's break this down.

**Dependency Analysis for mac80211 Debugging and Fuzzing**

Right, so I need to figure out the dependencies for debugging and fuzzing the `mac80211` subsystem. The first thing that jumps out is `CONFIG_MAC80211_DEBUGFS`. Obviously, that's reliant on `MAC80211` – makes sense. And then, `CFG80211_DEBUGFS`, which that `CONFIG_MAC80211_DEBUGFS` depends on, itself depends on `DEBUG_FS`. Got it. That establishes the debugging side.

Now, for fuzzing, I've got a couple of options: `MAC80211_HWSIM` or `NL80211`. I'll probably want to investigate those further. I'm going to quickly check the dependencies of `MAC80211_HWSIM` as well to make sure there are no other configurations I need to take into consideration.

{
  "Expression": "config MAC80211_HWSIM"
}

{
  "Output": "drivers/net/wireless/virtual/Kconfig:1:config MAC80211_HWSIM\ndrivers/net/wireless/virtual/Kconfig-2-\ttristate \"Simulated radio testing tool for mac80211\"\n"
}

gemini-3.7-flash

null

null

							input: 28783
							output: 36
							thoughts: 16
						

Here's my summary, as though I'm thinking through this process:

**Diving into the Virtual Wireless Kconfig**

Okay, so I need to understand something about the virtual wireless setup in this kernel. The best place to start, as always, is the configuration file. Let's see... the text mentions `drivers/net/wireless/virtual/Kconfig`. Right, that's where I'd expect to find all the configuration options for this subsystem. I'm going to take a look at `Kconfig` now to see what's defined, what dependencies exist, and how this all pieces together. That'll give me a solid foundation for understanding the rest of the code. Let's get to it.

{
  "File": "drivers/net/wireless/virtual/Kconfig",
  "FirstLine": 1,
  "LineCount": 20
}

{
  "Contents": "   1:\tconfig MAC80211_HWSIM\n   2:\t\ttristate \"Simulated radio testing tool for mac80211\"\n   3:\t\tdepends on MAC80211\n   4:\t\thelp\n   5:\t\t  This driver is a developer testing tool that can be used to test\n   6:\t\t  IEEE 802.11 networking stack (mac80211) functionality. This is not\n   7:\t\t  needed for normal wireless LAN usage and is only for testing. See\n   8:\t\t  Documentation/networking/mac80211_hwsim for more information on how\n   9:\t\t  to use this tool.\n  10:\t\n  11:\t\t  To compile this driver as a module, choose M here: the module will be\n  12:\t\t  called mac80211_hwsim.  If unsure, say N.\n  13:\t\n  14:\tconfig VIRT_WIFI\n  15:\t\ttristate \"Wifi wrapper for ethernet drivers\"\n  16:\t\tdepends on CFG80211\n  17:\t\thelp\n  18:\t\t  This option adds support for ethernet connections to appear as if they\n  19:\t\t  are wifi connections through a special rtnetlink device.\n  20:\t\n"
}

gemini-3.7-flash

null

null

							input: 29315
							output: 29
							thoughts: 356
						

**Analyzing Debugfs and mac80211 Interactions**

Okay, let's break this down. First, I need to understand the context, so I'm starting with the relevant configuration options: `CONFIG_MAC80211`, `CONFIG_CFG80211`, `CONFIG_MAC80211_DEBUGFS`, `CONFIG_CFG80211_DEBUGFS`, `CONFIG_DEBUG_FS`, and `CONFIG_MAC80211_HWSIM`. These point directly to the mac80211 subsystem and its debug interface, which means I'm probably looking at changes related to debugging and monitoring the wireless network interface.

Now, let's dig into the code changes. I see that `net/mac80211/debugfs_netdev.c` has been touched. Specifically, the functions `ieee80211_debugfs_remove_netdev` and `ieee80211_debugfs_recreate_netdev` have been modified. Interesting. I need to understand how these functions are used.

