AI Trajectory

null

{
  "EnableConfigs": [
    "RTL8XXXU",
    "RTL8XXXU_UNTESTED"
  ],
  "FocusSymbols": [
    "rtl8xxxu_stop",
    "rtl8xxxu_rx_urb_work"
  ],
  "Reasoning": "The patch fixes a race condition between the RX URB completion handler and the driver stop routine in the rtl8xxxu wireless driver. It moves the workqueue scheduling inside a spinlock and adds a cancel_work_sync call to ensure the workqueue is properly cancelled during shutdown. Fuzzing the driver initialization and teardown paths (via dummy_hcd or mac80211_hwsim) can help verify this fix and uncover similar race conditions.",
  "WorthFuzzing": true
}

null

{
  "PatchDiff": "commit 5cd3940c4ffce8b69ffd5ab767b2add80442ee32\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Tue Jun 30 04:34:02 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/wireless/realtek/rtl8xxxu/core.c b/drivers/net/wireless/realtek/rtl8xxxu/core.c\nindex c06ad064f37c65..b447ce78ff058f 100644\n--- a/drivers/net/wireless/realtek/rtl8xxxu/core.c\n+++ b/drivers/net/wireless/realtek/rtl8xxxu/core.c\n@@ -5792,14 +5792,19 @@ static void rtl8xxxu_queue_rx_urb(struct rtl8xxxu_priv *priv,\n {\n \tstruct sk_buff *skb;\n \tunsigned long flags;\n-\tint pending = 0;\n \n \tspin_lock_irqsave(\u0026priv-\u003erx_urb_lock, flags);\n \n \tif (!priv-\u003eshutdown) {\n \t\tlist_add_tail(\u0026rx_urb-\u003elist, \u0026priv-\u003erx_urb_pending_list);\n \t\tpriv-\u003erx_urb_pending_count++;\n-\t\tpending = priv-\u003erx_urb_pending_count;\n+\t\t/*\n+\t\t * Arm the worker under rx_urb_lock so this is atomic with the\n+\t\t * shutdown check: moving it out of the lock would let a\n+\t\t * completion arm the work after rtl8xxxu_stop() canceled it.\n+\t\t */\n+\t\tif (priv-\u003erx_urb_pending_count \u003e RTL8XXXU_RX_URB_PENDING_WATER)\n+\t\t\tschedule_work(\u0026priv-\u003erx_urb_wq);\n \t} else {\n \t\tskb = (struct sk_buff *)rx_urb-\u003eurb.context;\n \t\tdev_kfree_skb_irq(skb);\n@@ -5807,9 +5812,6 @@ static void rtl8xxxu_queue_rx_urb(struct rtl8xxxu_priv *priv,\n \t}\n \n \tspin_unlock_irqrestore(\u0026priv-\u003erx_urb_lock, flags);\n-\n-\tif (pending \u003e RTL8XXXU_RX_URB_PENDING_WATER)\n-\t\tschedule_work(\u0026priv-\u003erx_urb_wq);\n }\n \n static void rtl8xxxu_rx_urb_work(struct work_struct *work)\n@@ -7461,6 +7463,13 @@ static void rtl8xxxu_stop(struct ieee80211_hw *hw, bool suspend)\n \tpriv-\u003eshutdown = true;\n \tspin_unlock_irqrestore(\u0026priv-\u003erx_urb_lock, flags);\n \n+\t/*\n+\t * Cancel before killing rx_anchor: the worker re-anchors every URB\n+\t * it drained via rtl8xxxu_submit_rx_urb(), so a worker still running\n+\t * after the kill could submit a URB that escapes it.\n+\t */\n+\tcancel_work_sync(\u0026priv-\u003erx_urb_wq);\n+\n \tusb_kill_anchored_urbs(\u0026priv-\u003erx_anchor);\n \tusb_kill_anchored_urbs(\u0026priv-\u003etx_anchor);\n \tif (priv-\u003eusb_interrupts)\n"
}

gemini-3.1-pro-preview

null

{
  "EnableConfigs": [
    "RTL8XXXU",
    "RTL8XXXU_UNTESTED"
  ],
  "FocusSymbols": [
    "rtl8xxxu_stop",
    "rtl8xxxu_rx_urb_work"
  ],
  "Reasoning": "The patch fixes a race condition between the RX URB completion handler and the driver stop routine in the rtl8xxxu wireless driver. It moves the workqueue scheduling inside a spinlock and adds a cancel_work_sync call to ensure the workqueue is properly cancelled during shutdown. Fuzzing the driver initialization and teardown paths (via dummy_hcd or mac80211_hwsim) can help verify this fix and uncover similar race conditions.",
  "WorthFuzzing": true
}

