AI Trajectory


Trajectory: (Expand/Collapse All)
Seq Timestamp Type Name Duration
0/0 2026/06/23 04:21 flow patch-triage
0m Args:
null

Results:
{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch only modifies format specifiers and adds missing newlines in logging functions (ath12k_dbg, ath12k_warn, ath12k_err, ath12k_info). It does not contain any functional changes.",
  "WorthFuzzing": false
}

1/1 2026/06/23 04:21 action read-patch-diff
0m Args:
null

Results:
{
  "PatchDiff": "commit ecc2605ea25d1c10a18bf49469ddf00a919ea93e\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Tue Jun 23 04:21:20 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/wireless/ath/ath12k/qmi.c b/drivers/net/wireless/ath/ath12k/qmi.c\nindex fd762b5d7bb597..b9a606c8ec8269 100644\n--- a/drivers/net/wireless/ath/ath12k/qmi.c\n+++ b/drivers/net/wireless/ath/ath12k/qmi.c\n@@ -2094,14 +2094,14 @@ static int ath12k_host_cap_parse_mlo(struct ath12k_base *ab,\n \n \tif (!ag-\u003emlo_capable) {\n \t\tath12k_dbg(ab, ATH12K_DBG_QMI,\n-\t\t\t   \"MLO is disabled hence skip QMI MLO cap\");\n+\t\t\t   \"MLO is disabled hence skip QMI MLO cap\\n\");\n \t\treturn 0;\n \t}\n \n \tif (!ab-\u003eqmi.num_radios || ab-\u003eqmi.num_radios == U8_MAX) {\n \t\tag-\u003emlo_capable = false;\n \t\tath12k_dbg(ab, ATH12K_DBG_QMI,\n-\t\t\t   \"skip QMI MLO cap due to invalid num_radio %d\\n\",\n+\t\t\t   \"skip QMI MLO cap due to invalid num_radio %u\\n\",\n \t\t\t   ab-\u003eqmi.num_radios);\n \t\treturn 0;\n \t}\n@@ -2125,7 +2125,7 @@ static int ath12k_host_cap_parse_mlo(struct ath12k_base *ab,\n \treq-\u003emlo_num_chips_valid = 1;\n \treq-\u003emlo_num_chips = ag-\u003enum_devices;\n \n-\tath12k_dbg(ab, ATH12K_DBG_QMI, \"mlo capability advertisement device_id %d group_id %d num_devices %d\",\n+\tath12k_dbg(ab, ATH12K_DBG_QMI, \"mlo capability advertisement device_id %u group_id %u num_devices %u\\n\",\n \t\t   req-\u003emlo_chip_id, req-\u003emlo_group_id, req-\u003emlo_num_chips);\n \n \tmutex_lock(\u0026ag-\u003emutex);\n@@ -2146,14 +2146,14 @@ static int ath12k_host_cap_parse_mlo(struct ath12k_base *ab,\n \t\tinfo-\u003echip_id = partner_ab-\u003edevice_id;\n \t\tinfo-\u003enum_local_links = partner_ab-\u003eqmi.num_radios;\n \n-\t\tath12k_dbg(ab, ATH12K_DBG_QMI, \"mlo device id %d num_link %d\\n\",\n+\t\tath12k_dbg(ab, ATH12K_DBG_QMI, \"mlo device id %u num_link %u\\n\",\n \t\t\t   info-\u003echip_id, info-\u003enum_local_links);\n \n \t\tfor (j = 0; j \u003c info-\u003enum_local_links; j++) {\n \t\t\tinfo-\u003ehw_link_id[j] = partner_ab-\u003ewsi_info.hw_link_id_base + j;\n \t\t\tinfo-\u003evalid_mlo_link_id[j] = 1;\n \n-\t\t\tath12k_dbg(ab, ATH12K_DBG_QMI, \"mlo hw_link_id %d\\n\",\n+\t\t\tath12k_dbg(ab, ATH12K_DBG_QMI, \"mlo hw_link_id %u\\n\",\n \t\t\t\t   info-\u003ehw_link_id[j]);\n \n \t\t\thw_link_id++;\n@@ -2268,7 +2268,7 @@ int ath12k_qmi_host_cap_send(struct ath12k_base *ab)\n \t\tgoto out;\n \n \tif (resp.resp.result != QMI_RESULT_SUCCESS_V01) {\n-\t\tath12k_warn(ab, \"Host capability request failed, result: %d, err: %d\\n\",\n+\t\tath12k_warn(ab, \"Host capability request failed, result: %u, err: %u\\n\",\n \t\t\t    resp.resp.result, resp.resp.error);\n \t\tret = -EINVAL;\n \t\tgoto out;\n@@ -2320,7 +2320,7 @@ static void ath12k_qmi_phy_cap_send(struct ath12k_base *ab)\n \tab-\u003eqmi.num_radios = resp.num_phy;\n \n \tath12k_dbg(ab, ATH12K_DBG_QMI,\n-\t\t   \"phy capability resp valid %d single_chip_mlo_support %d valid %d num_phy %d valid %d board_id %d\\n\",\n+\t\t   \"phy capability resp valid %u single_chip_mlo_support %u valid %u num_phy %u valid %u board_id %u\\n\",\n \t\t   resp.single_chip_mlo_support_valid, resp.single_chip_mlo_support,\n \t\t   resp.num_phy_valid, resp.num_phy,\n \t\t   resp.board_id_valid, resp.board_id);\n@@ -2332,7 +2332,7 @@ static void