Looking at the call graph, I see that `ieee80211_debugfs_remove_netdev` is called in `drv_remove_interface`, `ieee80211_del_virtual_monitor`, `ieee80211_teardown_sdata`, and even `ieee80211_debugfs_recreate_netdev` itself, suggesting a cleanup or removal process. Meanwhile, `ieee80211_debugfs_recreate_netdev` gets called by `drv_remove_interface`, `ieee80211_setup_sdata`, and `ieee80211_vif_update_links`. So, these functions likely deal with removing and recreating the debugfs entries associated with a network device. I need to look closely at `drv_remove_interface`, `ieee80211_del_virtual_monitor`, `ieee80211_teardown_sdata`, `ieee80211_setup_sdata`, and `ieee80211_vif_update_links` to understand where these debugfs interactions are triggered. I am also aware that the `debugfs_recreate_netdev` is called within the same family of functions that call the `debugfs_remove_netdev`.

Given the nature of the calls and the presence of `remove` and `recreate` in the function names, I think this could be related to:
*   Interface removal and creation
*   Virtual interface management
*   Station data teardown and setup

Since I need a broader view, I'm going to scan the codebase for all calls to `ieee80211_debugfs_remove_netdev`. I want to ensure I haven't missed a critical location. I want to be comprehensive.

{
  "Expression": "ieee80211_debugfs_remove_netdev"
}

{
  "Output": "net/mac80211/debugfs_netdev.c=999=static void ieee80211_debugfs_add_netdev(struct ieee80211_sub_if_data *sdata,\n--\nnet/mac80211/debugfs_netdev.c-1015-\nnet/mac80211/debugfs_netdev.c:1016:void ieee80211_debugfs_remove_netdev(struct ieee80211_sub_if_data *sdata)\nnet/mac80211/debugfs_netdev.c-1017-{\n--\nnet/mac80211/debugfs_netdev.c=1033=void ieee80211_debugfs_recreate_netdev(struct ieee80211_sub_if_data *sdata,\n--\nnet/mac80211/debugfs_netdev.c-1035-{\nnet/mac80211/debugfs_netdev.c:1036:\tieee80211_debugfs_remove_netdev(sdata);\nnet/mac80211/debugfs_netdev.c-1037-\tieee80211_debugfs_add_netdev(sdata, mld_vif);\n--\nnet/mac80211/debugfs_netdev.h-13-#ifdef CONFIG_MAC80211_DEBUGFS\nnet/mac80211/debugfs_netdev.h:14:void ieee80211_debugfs_remove_netdev(struct ieee80211_sub_if_data *sdata);\nnet/mac80211/debugfs_netdev.h-15-void ieee80211_debugfs_rename_netdev(struct ieee80211_sub_if_data *sdata);\n--\nnet/mac80211/debugfs_netdev.h=23=void ieee80211_link_debugfs_drv_remove(struct ieee80211_link_data *link);\nnet/mac80211/debugfs_netdev.h-24-#else\nnet/mac80211/debugfs_netdev.h:25:static inline void ieee80211_debugfs_remove_netdev(\nnet/mac80211/debugfs_netdev.h-26-\tstruct ieee80211_sub_if_data *sdata)\n--\nnet/mac80211/iface.c=900=static void ieee80211_teardown_sdata(struct ieee80211_sub_if_data *sdata)\n--\nnet/mac80211/iface.c-907-\nnet/mac80211/iface.c:908:\tieee80211_debugfs_remove_netdev(sdata);\nnet/mac80211/iface.c-909-\n"
}

gemini-3.7-flash

null

null

							input: 31143
							output: 253
							thoughts: 912
						

**Fuzzing Target Analysis: mac80211 Debugfs Functions**

Okay, let's break this down. My initial assessment is that these functions, `ieee80211_debugfs_remove_netdev`, `ieee80211_debugfs_recreate_netdev`, and `ieee80211_debugfs_key_update_default`, are definitely worth a closer look for fuzzing. `ieee80211_debugfs_remove_netdev` handles removal of debugfs entries when the sdata is destroyed or updated, or the debugfs is recreated. Conversely, `ieee80211_debugfs_recreate_netdev` is called on sdata setup, interface removal, or link updates. I'm noting that `ieee80211_debugfs_key_update_default` is directly called within the recreate function.