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Do not list too generic configs (we already have them enabled). Only list those that
   specifically cover the modified code. List them in the EnableConfigs output array,
   and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit 5cd3940c4ffce8b69ffd5ab767b2add80442ee32
Author: syz-cluster <triage@syzkaller.com>
Date:   Tue Jun 30 04:34:02 2026 +0000

    syz-cluster: applied patch under review

diff --git a/drivers/net/wireless/realtek/rtl8xxxu/core.c b/drivers/net/wireless/realtek/rtl8xxxu/core.c
index c06ad064f37c65..b447ce78ff058f 100644
--- a/drivers/net/wireless/realtek/rtl8xxxu/core.c
+++ b/drivers/net/wireless/realtek/rtl8xxxu/core.c
@@ -5792,14 +5792,19 @@ static void rtl8xxxu_queue_rx_urb(struct rtl8xxxu_priv *priv,
 {
 	struct sk_buff *skb;
 	unsigned long flags;
-	int pending = 0;
 
 	spin_lock_irqsave(&priv->rx_urb_lock, flags);
 
 	if (!priv->shutdown) {
 		list_add_tail(&rx_urb->list, &priv->rx_urb_pending_list);
 		priv->rx_urb_pending_count++;
-		pending = priv->rx_urb_pending_count;
+		/*
+		 * Arm the worker under rx_urb_lock so this is atomic with the
+		 * shutdown check: moving it out of the lock would let a
+		 * completion arm the work after rtl8xxxu_stop() canceled it.
+		 */
+		if (priv->rx_urb_pending_count > RTL8XXXU_RX_URB_PENDING_WATER)
+			schedule_work(&priv->rx_urb_wq);
 	} else {
 		skb = (struct sk_buff *)rx_urb->urb.context;
 		dev_kfree_skb_irq(skb);
@@ -5807,9 +5812,6 @@ static void rtl8xxxu_queue_rx_urb(struct rtl8xxxu_priv *priv,
 	}
 
 	spin_unlock_irqrestore(&priv->rx_urb_lock, flags);
-
-	if (pending > RTL8XXXU_RX_URB_PENDING_WATER)
-		schedule_work(&priv->rx_urb_wq);
 }
 
 static void rtl8xxxu_rx_urb_work(struct work_struct *work)
@@ -7461,6 +7463,13 @@ static void rtl8xxxu_stop(struct ieee80211_hw *hw, bool suspend)
 	priv->shutdown = true;
 	spin_unlock_irqrestore(&priv->rx_urb_lock, flags);
 
+	/*
+	 * Cancel before killing rx_anchor: the worker re-anchors every URB
+	 * it drained via rtl8xxxu_submit_rx_urb(), so a worker still running
+	 * after the kill could submit a URB that escapes it.
+	 */
+	cancel_work_sync(&priv->rx_urb_wq);
+
 	usb_kill_anchored_urbs(&priv->rx_anchor);
 	usb_kill_anchored_urbs(&priv->tx_anchor);
 	if (priv->usb_interrupts)

gemini-3.1-pro-preview

null

null

							input: 2388
							output: 39
							thoughts: 214
						

**Analyzing a Wireless Driver Patch**

Okay, so I'm looking at this patch for `drivers/net/wireless/realtek/rtl8xxxu/core.c`. The core change is moving `schedule_work(&priv->rx_urb_wq);` inside the `spin_lock_irqsave(&priv->rx_urb_lock, flags);` block within the `rtl8xxxu_queue_rx_urb` function. It also includes adding `cancel_work_sync(&priv->rx_urb_wq);` to the `rtl8xxxu_stop` function. Functionally, this is a modification to a wireless driver, specifically for the Realtek RTL8xxxU, which, as I recall, is a USB-based wireless chipset.