ath12k_qmi_phy_cap_send(struct ath12k_base *ab)\n \tab-\u003eqmi.num_radios = ab-\u003ehw_params-\u003edef_num_link;\n \n \tath12k_dbg(ab, ATH12K_DBG_QMI,\n-\t\t   \"no valid response from PHY capability, choose default num_phy %d\\n\",\n+\t\t   \"no valid response from PHY capability, choose default num_phy %u\\n\",\n \t\t   ab-\u003eqmi.num_radios);\n }\n \n@@ -2393,7 +2393,7 @@ static int ath12k_qmi_fw_ind_register_send(struct ath12k_base *ab)\n \t}\n \n \tif (resp-\u003eresp.result != QMI_RESULT_SUCCESS_V01) {\n-\t\tath12k_warn(ab, \"FW Ind register request failed, result: %d, err: %d\\n\",\n+\t\tath12k_warn(ab, \"FW Ind register request failed, result: %u, err: %u\\n\",\n \t\t\t    resp-\u003eresp.result, resp-\u003eresp.error);\n \t\tret = -EINVAL;\n \t\tgoto out;\n@@ -2428,7 +2428,7 @@ int ath12k_qmi_respond_fw_mem_request(struct ath12k_base *ab)\n \tif (!test_bit(ATH12K_FLAG_FIXED_MEM_REGION, \u0026ab-\u003edev_flags) \u0026\u0026\n \t    ab-\u003eqmi.target_mem_delayed) {\n \t\tdelayed = true;\n-\t\tath12k_dbg(ab, ATH12K_DBG_QMI, \"qmi delays mem_request %d\\n\",\n+\t\tath12k_dbg(ab, ATH12K_DBG_QMI, \"qmi delays mem_request %u\\n\",\n \t\t\t   ab-\u003eqmi.mem_seg_count);\n \t} else {\n \t\tdelayed = false;\n@@ -2474,7 +2474,7 @@ int ath12k_qmi_respond_fw_mem_request(struct ath12k_base *ab)\n \t\tif (delayed \u0026\u0026 resp.resp.error == 0)\n \t\t\tgoto out;\n \n-\t\tath12k_warn(ab, \"Respond mem req failed, result: %d, err: %d\\n\",\n+\t\tath12k_warn(ab, \"Respond mem req failed, result: %u, err: %u\\n\",\n \t\t\t    resp.resp.result, resp.resp.error);\n \t\tret = -EINVAL;\n \t\tgoto out;\n@@ -2606,13 +2606,13 @@ static int ath12k_qmi_alloc_chunk(struct ath12k_base *ab,\n \t\tif (chunk-\u003esize \u003e ATH12K_QMI_MAX_CHUNK_SIZE) {\n \t\t\tab-\u003eqmi.target_mem_delayed = true;\n \t\t\tath12k_warn(ab,\n-\t\t\t\t    \"qmi dma allocation failed (%d B type %u), will try later with small size\\n\",\n+\t\t\t\t    \"qmi dma allocation failed (%u B type %u), will try later with small size\\n\",\n \t\t\t\t    chunk-\u003esize,\n \t\t\t\t    chunk-\u003etype);\n \t\t\tath12k_qmi_free_target_mem_chunk(ab);\n \t\t\treturn -EAGAIN;\n \t\t}\n-\t\tath12k_warn(ab, \"memory allocation failure for %u size: %d\\n\",\n+\t\tath12k_warn(ab, \"memory allocation failure for %u size: %u\\n\",\n \t\t\t    chunk-\u003etype, chunk-\u003esize);\n \t\treturn -ENOMEM;\n \t}\n@@ -2659,7 +2659,7 @@ static int ath12k_qmi_alloc_target_mem_chunk(struct ath12k_base *ab)\n \t\t\tmlo_size += chunk-\u003esize;\n \t\t\tif (ag-\u003emlo_mem.mlo_mem_size \u0026\u0026\n \t\t\t    mlo_size \u003e ag-\u003emlo_mem.mlo_mem_size) {\n-\t\t\t\tath12k_err(ab, \"QMI MLO memory allocation failure, requested size %d is more than allocated size %d\",\n+\t\t\t\tath12k_err(ab, \"QMI MLO memory allocation failure, requested size %d is more than allocated size %d\\n\",\n \t\t\t\t\t   mlo_size, ag-\u003emlo_mem.mlo_mem_size);\n \t\t\t\tret = -EINVAL;\n \t\t\t\tgoto err;\n@@ -2668,7 +2668,7 @@ static int ath12k_qmi_alloc_target_mem_chunk(struct ath12k_base *ab)\n \t\t\tmlo_chunk = \u0026ag-\u003emlo_mem.chunk[mlo_idx];\n \t\t\tif (mlo_chunk-\u003epaddr) {\n \t\t\t\tif (chunk-\u003esize != mlo_chunk-\u003esize) {\n-\t\t\t\t\tath12k_err(ab, \"QMI MLO chunk memory allocation failure for index %d, requested size %d is more than allocated size %d\",\n+\t\t\t\t\tath12k_err(ab, \"QMI MLO chunk memory allocation failure for index %d, requested size %u is more than allocated size %u\\n\",\n \t\t\t\t\t\t   mlo_idx, chunk-\u003esize, mlo_chunk-\u003esize);\n \t\t\t\t\tret = -EINVAL;\n \t\t\t\t\tgoto err;\n@@ -2699,7 +2699,7 @@ static int ath12k_qmi_alloc_target_mem_chunk(struct ath12k_base *ab)\n \tif (!ag-\u003emlo_mem.mlo_mem_size) {\n \t\tag-\u003emlo_mem.mlo_mem_size = mlo_size;\n \t} else if (ag-\u003emlo_mem.mlo_mem_size != mlo_size) {\n-\t\tath12k_err(ab, \"QMI MLO memory size error, expected size is %d but requested size is %d\",\n+\t\tath12k_err(ab, \"QMI MLO memory size error, expected size is %d but requested size is %d\\n\",\n \t\t\t   ag-\u003emlo_mem.mlo_mem_size, mlo_size);\n \t\tret = -EINVAL;\n \t\tgoto err;\n@@ -2884,7 +2884,7 @@ int ath12k_qmi_request_target_cap(struct ath12k_base *ab)\n \t}\n \n \tif (resp.resp.result != QMI_RESULT_SUCCESS_V01) {\n-\t\tath12k_warn(ab, \"qmi targetcap req failed, result: %d, err: %d\\n\",\n+\t\tath12k_warn(ab, \"qmi targetcap req failed, result: %u, err: %u\\n\",\n \t\t\t    resp.resp.result, resp.resp.error);\n \t\tret = -EINVAL;\n \t\tgoto out;\n@@ -2936,7 +2936,7 @@ int ath12k_qmi_request_target_cap(struct ath12k_base *ab)\n \t\t    ab-\u003eqmi.target.chip_id, ab-\u003eqmi.target.chip_family,\n \t\t    ab-\u003eqmi.target.board_id, ab-\u003eqmi.target.soc_id);\n \n-\tath12k_info(ab, \"fw_version 0x%x fw_build_timestamp %s fw_build_id %s\",\n+\tath12k_info(ab, \"fw_version 0x%x fw_build_timestamp %s fw_build_id %s\\n\",\n \t\t    ab-\u003eqmi.target.fw_version,\n \t\t    ab-\u003eqmi.target.fw_build_timestamp,\n \t\t    ab-\u003eqmi.target.fw_build_id);\n@@ -3006,7 +3006,7 @@ static int ath12k_qmi_load_file_target_mem(struct ath12k_base *ab,\n \t\tif (ret \u003c 0)\n \t\t\tgoto out;\n \n-\t\tath12k_dbg(ab, ATH12K_DBG_QMI, \"qmi bdf download req fixed addr type %d\\n\",\n+\t\tath12k_dbg(ab, ATH12K_DBG_QMI, \"qmi bdf download req fixed addr type %u\\n\",\n \t\t\t   type);\n \n \t\tret = qmi_send_request(\u0026ab-\u003eqmi.handle, NULL, \u0026txn,\n@@ -3023,7 +3023,7 @@ static int ath12k_qmi_load_file_target_mem(struct ath12k_base *ab,\n \t\t\tgoto out;\n \n \t\tif (resp.resp.result != QMI_RESULT_SUCCESS_V01) {\n-\t\t\tath12k_warn(ab, \"qmi BDF download failed, result: %d, err: %d\\n\",\n+\t\t\tath12k_warn(ab, \"qmi BDF download failed, result: %u, err: %u\\n\",\n \t\t\t\t    resp.resp.result, resp.resp.error);\n \t\t\tret = -EINVAL;\n \t\t\tgoto out;\n@@ -3036,7 +3036,7 @@ static int ath12k_qmi_load_file_target_mem(struct ath12k_base *ab,\n \t\t\ttemp += req-\u003edata_len;\n \t\t\treq-\u003eseg_id++;\n \t\t\tath12k_dbg(ab, ATH12K_DBG_QMI,\n-\t\t\t\t   \"qmi bdf download request remaining %i\\n\",\n+\t\t\t\t   \"qmi bdf download request remaining %u\\n\",\n \t\t\t\t   remaining);\n \t\t}\n \t}\n@@ -3127,7 +3127,7 @@ int ath12k_qmi_load_bdf_qmi(struct ath12k_base *ab,\n \t\t\trelease_firmware(fw_entry);\n \t\treturn ret;\n \tdefault:\n-\t\tath12k_warn(ab, \"unknown file type for load %d\", type);\n+\t\tath12k_warn(ab, \"unknown file type for load %d\\n\", type);\n \t\tgoto out;\n \t}\n \n@@ -3239,7 +3239,7 @@ int ath12k_qmi_wlanfw_m3_info_send(struct ath12k_base *ab)\n \tif (ab-\u003ehw_params-\u003efw.m3_loader == ath12k_m3_fw_loader_driver) {\n \t\tret = ath12k_qmi_m3_load(ab);\n \t\tif (ret) {\n-\t\t\tath12k_err(ab, \"failed to load m3 firmware: %d\", ret);\n+\t\t\tath12k_err(ab, \"failed to load m3 firmware: %d\\n\", ret);\n \t\t\treturn ret;\n \t\t}\n \t\treq.addr = m3_mem-\u003epaddr;\n@@ -3269,7 +3269,7 @@ int ath12k_qmi_wlanfw_m3_info_send(struct ath12k_base *ab)\n \t}\n \n \tif (resp.resp.result != QMI_RESULT_SUCCESS_V01) {\n-\t\tath12k_warn(ab, \"qmi M3 info request failed, result: %d, err: %d\\n\",\n+\t\tath12k_warn(ab, \"qmi M3 info request failed, result: %u, err: %u\\n\",\n \t\t\t    resp.resp.result, resp.resp.error);\n \t\tret = -EINVAL;\n \t\tgoto out;\n@@ -3364,7 +3364,7 @@ int ath12k_qmi_wlanfw_aux_uc_info_send(struct ath12k_base *ab)\n \n \tret = ath12k_qmi_aux_uc_load(ab);\n \tif (ret) {\n-\t\tath12k_err(ab, \"failed to load aux_uc firmware: %d\", ret);\n+\t\tath12k_err(ab, \"failed to load aux_uc firmware: %d\\n\", ret);\n \t\treturn ret;\n \t}\n \n@@ -3394,7 +3394,7 @@ int ath12k_qmi_wlanfw_aux_uc_info_send(struct