The key question is reachability, and here, things look promising. This is within `mac80211`, which is core, and accessible through standard `nl80211` netlink commands. This makes it a great target for Syzkaller fuzzing. The fact that `mac80211_hwsim` offers a virtual device to mimic real hardware further strengthens this argument. This isn't tied to any specific vendor's hardware and isn't just about unpluggable hardware teardown, but standard runtime operations on the interface level. WorthFuzzing is a definite yes.

I've confirmed the focus symbols are:
*   `ieee80211_debugfs_remove_netdev`
*   `ieee80211_debugfs_recreate_netdev`
*   `ieee80211_debugfs_key_update_default`

And it's worth noting that the patch also touches `ieee80211_debugfs_recreate_netdev` and I know `ieee80211_debugfs_key_update_default` is called inside it.

For configurations, this needs `MAC80211`, `MAC80211_DEBUGFS`, `CFG80211_DEBUGFS`, and `DEBUG_FS`. Let me verify the dependencies: `MAC80211_DEBUGFS` depends on `MAC80211` and `CFG80211_DEBUGFS` and `CFG80211_DEBUGFS` depends on `DEBUG_FS`.

So, to summarize succinctly:

1.  This patch modifies debugfs entry handling, resetting `default_unicast_key` and `default_multicast_key` to NULL during netdev debugfs removal and updating key symlinks during netdev debugfs recreation.
2.  It's reachable through `nl80211` netlink commands (interface creation, modification, deletion) and simulatable via `mac80211_hwsim`.
3.  Fuzzing prevents and tests dangling debugfs dentry references and state issues with interface/link recreation and key configuration.
4.  Focus symbols are `ieee80211_debugfs_remove_netdev`, `ieee80211_debugfs_recreate_netdev`, and `ieee80211_debugfs_key_update_default`.
5.  Required configs are `MAC80211`, `MAC80211_DEBUGFS`, `CFG80211_DEBUGFS`, and `DEBUG_FS`.

Now, I'm ready to proceed with the `set-results` tool call.

{
  "EnableConfigs": [
    "MAC80211",
    "MAC80211_DEBUGFS",
    "CFG80211_DEBUGFS",
    "DEBUG_FS"
  ],
  "FocusSymbols": [
    "ieee80211_debugfs_remove_netdev",
    "ieee80211_debugfs_recreate_netdev",
    "ieee80211_debugfs_key_update_default"
  ],
  "Reasoning": "The patch modifies mac80211's debugfs netdev handling by properly clearing default key debugfs pointers upon removal (ieee80211_debugfs_remove_netdev) and rebuilding default key debugfs links upon interface recreation (ieee80211_debugfs_recreate_netdev). This code is reachable and testable in virtual environments using mac80211_hwsim and nl80211 netlink commands. Fuzzing helps ensure that interface setup, link updates, and key updates do not produce stale or dangling dentry references or race conditions.",
  "WorthFuzzing": true
}

{
  "EnableConfigs": [
    "MAC80211",
    "MAC80211_DEBUGFS",
    "CFG80211_DEBUGFS",
    "DEBUG_FS"
  ],
  "FocusSymbols": [
    "ieee80211_debugfs_remove_netdev",
    "ieee80211_debugfs_recreate_netdev",
    "ieee80211_debugfs_key_update_default"
  ],
  "Reasoning": "The patch modifies mac80211's debugfs netdev handling by properly clearing default key debugfs pointers upon removal (ieee80211_debugfs_remove_netdev) and rebuilding default key debugfs links upon interface recreation (ieee80211_debugfs_recreate_netdev). This code is reachable and testable in virtual environments using mac80211_hwsim and nl80211 netlink commands. Fuzzing helps ensure that interface setup, link updates, and key updates do not produce stale or dangling dentry references or race conditions.",
  "WorthFuzzing": true
}