My initial thought is to assess the potential impact of this change. Wireless drivers are often prime targets for fuzzing, and I start thinking about familiar tools like `mac80211_hwsim`. However, this is a USB driver, which makes me pause. Can we effectively fuzz USB drivers? Wait... yes, we can. Dummy HCD and syzkaller's USB fuzzing capabilities should be able to cover this, meaning we have to consider whether this driver is already actively fuzzed.

Now I need to understand the current fuzzing status. I'll need to check the configuration to see if `RTL8XXXU` is even enabled for fuzzing.

{
  "Expression": "RTL8XXXU",
  "PathPrefix": "drivers/net/wireless/realtek/rtl8xxxu/"
}

{
  "Output": "\nFull output is too long, showing 500 out of 919 lines.\nUse more precise expression if possible.\n\ndrivers/net/wireless/realtek/rtl8xxxu/8188e.c-2-/*\ndrivers/net/wireless/realtek/rtl8xxxu/8188e.c:3: * RTL8XXXU mac80211 USB driver - 8188e specific subdriver\ndrivers/net/wireless/realtek/rtl8xxxu/8188e.c-4- *\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8188e.c=750=static void rtl8188eu_phy_iqcalibrate(struct rtl8xxxu_priv *priv,\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8188e.c-756-\tint retry = 2;\ndrivers/net/wireless/realtek/rtl8xxxu/8188e.c:757:\tstatic const u32 adda_regs[RTL8XXXU_ADDA_REGS] = {\ndrivers/net/wireless/realtek/rtl8xxxu/8188e.c-758-\t\tREG_FPGA0_XCD_SWITCH_CTRL, REG_BLUETOOTH,\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8188e.c-766-\t};\ndrivers/net/wireless/realtek/rtl8xxxu/8188e.c:767:\tstatic const u32 iqk_mac_regs[RTL8XXXU_MAC_REGS] = {\ndrivers/net/wireless/realtek/rtl8xxxu/8188e.c-768-\t\tREG_TXPAUSE, REG_BEACON_CTRL,\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8188e.c-770-\t};\ndrivers/net/wireless/realtek/rtl8xxxu/8188e.c:771:\tstatic const u32 iqk_bb_regs[RTL8XXXU_BB_REGS] = {\ndrivers/net/wireless/realtek/rtl8xxxu/8188e.c-772-\t\tREG_OFDM0_TRX_PATH_ENABLE, REG_OFDM0_TR_MUX_PAR,\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8188e.c-785-\t\trtl8xxxu_save_regs(priv, adda_regs, priv-\u003eadda_backup,\ndrivers/net/wireless/realtek/rtl8xxxu/8188e.c:786:\t\t\t\t   RTL8XXXU_ADDA_REGS);\ndrivers/net/wireless/realtek/rtl8xxxu/8188e.c-787-\t\trtl8xxxu_save_mac_regs(priv, iqk_mac_regs, priv-\u003emac_backup);\ndrivers/net/wireless/realtek/rtl8xxxu/8188e.c-788-\t\trtl8xxxu_save_regs(priv, iqk_bb_regs,\ndrivers/net/wireless/realtek/rtl8xxxu/8188e.c:789:\t\t\t\t   priv-\u003ebb_backup, RTL8XXXU_BB_REGS);\ndrivers/net/wireless/realtek/rtl8xxxu/8188e.c-790-\t}\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8188e.c-888-\trtl8xxxu_restore_regs(priv, adda_regs, priv-\u003eadda_backup,\ndrivers/net/wireless/realtek/rtl8xxxu/8188e.c:889:\t\t\t      RTL8XXXU_ADDA_REGS);\ndrivers/net/wireless/realtek/rtl8xxxu/8188e.c-890-\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8188e.c-895-\trtl8xxxu_restore_regs(priv, iqk_bb_regs,\ndrivers/net/wireless/realtek/rtl8xxxu/8188e.c:896:\t\t\t      priv-\u003ebb_backup, RTL8XXXU_BB_REGS);\ndrivers/net/wireless/realtek/rtl8xxxu/8188e.c-897-\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8188e.c=906=static void rtl8188eu_phy_iq_calibrate(struct rtl8xxxu_priv *priv)\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8188e.c-989-\trtl8xxxu_save_regs(priv, rtl8xxxu_iqk_phy_iq_bb_reg,\ndrivers/net/wireless/realtek/rtl8xxxu/8188e.c:990:\t\t\t   priv-\u003ebb_recovery_backup, RTL8XXXU_BB_REGS);\ndrivers/net/wireless/realtek/rtl8xxxu/8188e.c-991-}\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8188e.c=1002=static int rtl8188e_emu_to_active(struct rtl8xxxu_priv *priv)\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8188e.c-1009-\t/* wait till 0x04[17] = 1 power ready*/\ndrivers/net/wireless/realtek/rtl8xxxu/8188e.c:1010:\tfor (count = RTL8XXXU_MAX_REG_POLL; count; count--) {\ndrivers/net/wireless/realtek/rtl8xxxu/8188e.c-1011-\t\tval32 = rtl8xxxu_read32(priv, REG_APS_FSMCO);\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8188e.c-1047-\ndrivers/net/wireless/realtek/rtl8xxxu/8188e.c:1048:\tfor (count = RTL8XXXU_MAX_REG_POLL; count; count--) {\ndrivers/net/wireless/realtek/rtl8xxxu/8188e.c-1049-\t\tval32 = rtl8xxxu_read32(priv, REG_APS_FSMCO);\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8188e.c=1334=static int rtl8188eu_led_brightness_set(struct led_classdev *led_cdev,\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8188e.c-1347-\t\tledcfg |= LEDCFG2_SW_LED_CONTROL;\ndrivers/net/wireless/realtek/rtl8xxxu/8188e.c:1348:\t} else if (brightness == RTL8XXXU_HW_LED_CONTROL) {\ndrivers/net/wireless/realtek/rtl8xxxu/8188e.c-1349-\t\tledcfg \u0026= ~LEDCFG2_SW_LED_DISABLE;\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8188f.c-2-/*\ndrivers/net/wireless/realtek/rtl8xxxu/8188f.c:3: * RTL8XXXU mac80211 USB driver - 8188f specific subdriver\ndrivers/net/wireless/realtek/rtl8xxxu/8188f.c-4- *\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8188f.c=1061=static void rtl8188fu_phy_iqcalibrate(struct rtl8xxxu_priv *priv,\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8188f.c-1068-\tint retry = 2;\ndrivers/net/wireless/realtek/rtl8xxxu/8188f.c:1069:\tstatic const u32 adda_regs[RTL8XXXU_ADDA_REGS] = {\ndrivers/net/wireless/realtek/rtl8xxxu/8188f.c-1070-\t\tREG_FPGA0_XCD_SWITCH_CTRL, REG_BLUETOOTH,\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8188f.c-1078-\t};\ndrivers/net/wireless/realtek/rtl8xxxu/8188f.c:1079:\tstatic const u32 iqk_mac_regs[RTL8XXXU_MAC_REGS] = {\ndrivers/net/wireless/realtek/rtl8xxxu/8188f.c-1080-\t\tREG_TXPAUSE, REG_BEACON_CTRL,\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8188f.c-1082-\t};\ndrivers/net/wireless/realtek/rtl8xxxu/8188f.c:1083:\tstatic const u32 iqk_bb_regs[RTL8XXXU_BB_REGS] = {\ndrivers/net/wireless/realtek/rtl8xxxu/8188f.c-1084-\t\tREG_OFDM0_TRX_PATH_ENABLE, REG_OFDM0_TR_MUX_PAR,\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8188f.c-1099-\t\trtl8xxxu_save_regs(priv, adda_regs, priv-\u003eadda_backup,\ndrivers/net/wireless/realtek/rtl8xxxu/8188f.c:1100:\t\t\t\t   RTL8XXXU_ADDA_REGS);\ndrivers/net/wireless/realtek/rtl8xxxu/8188f.c-1101-\t\trtl8xxxu_save_mac_regs(priv, iqk_mac_regs, priv-\u003emac_backup);\ndrivers/net/wireless/realtek/rtl8xxxu/8188f.c-1102-\t\trtl8xxxu_save_regs(priv, iqk_bb_regs,\ndrivers/net/wireless/realtek/rtl8xxxu/8188f.c:1103:\t\t\t\t   