ath12k_base *ab)\n \t}\n \n \tif (resp.resp.result != QMI_RESULT_SUCCESS_V01) {\n-\t\tath12k_warn(ab, \"qmi AUX_UC info request failed, result: %d, err: %d\\n\",\n+\t\tath12k_warn(ab, \"qmi AUX_UC info request failed, result: %u, err: %u\\n\",\n \t\t\t    resp.resp.result, resp.resp.error);\n \t\tret = -EINVAL;\n \t\tgoto out;\n@@ -3426,7 +3426,7 @@ static int ath12k_qmi_wlanfw_mode_send(struct ath12k_base *ab,\n \t\t\t       qmi_wlanfw_wlan_mode_req_msg_v01_ei, \u0026req);\n \tif (ret \u003c 0) {\n \t\tqmi_txn_cancel(\u0026txn);\n-\t\tath12k_warn(ab, \"qmi failed to send mode request, mode: %d, err = %d\\n\",\n+\t\tath12k_warn(ab, \"qmi failed to send mode request, mode: %u, err = %d\\n\",\n \t\t\t    mode, ret);\n \t\tgoto out;\n \t}\n@@ -3437,13 +3437,13 @@ static int ath12k_qmi_wlanfw_mode_send(struct ath12k_base *ab,\n \t\t\tath12k_warn(ab, \"WLFW service is dis-connected\\n\");\n \t\t\treturn 0;\n \t\t}\n-\t\tath12k_warn(ab, \"qmi failed set mode request, mode: %d, err = %d\\n\",\n+\t\tath12k_warn(ab, \"qmi failed set mode request, mode: %u, err = %d\\n\",\n \t\t\t    mode, ret);\n \t\tgoto out;\n \t}\n \n \tif (resp.resp.result != QMI_RESULT_SUCCESS_V01) {\n-\t\tath12k_warn(ab, \"Mode request failed, mode: %d, result: %d err: %d\\n\",\n+\t\tath12k_warn(ab, \"Mode request failed, mode: %u, result: %u err: %u\\n\",\n \t\t\t    mode, resp.resp.result, resp.resp.error);\n \t\tret = -EINVAL;\n \t\tgoto out;\n@@ -3536,7 +3536,7 @@ static int ath12k_qmi_wlanfw_wlan_cfg_send(struct ath12k_base *ab)\n \t}\n \n \tif (resp.resp.result != QMI_RESULT_SUCCESS_V01) {\n-\t\tath12k_warn(ab, \"qmi wlan config request failed, result: %d, err: %d\\n\",\n+\t\tath12k_warn(ab, \"qmi wlan config request failed, result: %u, err: %u\\n\",\n \t\t\t    resp.resp.result, resp.resp.error);\n \t\tret = -EINVAL;\n \t\tgoto out;\n@@ -3580,7 +3580,7 @@ static int ath12k_qmi_wlanfw_wlan_ini_send(struct ath12k_base *ab)\n \t}\n \n \tif (resp.resp.result != QMI_RESULT_SUCCESS_V01) {\n-\t\tath12k_warn(ab, \"QMI wlan ini response failure: %d %d\\n\",\n+\t\tath12k_warn(ab, \"QMI wlan ini response failure: %u %u\\n\",\n \t\t\t    resp.resp.result, resp.resp.error);\n \t\tret = -EINVAL;\n \t\tgoto out;\n@@ -3663,7 +3663,7 @@ void ath12k_qmi_trigger_host_cap(struct ath12k_base *ab)\n \n \tspin_unlock(\u0026qmi-\u003eevent_lock);\n \n-\tath12k_dbg(ab, ATH12K_DBG_QMI, \"trigger host cap for device id %d\\n\",\n+\tath12k_dbg(ab, ATH12K_DBG_QMI, \"trigger host cap for device id %u\\n\",\n \t\t   ab-\u003edevice_id);\n \n \tath12k_qmi_driver_event_post(qmi, ATH12K_QMI_EVENT_HOST_CAP, NULL);\n@@ -3833,7 +3833,7 @@ static void ath12k_qmi_msg_mem_request_cb(struct qmi_handle *qmi_hdl,\n \tfor (i = 0; i \u003c qmi-\u003emem_seg_count ; i++) {\n \t\tab-\u003eqmi.target_mem[i].type = msg-\u003emem_seg[i].type;\n \t\tab-\u003eqmi.target_mem[i].size = msg-\u003emem_seg[i].size;\n-\t\tath12k_dbg(ab, ATH12K_DBG_QMI, \"qmi mem seg type %d size %d\\n\",\n+\t\tath12k_dbg(ab, ATH12K_DBG_QMI, \"qmi mem seg type %d size %u\\n\",\n \t\t\t   msg-\u003emem_seg[i].type, msg-\u003emem_seg[i].size);\n \t}\n \n@@ -3954,7 +3954,7 @@ static int ath12k_qmi_event_host_cap(struct ath12k_qmi *qmi)\n \n \tret = ath12k_qmi_host_cap_send(ab);\n \tif (ret \u003c 0) {\n-\t\tath12k_warn(ab, \"failed to send qmi host cap for device id %d: %d\\n\",\n+\t\tath12k_warn(ab, \"failed to send qmi host cap for device id %u: %d\\n\",\n \t\t\t    ab-\u003edevice_id, ret);\n \t\treturn ret;\n \t}\n@@ -4024,7 +4024,7 @@ static void ath12k_qmi_driver_event_work(struct work_struct *work)\n \t\t\t\tset_bit(ATH12K_FLAG_QMI_FAIL, \u0026ab-\u003edev_flags);\n \t\t\tbreak;\n \t\tdefault:\n-\t\t\tath12k_warn(ab, \"invalid event type: %d\", event-\u003etype);\n+\t\t\tath12k_warn(ab, \"invalid event type: %d\\n\", event-\u003etype);\n \t\t\tbreak;\n \t\t}\n \n"
}