{
  "WorthFuzzing": true
}

null

core

null

{
  "KMSANReasoning": "The patch addresses debugfs lifetime management in mac80211 by zeroing dangling debugfs dentry pointers (default_unicast_key and default_multicast_key) upon interface debugfs removal and re-creating default key symlinks during interface debugfs recreation. \n\nThis change does not introduce or modify any uninitialized memory paths, heap/stack allocations, or kernel-to-user info leaks (e.g., via copy_to_user or netlink). Any potential memory management issues related to stale debugfs dentries or use-after-free conditions are addressed and detectable by KASAN. Therefore, a dedicated KMSAN fuzzing session is not warranted.",
  "NeedsKMSAN": false
}

You are an expert Linux kernel security engineer specializing in kernel memory
error detectors (KASAN and KMSAN). Your job is to review the provided patch series and
determine if the code changes justify spawning a dedicated KMSAN (KernelMemorySanitizer)
fuzzing session in addition to standard KASAN fuzzing.

CRITICAL DISTINCTION BETWEEN KASAN AND KMSAN:
- Standard KASAN kernel builds (upstream-apparmor-kasan.config) already enable
  a comprehensive suite of debugging tools and sanitizers, including KASAN
  (out-of-bounds accesses, use-after-free, double free, invalid free), LOCKDEP
  (locking bugs and deadlocks), UB-sanitizers, and memory corruption checks.
- KMSAN (KernelMemorySanitizer) detects reads of UNINITIALIZED memory (stack, heap,
  or page allocations) and kernel-to-user memory info-leaks.

Rule: THERE IS NO SENSE IN RUNNING A KMSAN SESSION IF A BUG CAN BE CAUGHT BY KASAN,
LOCKDEP, OR OTHER STANDARD BUG DETECTORS.
A dedicated KMSAN fuzzing session incurs significant resource costs. You must ONLY
set NeedsKMSAN=true if the code changes introduce or expose UNINITIALIZED MEMORY risks
that are detected ONLY by KMSAN.

Look holistically at the patch series and surrounding code. Even if no direct
uninitialized field accesses or new buffer allocations are added in the diff itself,
a patch may alter control flow, bounds checking, or data length calculations in ways
that change how the rest of the code operates on existing buffers (e.g. allowing
uninitialized stack/heap memory to be read, copied to user space, or used in control
flow). Do not hesitate to use your code access tools to inspect the surrounding code,
called functions, and callers.

Set NeedsKMSAN=true ONLY IF the patch introduces or modifies:
1. Kernel structures sent to user space (via copy_to_user, put_user, netlink skb
   attributes, ioctl output arguments, socket options, or BPF buffers) where fields
   or structure padding might not be fully initialized/zeroed.
2. Conditional logic or branching that depends on potentially uninitialized variables
   or struct fields.
3. Allocation or initialization of complex data structures where uninitialized fields
   could be read later in reachable code paths.
4. Bounds checks, lengths, or logic in a way that allows surrounding code to access
   uninitialized bytes of existing buffers.

Set NeedsKMSAN=false IF:
- The code changes primarily risk out-of-bounds access, array overflows, NULL pointer
  dereferences, locking deadlocks, or use-after-free bugs (these are already caught
  by KASAN, LOCKDEP, or standard bug detectors).
- All stack/heap structures touched or introduced by the patch are fully zeroed
  or initialized (e.g. using = {0}, memset, kzalloc) before being read or copied.
- The patch does not introduce any risk of uninitialized memory usage or info-leaks.