priv-\u003ebb_backup, RTL8XXXU_BB_REGS);\ndrivers/net/wireless/realtek/rtl8xxxu/8188f.c-1104-\t}\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8188f.c-1189-\trtl8xxxu_restore_regs(priv, adda_regs, priv-\u003eadda_backup,\ndrivers/net/wireless/realtek/rtl8xxxu/8188f.c:1190:\t\t\t      RTL8XXXU_ADDA_REGS);\ndrivers/net/wireless/realtek/rtl8xxxu/8188f.c-1191-\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8188f.c-1196-\trtl8xxxu_restore_regs(priv, iqk_bb_regs,\ndrivers/net/wireless/realtek/rtl8xxxu/8188f.c:1197:\t\t\t      priv-\u003ebb_backup, RTL8XXXU_BB_REGS);\ndrivers/net/wireless/realtek/rtl8xxxu/8188f.c-1198-\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8188f.c=1218=static void rtl8188fu_phy_iq_calibrate(struct rtl8xxxu_priv *priv)\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8188f.c-1311-\trtl8xxxu_save_regs(priv, rtl8xxxu_iqk_phy_iq_bb_reg,\ndrivers/net/wireless/realtek/rtl8xxxu/8188f.c:1312:\t\t\t   priv-\u003ebb_recovery_backup, RTL8XXXU_BB_REGS);\ndrivers/net/wireless/realtek/rtl8xxxu/8188f.c-1313-\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8188f.c=1333=static int rtl8188f_emu_to_active(struct rtl8xxxu_priv *priv)\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8188f.c-1344-\t/* wait till 0x04[17] = 1 power ready */\ndrivers/net/wireless/realtek/rtl8xxxu/8188f.c:1345:\tfor (count = RTL8XXXU_MAX_REG_POLL; count; count--) {\ndrivers/net/wireless/realtek/rtl8xxxu/8188f.c-1346-\t\tval32 = rtl8xxxu_read32(priv, REG_APS_FSMCO);\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8188f.c-1372-\ndrivers/net/wireless/realtek/rtl8xxxu/8188f.c:1373:\tfor (count = RTL8XXXU_MAX_REG_POLL; count; count--) {\ndrivers/net/wireless/realtek/rtl8xxxu/8188f.c-1374-\t\tval32 = rtl8xxxu_read32(priv, REG_APS_FSMCO);\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8188f.c=1393=static int rtl8188fu_active_to_emu(struct rtl8xxxu_priv *priv)\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8188f.c-1414-\ndrivers/net/wireless/realtek/rtl8xxxu/8188f.c:1415:\tfor (count = RTL8XXXU_MAX_REG_POLL; count; count--) {\ndrivers/net/wireless/realtek/rtl8xxxu/8188f.c-1416-\t\tval32 = rtl8xxxu_read32(priv, REG_APS_FSMCO);\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8192c.c-2-/*\ndrivers/net/wireless/realtek/rtl8xxxu/8192c.c:3: * RTL8XXXU mac80211 USB driver - 8188c/8188r/8192c specific subdriver\ndrivers/net/wireless/realtek/rtl8xxxu/8192c.c-4- *\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8192c.c-18-\ndrivers/net/wireless/realtek/rtl8xxxu/8192c.c:19:#ifdef CONFIG_RTL8XXXU_UNTESTED\ndrivers/net/wireless/realtek/rtl8xxxu/8192c.c-20-static struct rtl8xxxu_power_base rtl8192c_power_base = {\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8192c.c=674=static int rtl8192cu_led_brightness_set(struct led_classdev *led_cdev,\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8192c.c-685-\t\tledcfg = LEDCFG2_SW_LED_CONTROL;\ndrivers/net/wireless/realtek/rtl8xxxu/8192c.c:686:\telse if (brightness == RTL8XXXU_HW_LED_CONTROL)\ndrivers/net/wireless/realtek/rtl8xxxu/8192c.c-687-\t\tledcfg = LEDCFG2_HW_LED_CONTROL | LEDCFG2_HW_LED_ENABLE;\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8192e.c-2-/*\ndrivers/net/wireless/realtek/rtl8xxxu/8192e.c:3: * RTL8XXXU mac80211 USB driver - 8192e