2/1 2026/06/23 04:21 agent patch-evaluator
0m Model:
gemini-3.1-pro-preview

Args:
null

Results:
{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch only modifies format specifiers and adds missing newlines in logging functions (ath12k_dbg, ath12k_warn, ath12k_err, ath12k_info). It does not contain any functional changes.",
  "WorthFuzzing": false
}

Instruction:
You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Do not list too generic configs (we already have them enabled). Only list those that
   specifically cover the modified code. List them in the EnableConfigs output array,
   and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

Prompt:
For your convenience, here is the diff of the changes:
commit ecc2605ea25d1c10a18bf49469ddf00a919ea93e
Author: syz-cluster <triage@syzkaller.com>
Date:   Tue Jun 23 04:21:20 2026 +0000

    syz-cluster: applied patch under review

diff --git a/drivers/net/wireless/ath/ath12k/qmi.c b/drivers/net/wireless/ath/ath12k/qmi.c
index fd762b5d7bb597..b9a606c8ec8269 100644
--- a/drivers/net/wireless/ath/ath12k/qmi.c
+++ b/drivers/net/wireless/ath/ath12k/qmi.c
@@ -2094,14 +2094,14 @@ static int ath12k_host_cap_parse_mlo(struct ath12k_base *ab,
 
 	if (!ag->mlo_capable) {
 		ath12k_dbg(ab, ATH12K_DBG_QMI,
-			   "MLO is disabled hence skip QMI MLO cap");
+			   "MLO is disabled hence skip QMI MLO cap\n");
 		return 0;
 	}
 
 	if (!ab->qmi.num_radios || ab->qmi.num_radios == U8_MAX) {
 		ag->mlo_capable = false;
 		ath12k_dbg(ab, ATH12K_DBG_QMI,
-			   "skip QMI MLO cap due to invalid num_radio %d\n",
+			   "skip QMI MLO cap due to invalid num_radio %u\n",
 			   ab->qmi.num_radios);
 		return 0;
 	}
@@ -2125,7 +2125,7 @@ static int ath12k_host_cap_parse_mlo(struct ath12k_base *ab,
 	req->mlo_num_chips_valid = 1;
 	req->mlo_num_chips = ag->num_devices;
 
-	ath12k_dbg(ab, ATH12K_DBG_QMI, "mlo capability advertisement device_id %d group_id %d num_devices %d",
+	ath12k_dbg(ab, ATH12K_DBG_QMI, "mlo capability advertisement device_id %u group_id %u num_devices %u\n",
 		   req->mlo_chip_id, req->mlo_group_id, req->mlo_num_chips);
 
 	mutex_lock(&ag->mutex);
@@ -2146,14 +2146,14 @@ static int ath12k_host_cap_parse_mlo(struct ath12k_base *ab,
 		info->chip_id = partner_ab->device_id;
 		info->num_local_links = partner_ab->qmi.num_radios;
 
-		ath12k_dbg(ab, ATH12K_DBG_QMI, "mlo device id %d num_link %d\n",
+		ath12k_dbg(ab, ATH12K_DBG_QMI, "mlo device id %u num_link %u\n",
 			   info->chip_id, info->num_local_links);
 
 		for (j = 0; j < info->num_local_links; j++) {
 			info->hw_link_id[j] = partner_ab->wsi_info.hw_link_id_base + j;
 			info->valid_mlo_link_id[j] = 1;
 
-			ath12k_dbg(ab, ATH12K_DBG_QMI, "mlo hw_link_id %d\n",
+			ath12k_dbg(ab, ATH12K_DBG_QMI, "mlo hw_link_id %u\n",
 				   info->hw_link_id[j]);
 
 			hw_link_id++;
@@ -2268,7 +2268,7 @@ int ath12k_qmi_host_cap_send(struct ath12k_base *ab)
 		goto out;
 
 	if (resp.resp.result != QMI_RESULT_SUCCESS_V01) {
-		ath12k_warn(ab, "Host capability request failed, result: %d, err: %d\n",
+		ath12k_warn(ab, "Host capability request failed, result: %u, err: %u\n",
 			    resp.resp.result, resp.resp.error);
 		ret = -EINVAL;
 		goto out;
@@ -2320,7 +2320,7 @@ static void ath12k_qmi_phy_cap_send(struct ath12k_base *ab)
 	ab->qmi.num_radios = resp.num_phy;
 
 	ath12k_dbg(ab, ATH12K_DBG_QMI,
-		   "phy capability resp valid %d single_chip_mlo_support %d valid %d num_phy %d valid %d board_id %d\n",
+		   "phy capability resp valid %u single_chip_mlo_support %u valid %u num_phy %u valid %u board_id %u\n",
 		   resp.single_chip_mlo_support_valid, resp.single_chip_mlo_support,
 		   resp.num_phy_valid, resp.num_phy,
 		   resp.board_id_valid, resp.board_id);
@@ -2332,7 +2332,7 @@ static void ath12k_qmi_phy_cap_send(struct ath12k_base *ab)
 	ab->qmi.num_radios = ab->hw_params->def_num_link;
 
 	ath12k_dbg(ab, ATH12K_DBG_QMI,
-		   "no valid response from PHY capability, choose default num_phy %d\n",
+		   "no valid response from PHY capability, choose default num_phy %u\n",
 		   ab->qmi.num_radios);
 }
 