Use your code access tools to inspect the surrounding code if necessary, then provide
detailed KMSANReasoning contrasting KASAN vs KMSAN applicability for this patch.
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

Target architecture: amd64

For your convenience, here is the diff of the changes:
commit 1e48ac890db0558c114a5d6e2e48e3d5e3cdde65
Author: syz-cluster <triage@syzkaller.com>
Date:   Mon Sep 7 17:15:07 2026 +0000

    syz-cluster: applied patch under review

diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
index f3c6a41e49119..a00b0776fdb1d 100644
--- a/net/mac80211/debugfs_netdev.c
+++ b/net/mac80211/debugfs_netdev.c
@@ -20,6 +20,7 @@
 #include "ieee80211_i.h"
 #include "rate.h"
 #include "debugfs.h"
+#include "debugfs_key.h"
 #include "debugfs_netdev.h"
 #include "driver-ops.h"
 
@@ -1020,6 +1021,8 @@ void ieee80211_debugfs_remove_netdev(struct ieee80211_sub_if_data *sdata)
 	debugfs_remove_recursive(sdata->vif.debugfs_dir);
 	sdata->vif.debugfs_dir = NULL;
 	sdata->debugfs.subdir_stations = NULL;
+	sdata->debugfs.default_unicast_key = NULL;
+	sdata->debugfs.default_multicast_key = NULL;
 }
 
 void ieee80211_debugfs_rename_netdev(struct ieee80211_sub_if_data *sdata)
@@ -1032,6 +1035,7 @@ void ieee80211_debugfs_recreate_netdev(struct ieee80211_sub_if_data *sdata,
 {
 	ieee80211_debugfs_remove_netdev(sdata);
 	ieee80211_debugfs_add_netdev(sdata, mld_vif);
+	ieee80211_debugfs_key_update_default(sdata);
 
 	if (sdata->flags & IEEE80211_SDATA_IN_DRIVER) {
 		drv_vif_add_debugfs(sdata->local, sdata);

gemini-3.7-flash

null

null

							input: 2425
							output: 45
							thoughts: 508
						

**Analyzing a Network Driver Patch for Memory Safety Concerns**

Okay, let's dive into this patch and figure out if we need to flag it for KMSAN or KASAN analysis. My initial thought is to examine the file changes and determine if there are any potential memory safety vulnerabilities.

Specifically, I see changes in `net/mac80211/debugfs_netdev.c`. The diff introduces an include for `debugfs_key.h` and updates the `ieee80211_debugfs_remove_netdev`, `ieee80211_debugfs_recreate_netdev` functions. The `ieee80211_debugfs_remove_netdev` function now clears the pointers to `default_unicast_key` and `default_multicast_key`, and the `ieee80211_debugfs_recreate_netdev` function has a call to `ieee80211_debugfs_key_update_default`.

My intuition tells me that managing these key pointers and any associated key data may be the area of focus, and is worth additional investigation. Time to employ some grepping and file reading to understand the context of these added features. From here, I will assess whether the new or modified code could potentially lead to use-after-free, double-free, or other memory corruption issues within the kernel.

{
  "Expression": "ieee80211_debugfs_key_update_default",
  "PathPrefix": "net/mac80211/"
}