@@ -2393,7 +2393,7 @@ static int ath12k_qmi_fw_ind_register_send(struct ath12k_base *ab)
 	}
 
 	if (resp->resp.result != QMI_RESULT_SUCCESS_V01) {
-		ath12k_warn(ab, "FW Ind register request failed, result: %d, err: %d\n",
+		ath12k_warn(ab, "FW Ind register request failed, result: %u, err: %u\n",
 			    resp->resp.result, resp->resp.error);
 		ret = -EINVAL;
 		goto out;
@@ -2428,7 +2428,7 @@ int ath12k_qmi_respond_fw_mem_request(struct ath12k_base *ab)
 	if (!test_bit(ATH12K_FLAG_FIXED_MEM_REGION, &ab->dev_flags) &&
 	    ab->qmi.target_mem_delayed) {
 		delayed = true;
-		ath12k_dbg(ab, ATH12K_DBG_QMI, "qmi delays mem_request %d\n",
+		ath12k_dbg(ab, ATH12K_DBG_QMI, "qmi delays mem_request %u\n",
 			   ab->qmi.mem_seg_count);
 	} else {
 		delayed = false;
@@ -2474,7 +2474,7 @@ int ath12k_qmi_respond_fw_mem_request(struct ath12k_base *ab)
 		if (delayed && resp.resp.error == 0)
 			goto out;
 
-		ath12k_warn(ab, "Respond mem req failed, result: %d, err: %d\n",
+		ath12k_warn(ab, "Respond mem req failed, result: %u, err: %u\n",
 			    resp.resp.result, resp.resp.error);
 		ret = -EINVAL;
 		goto out;
@@ -2606,13 +2606,13 @@ static int ath12k_qmi_alloc_chunk(struct ath12k_base *ab,
 		if (chunk->size > ATH12K_QMI_MAX_CHUNK_SIZE) {
 			ab->qmi.target_mem_delayed = true;
 			ath12k_warn(ab,
-				    "qmi dma allocation failed (%d B type %u), will try later with small size\n",
+				    "qmi dma allocation failed (%u B type %u), will try later with small size\n",
 				    chunk->size,
 				    chunk->type);
 			ath12k_qmi_free_target_mem_chunk(ab);
 			return -EAGAIN;
 		}
-		ath12k_warn(ab, "memory allocation failure for %u size: %d\n",
+		ath12k_warn(ab, "memory allocation failure for %u size: %u\n",
 			    chunk->type, chunk->size);
 		return -ENOMEM;
 	}
@@ -2659,7 +2659,7 @@ static int ath12k_qmi_alloc_target_mem_chunk(struct ath12k_base *ab)
 			mlo_size += chunk->size;
 			if (ag->mlo_mem.mlo_mem_size &&
 			    mlo_size > ag->mlo_mem.mlo_mem_size) {
-				ath12k_err(ab, "QMI MLO memory allocation failure, requested size %d is more than allocated size %d",
+				ath12k_err(ab, "QMI MLO memory allocation failure, requested size %d is more than allocated size %d\n",
 					   mlo_size, ag->mlo_mem.mlo_mem_size);
 				ret = -EINVAL;
 				goto err;
@@ -2668,7 +2668,7 @@ static int ath12k_qmi_alloc_target_mem_chunk(struct ath12k_base *ab)
 			mlo_chunk = &ag->mlo_mem.chunk[mlo_idx];
 			if (mlo_chunk->paddr) {
 				if (chunk->size != mlo_chunk->size) {
-					ath12k_err(ab, "QMI MLO chunk memory allocation failure for index %d, requested size %d is more than allocated size %d",
+					ath12k_err(ab, "QMI MLO chunk memory allocation failure for index %d, requested size %u is more than allocated size %u\n",
 						   mlo_idx, chunk->size, mlo_chunk->size);
 					ret = -EINVAL;
 					goto err;
@@ -2699,7 +2699,7 @@ static int ath12k_qmi_alloc_target_mem_chunk(struct ath12k_base *ab)
 	if (!ag->mlo_mem.mlo_mem_size) {
 		ag->mlo_mem.mlo_mem_size = mlo_size;
 	} else if (ag->mlo_mem.mlo_mem_size != mlo_size) {
-		ath12k_err(ab, "QMI MLO memory size error, expected size is %d but requested size is %d",
+		ath12k_err(ab, "QMI MLO memory size error, expected size is %d but requested size is %d\n",
 			   ag->mlo_mem.mlo_mem_size, mlo_size);
 		ret = -EINVAL;
 		goto err;
@@ -2884,7 +2884,7 @@ int ath12k_qmi_request_target_cap(struct ath12k_base *ab)
 	}
 
 	if (resp.resp.result != QMI_RESULT_SUCCESS_V01) {
-		ath12k_warn(ab, "qmi targetcap req failed, result: %d, err: %d\n",
+		ath12k_warn(ab, "qmi targetcap req failed, result: %u, err: %u\n",
 			    resp.resp.result, resp.resp.error);
 		ret = -EINVAL;
 		goto out;
@@ -2936,7 +2936,7 @@ int ath12k_qmi_request_target_cap(struct ath12k_base *ab)
 		    ab->qmi.target.chip_id, ab->qmi.target.chip_family,
 		    ab->qmi.target.board_id, ab->qmi.target.soc_id);
 
-	ath12k_info(ab, "fw_version 0x%x fw_build_timestamp %s fw_build_id %s",
+	ath12k_info(ab, "fw_version 0x%x fw_build_timestamp %s fw_build_id %s\n",
 		    ab->qmi.target.fw_version,
 		    ab->qmi.target.fw_build_timestamp,
 		    ab->qmi.target.fw_build_id);
@@ -3006,7 +3006,7 @@ static int ath12k_qmi_load_file_target_mem(struct ath12k_base *ab,
 		if (ret < 0)
 			goto out;
 