{
  "Output": "net/mac80211/debugfs_key.c=361=void ieee80211_debugfs_key_remove(struct ieee80211_key *key)\n--\nnet/mac80211/debugfs_key.c-369-\nnet/mac80211/debugfs_key.c:370:void ieee80211_debugfs_key_update_default(struct ieee80211_sub_if_data *sdata)\nnet/mac80211/debugfs_key.c-371-{\n--\nnet/mac80211/debugfs_key.h=7=void ieee80211_debugfs_key_remove(struct ieee80211_key *key);\nnet/mac80211/debugfs_key.h:8:void ieee80211_debugfs_key_update_default(struct ieee80211_sub_if_data *sdata);\nnet/mac80211/debugfs_key.h-9-void ieee80211_debugfs_key_remove_mgmt_default(\n--\nnet/mac80211/debugfs_key.h=16=static inline void ieee80211_debugfs_key_remove(struct ieee80211_key *key)\nnet/mac80211/debugfs_key.h-17-{}\nnet/mac80211/debugfs_key.h:18:static inline void ieee80211_debugfs_key_update_default(\nnet/mac80211/debugfs_key.h-19-\tstruct ieee80211_sub_if_data *sdata)\n--\nnet/mac80211/debugfs_netdev.c=1033=void ieee80211_debugfs_recreate_netdev(struct ieee80211_sub_if_data *sdata,\n--\nnet/mac80211/debugfs_netdev.c-1037-\tieee80211_debugfs_add_netdev(sdata, mld_vif);\nnet/mac80211/debugfs_netdev.c:1038:\tieee80211_debugfs_key_update_default(sdata);\nnet/mac80211/debugfs_netdev.c-1039-\n--\nnet/mac80211/key.c=350=static void __ieee80211_set_default_key(struct ieee80211_link_data *link,\n--\nnet/mac80211/key.c-375-\nnet/mac80211/key.c:376:\tieee80211_debugfs_key_update_default(sdata);\nnet/mac80211/key.c-377-}\n--\nnet/mac80211/key.c=388=__ieee80211_set_default_mgmt_key(struct ieee80211_link_data *link, int idx)\n--\nnet/mac80211/key.c-401-\nnet/mac80211/key.c:402:\tieee80211_debugfs_key_update_default(sdata);\nnet/mac80211/key.c-403-}\n--\nnet/mac80211/key.c=414=__ieee80211_set_default_beacon_key(struct ieee80211_link_data *link, int idx)\n--\nnet/mac80211/key.c-428-\nnet/mac80211/key.c:429:\tieee80211_debugfs_key_update_default(sdata);\nnet/mac80211/key.c-430-}\n--\nnet/mac80211/key.c=1087=static void ieee80211_free_keys_iface(struct ieee80211_sub_if_data *sdata,\n--\nnet/mac80211/key.c-1105-\nnet/mac80211/key.c:1106:\tieee80211_debugfs_key_update_default(sdata);\nnet/mac80211/key.c-1107-}\n"
}

gemini-3.7-flash

null

null

							input: 4450
							output: 43
							thoughts: 28
						

Here's a first-person summary, tailored as requested:

**Diving into `debugfs_key.c`**

Okay, let's zero in on `net/mac80211/debugfs_key.c`. I'm specifically interested in line 370, give or take a few around it. Time to refresh my memory on what's happening in that section of the driver. I expect that area to be related to... well, given the file name and the context of mac80211, probably something to do with key handling or debug output relating to keys, potentially key management or injection of key material through debugfs. I bet I'll find some useful information to work from. Let's see...

{
  "File": "net/mac80211/debugfs_key.c",
  "FirstLine": 360,
  "LineCount": 50
}

{
  "Contents": " 360:\t\n 361:\tvoid ieee80211_debugfs_key_remove(struct ieee80211_key *key)\n 362:\t{\n 363:\t\tif (!key)\n 364:\t\t\treturn;\n 365:\t\n 366:\t\tdebugfs_remove_recursive(key-\u003edebugfs.dir);\n 367:\t\tkey-\u003edebugfs.dir = NULL;\n 368:\t}\n 369:\t\n 370:\tvoid ieee80211_debugfs_key_update_default(struct ieee80211_sub_if_data *sdata)\n 371:\t{\n 372:\t\tchar buf[50];\n 373:\t\tstruct ieee80211_key *key;\n 374:\t\n 375:\t\tif (!sdata-\u003evif.debugfs_dir)\n 376:\t\t\treturn;\n 377:\t\n 378:\t\tlockdep_assert_wiphy(sdata-\u003elocal-\u003ehw.wiphy);\n 379:\t\n 380:\t\tdebugfs_remove(sdata-\u003edebugfs.default_unicast_key);\n 381:\t\tsdata-\u003edebugfs.default_unicast_key = NULL;\n 382:\t\n 383:\t\tif (sdata-\u003edefault_unicast_key) {\n 384:\t\t\tkey = wiphy_dereference(sdata-\u003elocal-\u003ehw.wiphy,\n 385:\t\t\t\t\t\tsdata-\u003edefault_unicast_key);\n 386:\t\t\tsprintf(buf, \"../keys/%d\", key-\u003edebugfs.cnt);\n 387:\t\t\tsdata-\u003edebugfs.default_unicast_key =\n 388:\t\t\t\tdebugfs_create_symlink(\"default_unicast_key\",\n 389:\t\t\t\t\t\t       sdata-\u003evif.debugfs_dir, buf);\n 390:\t\t}\n 391:\t\n 392:\t\tdebugfs_remove(sdata-\u003edebugfs.default_multicast_key);\n 393:\t\tsdata-\u003edebugfs.default_multicast_key = NULL;\n 394:\t\n 395:\t\tif (sdata-\u003edeflink.default_multicast_key) {\n 396:\t\t\tkey = wiphy_dereference(sdata-\u003elocal-\u003ehw.wiphy,\n 397:\t\t\t\t\t\tsdata-\u003edeflink.default_multicast_key);\n 398:\t\t\tsprintf(buf, \"../keys/%d\", key-\u003edebugfs.cnt);\n 399:\t\t\tsdata-\u003edebugfs.default_multicast_key =\n 400:\t\t\t\tdebugfs_create_symlink(\"default_multicast_key\",\n 401:\t\t\t\t\t\t       sdata-\u003evif.debugfs_dir, buf);\n 402:\t\t}\n 403:\t}\n 404:\t\n 405:\tvoid ieee80211_debugfs_key_remove_mgmt_default(struct ieee80211_sub_if_data *sdata)\n 406:\t{\n 407:\t\tif (!sdata)\n 408:\t\t\treturn;\n 409:\t\n"
}

gemini-3.7-flash

null

null

							input: 5513
							output: 45
							thoughts: 36
						

Here's a summary of my thought process, as requested:

**Debugging the mac80211 Network Device Driver**

Okay, so I'm digging into this networking issue, and my intuition is telling me that there might be something specific happening related to how the network device is handled at a lower level. My next step is to drill down into `net/mac80211/debugfs_netdev.c`. I need to check around lines 1010 to 1050, as that area often handles important network device management, maybe there is something off about the debugging options in relation to the network device. I'll need to scrutinize that section and see what it reveals. Hopefully, this detailed look sheds some light on the issue.

{
  "File": "net/mac80211/debugfs_netdev.c",
  "FirstLine": 1015,
  "LineCount": 40
}

{
  "Contents": "1015:\t\n1016:\tvoid ieee80211_debugfs_remove_netdev(struct ieee80211_sub_if_data *sdata)\n1017:\t{\n1018:\t\tif (!sdata-\u003evif.debugfs_dir)\n1019:\t\t\treturn;\n1020:\t\n1021:\t\tdebugfs_remove_recursive(sdata-\u003evif.debugfs_dir);\n1022:\t\tsdata-\u003evif.debugfs_dir = NULL;\n1023:\t\tsdata-\u003edebugfs.subdir_stations = NULL;\n1024:\t\tsdata-\u003edebugfs.default_unicast_key = NULL;\n1025:\t\tsdata-\u003edebugfs.default_multicast_key = NULL;\n1026:\t}\n1027:\t\n1028:\tvoid ieee80211_debugfs_rename_netdev(struct ieee80211_sub_if_data *sdata)\n1029:\t{\n1030:\t\tdebugfs_change_name(sdata-\u003evif.debugfs_dir, \"netdev:%s\", sdata-\u003ename);\n1031:\t}\n1032:\t\n1033:\tvoid ieee80211_debugfs_recreate_netdev(struct ieee80211_sub_if_data *sdata,\n1034:\t\t\t\t\t       bool mld_vif)\n1035:\t{\n1036:\t\tieee80211_debugfs_remove_netdev(sdata);\n1037:\t\tieee80211_debugfs_add_netdev(sdata, mld_vif);\n1038:\t\tieee80211_debugfs_key_update_default(sdata);\n1039:\t\n1040:\t\tif (sdata-\u003eflags \u0026 IEEE80211_SDATA_IN_DRIVER) {\n1041:\t\t\tdrv_vif_add_debugfs(sdata-\u003elocal, sdata);\n1042:\t\t\tif (!mld_vif)\n1043:\t\t\t\tieee80211_link_debugfs_drv_add(\u0026sdata-\u003edeflink);\n1044:\t\t}\n1045:\t}\n1046:\t\n1047:\tvoid ieee80211_link_debugfs_add(struct ieee80211_link_data *link)\n1048:\t{\n1049:\t\tchar link_dir_name[10];\n1050:\t\n1051:\t\tif (WARN_ON(!link-\u003esdata-\u003evif.debugfs_dir || link-\u003edebugfs_dir))\n1052:\t\t\treturn;\n1053:\t\n1054:\t\t/* For now, this should not be called for non-MLO capable drivers */\n"
}