-		ath12k_dbg(ab, ATH12K_DBG_QMI, "qmi bdf download req fixed addr type %d\n",
+		ath12k_dbg(ab, ATH12K_DBG_QMI, "qmi bdf download req fixed addr type %u\n",
 			   type);
 
 		ret = qmi_send_request(&ab->qmi.handle, NULL, &txn,
@@ -3023,7 +3023,7 @@ static int ath12k_qmi_load_file_target_mem(struct ath12k_base *ab,
 			goto out;
 
 		if (resp.resp.result != QMI_RESULT_SUCCESS_V01) {
-			ath12k_warn(ab, "qmi BDF download failed, result: %d, err: %d\n",
+			ath12k_warn(ab, "qmi BDF download failed, result: %u, err: %u\n",
 				    resp.resp.result, resp.resp.error);
 			ret = -EINVAL;
 			goto out;
@@ -3036,7 +3036,7 @@ static int ath12k_qmi_load_file_target_mem(struct ath12k_base *ab,
 			temp += req->data_len;
 			req->seg_id++;
 			ath12k_dbg(ab, ATH12K_DBG_QMI,
-				   "qmi bdf download request remaining %i\n",
+				   "qmi bdf download request remaining %u\n",
 				   remaining);
 		}
 	}
@@ -3127,7 +3127,7 @@ int ath12k_qmi_load_bdf_qmi(struct ath12k_base *ab,
 			release_firmware(fw_entry);
 		return ret;
 	default:
-		ath12k_warn(ab, "unknown file type for load %d", type);
+		ath12k_warn(ab, "unknown file type for load %d\n", type);
 		goto out;
 	}
 
@@ -3239,7 +3239,7 @@ int ath12k_qmi_wlanfw_m3_info_send(struct ath12k_base *ab)
 	if (ab->hw_params->fw.m3_loader == ath12k_m3_fw_loader_driver) {
 		ret = ath12k_qmi_m3_load(ab);
 		if (ret) {
-			ath12k_err(ab, "failed to load m3 firmware: %d", ret);
+			ath12k_err(ab, "failed to load m3 firmware: %d\n", ret);
 			return ret;
 		}
 		req.addr = m3_mem->paddr;
@@ -3269,7 +3269,7 @@ int ath12k_qmi_wlanfw_m3_info_send(struct ath12k_base *ab)
 	}
 
 	if (resp.resp.result != QMI_RESULT_SUCCESS_V01) {
-		ath12k_warn(ab, "qmi M3 info request failed, result: %d, err: %d\n",
+		ath12k_warn(ab, "qmi M3 info request failed, result: %u, err: %u\n",
 			    resp.resp.result, resp.resp.error);
 		ret = -EINVAL;
 		goto out;
@@ -3364,7 +3364,7 @@ int ath12k_qmi_wlanfw_aux_uc_info_send(struct ath12k_base *ab)
 
 	ret = ath12k_qmi_aux_uc_load(ab);
 	if (ret) {
-		ath12k_err(ab, "failed to load aux_uc firmware: %d", ret);
+		ath12k_err(ab, "failed to load aux_uc firmware: %d\n", ret);
 		return ret;
 	}
 
@@ -3394,7 +3394,7 @@ int ath12k_qmi_wlanfw_aux_uc_info_send(struct ath12k_base *ab)
 	}
 
 	if (resp.resp.result != QMI_RESULT_SUCCESS_V01) {
-		ath12k_warn(ab, "qmi AUX_UC info request failed, result: %d, err: %d\n",
+		ath12k_warn(ab, "qmi AUX_UC info request failed, result: %u, err: %u\n",
 			    resp.resp.result, resp.resp.error);
 		ret = -EINVAL;
 		goto out;
@@ -3426,7 +3426,7 @@ static int ath12k_qmi_wlanfw_mode_send(struct ath12k_base *ab,
 			       qmi_wlanfw_wlan_mode_req_msg_v01_ei, &req);
 	if (ret < 0) {
 		qmi_txn_cancel(&txn);
-		ath12k_warn(ab, "qmi failed to send mode request, mode: %d, err = %d\n",
+		ath12k_warn(ab, "qmi failed to send mode request, mode: %u, err = %d\n",
 			    mode, ret);
 		goto out;
 	}
@@ -3437,13 +3437,13 @@ static int ath12k_qmi_wlanfw_mode_send(struct ath12k_base *ab,
 			ath12k_warn(ab, "WLFW service is dis-connected\n");
 			return 0;
 		}
-		ath12k_warn(ab, "qmi failed set mode request, mode: %d, err = %d\n",
+		ath12k_warn(ab, "qmi failed set mode request, mode: %u, err = %d\n",
 			    mode, ret);
 		goto out;
 	}
 
 	if (resp.resp.result != QMI_RESULT_SUCCESS_V01) {
-		ath12k_warn(ab, "Mode request failed, mode: %d, result: %d err: %d\n",
+		ath12k_warn(ab, "Mode request failed, mode: %u, result: %u err: %u\n",
 			    mode, resp.resp.result, resp.resp.error);
 		ret = -EINVAL;
 		goto out;
@@ -3536,7 +3536,7 @@ static int ath12k_qmi_wlanfw_wlan_cfg_send(struct ath12k_base *ab)
 	}
 
 	if (resp.resp.result != QMI_RESULT_SUCCESS_V01) {
-		ath12k_warn(ab, "qmi wlan config request failed, result: %d, err: %d\n",
+		ath12k_warn(ab, "qmi wlan config request failed, result: %u, err: %u\n",
 			    resp.resp.result, resp.resp.error);
 		ret = -EINVAL;
 		goto out;
@@ -3580,7 +3580,7 @@ static int ath12k_qmi_wlanfw_wlan_ini_send(struct ath12k_base *ab)
 	}
 
 	if (resp.resp.result != QMI_RESULT_SUCCESS_V01) {
-		ath12k_warn(ab, "QMI wlan ini response failure: %d %d\n",
+		ath12k_warn(ab, "QMI wlan ini response failure: %u %u\n",
 			    resp.resp.result, resp.resp.error);
 		ret = -EINVAL;
 		goto out;
@@ -3663,7 +3663,7 @@ void ath12k_qmi_trigger_host_cap(struct ath12k_base *ab)
 
 	spin_unlock(&qmi->event_lock);
 