gemini-3.7-flash

null

null

							input: 6511
							output: 167
							thoughts: 605
						

**My Analysis of the Debugfs Patch**

Okay, let's break this down. This patch is all about fixing a pretty nasty bug related to how we handle debugfs entries, specifically when a network device is removed and recreated. The core issue is the function `ieee80211_debugfs_remove_netdev`, which calls `debugfs_remove_recursive` on the netdev's debugfs directory.  This recursive removal leads to stale pointers. Specifically, the dentries pointed to by `sdata->debugfs.default_unicast_key` and `sdata->debugfs.default_multicast_key` are getting freed.  Later, functions like `ieee80211_debugfs_key_update_default` could try to operate on these now-invalid pointers, leading to a use-after-free or, even worse, a double-free if we're not careful.  Alternatively, when we recreate the netdev's debugfs, the default key symlinks aren't re-established in `ieee80211_debugfs_recreate_netdev`.

The patch's solution is straightforward: we set `sdata->debugfs.default_unicast_key` and `sdata->debugfs.default_multicast_key` to `NULL` during netdev removal. Then, during the recreation of the netdev's debugfs, we call `ieee80211_debugfs_key_update_default(sdata)` to ensure the symlinks are correctly recreated. This fixes the stale pointer issue and restores the default key symlinks correctly.

Now, about memory safety.  I've checked for uninitialized memory risks.  There's no structure data being copied to user space, so that's good. There are no uninitialized memory reads or allocations happening. The patch specifically sets those key pointers to `NULL`, and `ieee80211_debugfs_key_update_default` uses `sprintf` with an initialized string buffer for the symlink creation.  The core memory bugs (UAF, double-free) are things that KASAN will catch.

So, given that, I'm confident that this is *not* a KMSAN issue. I've double-checked my work. Let me run through the usual KMSAN criteria:

1.  Kernel data exposed to user space? No.
2.  Conditional logic based on uninitialized variables? No.
3.  Allocation of complex data structures with uninitialized fields? No.
4.  Bounds checks/lengths giving access to uninit memory? No.

Therefore, `NeedsKMSAN=false`.

In summary, this patch is a bug fix that addresses dangling debugfs pointers and missing symlinks.  KASAN is sufficient to catch any remaining memory errors. KMSAN isn't needed here.

{
  "KMSANReasoning": "The patch addresses debugfs lifetime management in mac80211 by zeroing dangling debugfs dentry pointers (default_unicast_key and default_multicast_key) upon interface debugfs removal and re-creating default key symlinks during interface debugfs recreation. \n\nThis change does not introduce or modify any uninitialized memory paths, heap/stack allocations, or kernel-to-user info leaks (e.g., via copy_to_user or netlink). Any potential memory management issues related to stale debugfs dentries or use-after-free conditions are addressed and detectable by KASAN. Therefore, a dedicated KMSAN fuzzing session is not warranted.",
  "NeedsKMSAN": false
}

{
  "KMSANReasoning": "The patch addresses debugfs lifetime management in mac80211 by zeroing dangling debugfs dentry pointers (default_unicast_key and default_multicast_key) upon interface debugfs removal and re-creating default key symlinks during interface debugfs recreation. \n\nThis change does not introduce or modify any uninitialized memory paths, heap/stack allocations, or kernel-to-user info leaks (e.g., via copy_to_user or netlink). Any potential memory management issues related to stale debugfs dentries or use-after-free conditions are addressed and detectable by KASAN. Therefore, a dedicated KMSAN fuzzing session is not warranted.",
  "NeedsKMSAN": false
}