-	ath12k_dbg(ab, ATH12K_DBG_QMI, "trigger host cap for device id %d\n",
+	ath12k_dbg(ab, ATH12K_DBG_QMI, "trigger host cap for device id %u\n",
 		   ab->device_id);
 
 	ath12k_qmi_driver_event_post(qmi, ATH12K_QMI_EVENT_HOST_CAP, NULL);
@@ -3833,7 +3833,7 @@ static void ath12k_qmi_msg_mem_request_cb(struct qmi_handle *qmi_hdl,
 	for (i = 0; i < qmi->mem_seg_count ; i++) {
 		ab->qmi.target_mem[i].type = msg->mem_seg[i].type;
 		ab->qmi.target_mem[i].size = msg->mem_seg[i].size;
-		ath12k_dbg(ab, ATH12K_DBG_QMI, "qmi mem seg type %d size %d\n",
+		ath12k_dbg(ab, ATH12K_DBG_QMI, "qmi mem seg type %d size %u\n",
 			   msg->mem_seg[i].type, msg->mem_seg[i].size);
 	}
 
@@ -3954,7 +3954,7 @@ static int ath12k_qmi_event_host_cap(struct ath12k_qmi *qmi)
 
 	ret = ath12k_qmi_host_cap_send(ab);
 	if (ret < 0) {
-		ath12k_warn(ab, "failed to send qmi host cap for device id %d: %d\n",
+		ath12k_warn(ab, "failed to send qmi host cap for device id %u: %d\n",
 			    ab->device_id, ret);
 		return ret;
 	}
@@ -4024,7 +4024,7 @@ static void ath12k_qmi_driver_event_work(struct work_struct *work)
 				set_bit(ATH12K_FLAG_QMI_FAIL, &ab->dev_flags);
 			break;
 		default:
-			ath12k_warn(ab, "invalid event type: %d", event->type);
+			ath12k_warn(ab, "invalid event type: %d\n", event->type);
 			break;
 		}
 

3/2 2026/06/23 04:21 llm patch-evaluator
0m Model:
gemini-3.1-pro-preview

Args:
null

Results:
null

Tokens:
							input: 7726
							output: 83
							thoughts: 570
						

Thoughts:
**Analyzing a Logging-Only Patch**

Okay, I've got this patch affecting `drivers/net/wireless/ath/ath12k/qmi.c`. My initial glance suggests this is going to be a straightforward one. The changes seem to be all about modifying format specifiers within the logging functions: `ath12k_dbg`, `ath12k_warn`, `ath12k_err`, and `ath12k_info`. It looks like we're just correcting `%d` to `%u` where appropriate for unsigned variables and adding some missing newline characters, `\n`, to improve readability. There's nothing here that's going to alter the execution flow, at least not directly.

Let's do a quick double-check though. I need to be absolutely certain before I make any judgements. I see that the following variables are affected, which means these are all variables that were incorrectly treated as signed: `ab->qmi.num_radios`, `req->mlo_chip_id`, `info->chip_id`, `info->hw_link_id[j]`, `resp.resp.result`, `resp.single_chip_mlo_support_valid`, `ab->qmi.num_radios`, `resp->resp.result`, `ab->qmi.mem_seg_count`, and `chunk->size`.

There are also a couple of cases of adding the `\n`, so:
`%d\n` -> `%d\n` (added `\n`)
`%u\n` -> `%u\n`
`%d` -> `%d\n`
`%d` -> `%u`
`%s` -> `%s\n`
`%d` -> `%u`
`%i` -> `%u`
`%d` -> `%d\n`
`%d` -> `%d\n`
`%d` -> `%d\n`
`%d` -> `%u`
`%d` -> `%u`
`%d` -> `%u`
`%d` -> `%u`
`%d` -> `%u`
`%d` -> `%u`
`%d` -> `%u`
`%d` -> `%d\n`

Alright, that confirms it. All the changes are isolated to these logging macros. There's no functional modification here, just improving the logging output's correctness and clarity. This patch is purely cosmetic. Based on this analysis, I'm confident that the `WorthFuzzing` flag should be set to false. Time to update the results accordingly.



4/2 2026/06/23 04:21 tool set-results
0m Args:
{
  "EnableConfigs": [],
  "FocusSymbols": [],
  "Reasoning": "The patch only modifies format specifiers and adds missing newlines in logging functions (ath12k_dbg, ath12k_warn, ath12k_err, ath12k_info). It does not contain any functional changes.",
  "WorthFuzzing": false
}

Results:
{
  "EnableConfigs": null,
  "FocusSymbols": [],
  "Reasoning": "The patch only modifies format specifiers and adds missing newlines in logging functions (ath12k_dbg, ath12k_warn, ath12k_err, ath12k_info). It does not contain any functional changes.",
  "WorthFuzzing": false
}

LLM Calls Summary:
Total Calls Total Tokens Avg Tokens Total Duration (Seconds) Avg Duration (Seconds)
Tool Calls Summary:
Total Calls Total Duration (Seconds) Avg Duration (Seconds)