specific subdriver\ndrivers/net/wireless/realtek/rtl8xxxu/8192e.c-4- *\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8192e.c=1050=static void rtl8192eu_phy_iqcalibrate(struct rtl8xxxu_priv *priv,\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8192e.c-1056-\tint retry = 2;\ndrivers/net/wireless/realtek/rtl8xxxu/8192e.c:1057:\tstatic const u32 adda_regs[RTL8XXXU_ADDA_REGS] = {\ndrivers/net/wireless/realtek/rtl8xxxu/8192e.c-1058-\t\tREG_FPGA0_XCD_SWITCH_CTRL, REG_BLUETOOTH,\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8192e.c-1066-\t};\ndrivers/net/wireless/realtek/rtl8xxxu/8192e.c:1067:\tstatic const u32 iqk_mac_regs[RTL8XXXU_MAC_REGS] = {\ndrivers/net/wireless/realtek/rtl8xxxu/8192e.c-1068-\t\tREG_TXPAUSE, REG_BEACON_CTRL,\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8192e.c-1070-\t};\ndrivers/net/wireless/realtek/rtl8xxxu/8192e.c:1071:\tstatic const u32 iqk_bb_regs[RTL8XXXU_BB_REGS] = {\ndrivers/net/wireless/realtek/rtl8xxxu/8192e.c-1072-\t\tREG_OFDM0_TRX_PATH_ENABLE, REG_OFDM0_TR_MUX_PAR,\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8192e.c-1087-\t\trtl8xxxu_save_regs(priv, adda_regs, priv-\u003eadda_backup,\ndrivers/net/wireless/realtek/rtl8xxxu/8192e.c:1088:\t\t\t\t   RTL8XXXU_ADDA_REGS);\ndrivers/net/wireless/realtek/rtl8xxxu/8192e.c-1089-\t\trtl8xxxu_save_mac_regs(priv, iqk_mac_regs, priv-\u003emac_backup);\ndrivers/net/wireless/realtek/rtl8xxxu/8192e.c-1090-\t\trtl8xxxu_save_regs(priv, iqk_bb_regs,\ndrivers/net/wireless/realtek/rtl8xxxu/8192e.c:1091:\t\t\t\t   priv-\u003ebb_backup, RTL8XXXU_BB_REGS);\ndrivers/net/wireless/realtek/rtl8xxxu/8192e.c-1092-\t}\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8192e.c-1205-\t\trtl8xxxu_restore_regs(priv, adda_regs, priv-\u003eadda_backup,\ndrivers/net/wireless/realtek/rtl8xxxu/8192e.c:1206:\t\t\t\t      RTL8XXXU_ADDA_REGS);\ndrivers/net/wireless/realtek/rtl8xxxu/8192e.c-1207-\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8192e.c-1212-\t\trtl8xxxu_restore_regs(priv, iqk_bb_regs,\ndrivers/net/wireless/realtek/rtl8xxxu/8192e.c:1213:\t\t\t\t      priv-\u003ebb_backup, RTL8XXXU_BB_REGS);\ndrivers/net/wireless/realtek/rtl8xxxu/8192e.c-1214-\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8192e.c=1236=static void rtl8192eu_phy_iq_calibrate(struct rtl8xxxu_priv *priv)\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8192e.c-1323-\trtl8xxxu_save_regs(priv, rtl8xxxu_iqk_phy_iq_bb_reg,\ndrivers/net/wireless/realtek/rtl8xxxu/8192e.c:1324:\t\t\t   priv-\u003ebb_recovery_backup, RTL8XXXU_BB_REGS);\ndrivers/net/wireless/realtek/rtl8xxxu/8192e.c-1325-}\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8192e.c=1372=static int rtl8192e_emu_to_active(struct rtl8xxxu_priv *priv)\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8192e.c-1393-\t/* wait till 0x04[17] = 1 power ready*/\ndrivers/net/wireless/realtek/rtl8xxxu/8192e.c:1394:\tfor (count = RTL8XXXU_MAX_REG_POLL; count; count--) {\ndrivers/net/wireless/realtek/rtl8xxxu/8192e.c-1395-\t\tval32 = rtl8xxxu_read32(priv, REG_APS_FSMCO);\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8192e.c-1418-\ndrivers/net/wireless/realtek/rtl8xxxu/8192e.c:1419:\tfor (count = RTL8XXXU_MAX_REG_POLL; count; count--) {\ndrivers/net/wireless/realtek/rtl8xxxu/8192e.c-1420-\t\tval32 = rtl8xxxu_read32(priv, REG_APS_FSMCO);\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8192e.c=1496=static int rtl8192eu_active_to_emu(struct rtl8xxxu_priv *priv)\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8192e.c-1515-\ndrivers/net/wireless/realtek/rtl8xxxu/8192e.c:1516:\tfor (count = RTL8XXXU_MAX_REG_POLL; count; count--) {\ndrivers/net/wireless/realtek/rtl8xxxu/8192e.c-1517-\t\tval8 = rtl8xxxu_read8(priv, REG_APS_FSMCO + 1);\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8192e.c=1698=static int rtl8192eu_led_brightness_set(struct led_classdev *led_cdev,\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8192e.c-1710-\t\tledcfg \u0026= ~(LEDCFG1_HW_LED_CONTROL | LEDCFG1_LED_DISABLE);\ndrivers/net/wireless/realtek/rtl8xxxu/8192e.c:1711:\t} else if (brightness == RTL8XXXU_HW_LED_CONTROL) {\ndrivers/net/wireless/realtek/rtl8xxxu/8192e.c-1712-\t\tledcfg \u0026= ~LEDCFG1_LED_DISABLE;\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8192f.c-2-/*\ndrivers/net/wireless/realtek/rtl8xxxu/8192f.c:3: * RTL8XXXU mac80211 USB driver - 8192fu specific subdriver\ndrivers/net/wireless/realtek/rtl8xxxu/8192f.c-4- *\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8192f.c=1255=static void rtl8192fu_phy_iqcalibrate(struct rtl8xxxu_priv *priv,\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8192f.c-1260-\t};\ndrivers/net/wireless/realtek/rtl8xxxu/8192f.c:1261:\tstatic const u32 iqk_mac_regs[RTL8XXXU_MAC_REGS] = {\ndrivers/net/wireless/realtek/rtl8xxxu/8192f.c-1262-\t\tREG_TXPAUSE, REG_BEACON_CTRL,\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8192f.c-1264-\t};\ndrivers/net/wireless/realtek/rtl8xxxu/8192f.c:1265:\tstatic const u32 iqk_bb_regs[RTL8XXXU_BB_REGS] = {\ndrivers/net/wireless/realtek/rtl8xxxu/8192f.c-1266-\t\tREG_OFDM0_TRX_PATH_ENABLE, REG_OFDM0_TR_MUX_PAR,\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8192f.c-1293-\t\trtl8xxxu_save_regs(priv, iqk_bb_regs,\ndrivers/net/wireless/realtek/rtl8xxxu/8192f.c:1294:\t\t\t\t   priv-\u003ebb_backup, RTL8XXXU_BB_REGS);\ndrivers/net/wireless/realtek/rtl8xxxu/8192f.c-1295-\t}\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8192f.c-1425-\t/* Reload BB parameters */\ndrivers/net/wireless/realtek/rtl8xxxu/8192f.c:1426:\trtl8xxxu_restore_regs(priv, iqk_bb_regs, priv-\u003ebb_backup, RTL8XXXU_BB_REGS);\ndrivers/net/wireless/realtek/rtl8xxxu/8192f.c-1427-\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8192f.c=1602=static int rtl8192fu_emu_to_active(struct rtl8xxxu_priv *priv)\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8192f.c-1622-\t/* wait till 0x04[17] = 1 power ready */\ndrivers/net/wireless/realtek/rtl8xxxu/8192f.c:1623:\tfor (count = RTL8XXXU_MAX_REG_POLL; count; count--) {\ndrivers/net/wireless/realtek/rtl8xxxu/8192f.c-1624-\t\tval32 = rtl8xxxu_read32(priv, REG_APS_FSMCO);\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8192f.c-1635-\ndrivers/net/wireless/realtek/rtl8xxxu/8192f.c:1636:\tfor (count = RTL8XXXU_MAX_REG_POLL; count; count--) {\ndrivers/net/wireless/realtek/rtl8xxxu/8192f.c-1637-\t\tval32 = rtl8xxxu_read32(priv, REG_APS_FSMCO);\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8192f.c-1659-\ndrivers/net/wireless/realtek/rtl8xxxu/8192f.c:1660:\tfor (count = RTL8XXXU_MAX_REG_POLL; count; count--) {\ndrivers/net/wireless/realtek/rtl8xxxu/8192f.c-1661-\t\tval32 = rtl8xxxu_read32(priv, REG_APS_FSMCO);\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8192f.c=1728=static int rtl8192fu_active_to_emu(struct rtl8xxxu_priv *priv)\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8192f.c-1744-\ndrivers/net/wireless/realtek/rtl8xxxu/8192f.c:1745:\tfor (count = RTL8XXXU_MAX_REG_POLL; count; count--) {\ndrivers/net/wireless/realtek/rtl8xxxu/8192f.c-1746-\t\tval32 = rtl8xxxu_read32(priv, REG_APS_FSMCO);\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8192f.c=1995=static int rtl8192fu_led_brightness_set(struct led_classdev *led_cdev,\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8192f.c-2024-\t\tu32p_replace_bits(\u0026ledcfg, LED_SW_ON, LEDCFG0_LED1SV);\ndrivers/net/wireless/realtek/rtl8xxxu/8192f.c:2025:\t} else if (brightness == RTL8XXXU_HW_LED_CONTROL) {\ndrivers/net/wireless/realtek/rtl8xxxu/8192f.c-2026-\t\tu32p_replace_bits(\u0026ledcfg, LED_MODE_TX_OR_RX_EVENTS,\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8710b.c-2-/*\ndrivers/net/wireless/realtek/rtl8xxxu/8710b.c:3: * RTL8XXXU mac80211 USB driver - 8710bu aka 8188gu specific subdriver\ndrivers/net/wireless/realtek/rtl8xxxu/8710b.c-4- *\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8710b.c=463=static u32 rtl8710b_indirect_read32(struct rtl8xxxu_priv *priv, u32 addr)\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8710b.c-491-\ndrivers/net/wireless/realtek/rtl8xxxu/8710b.c:492:\tif (rtl8xxxu_debug \u0026 RTL8XXXU_DEBUG_REG_READ)\ndrivers/net/wireless/realtek/rtl8xxxu/8710b.c-493-\t\tdev_info(dev, \"%s(%04x) = 0x%08x\\n\", __func__, addr, value);\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8710b.c=498=static void rtl8710b_indirect_write32(struct rtl8xxxu_priv *priv, u32 addr, u32 val)\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8710b.c-525-\ndrivers/net/wireless/realtek/rtl8xxxu/8710b.c:526:\tif (rtl8xxxu_debug \u0026 RTL8XXXU_DEBUG_REG_WRITE)\ndrivers/net/wireless/realtek/rtl8xxxu/8710b.c-527-\t\tdev_info(dev, \"%s(%04x) = 0x%08x\\n\", __func__, addr, val);\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8710b.c=540=static int rtl8710b_read_efuse8(struct rtl8xxxu_priv *priv, u16 offset, u8 *data)\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8710b.c-551-\tval32 = rtl8xxxu_read32(priv, REG_EFUSE_INDIRECT_CTRL_8710B);\ndrivers/net/wireless/realtek/rtl8xxxu/8710b.c:552:\tfor (i = 0; i \u003c RTL8XXXU_MAX_REG_POLL; i++) {\ndrivers/net/wireless/realtek/rtl8xxxu/8710b.c-553-\t\tval32 = rtl8xxxu_read32(priv, REG_EFUSE_INDIRECT_CTRL_8710B);\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8710b.c-557-\ndrivers/net/wireless/realtek/rtl8xxxu/8710b.c:558:\tif (i == RTL8XXXU_MAX_REG_POLL)\ndrivers/net/wireless/realtek/rtl8xxxu/8710b.c-559-\t\treturn -EIO;\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8710b.c=1254=static void rtl8710bu_phy_iqcalibrate(struct rtl8xxxu_priv *priv,\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8710b.c-1261-\tint retry = 2;\ndrivers/net/wireless/realtek/rtl8xxxu/8710b.c:1262:\tstatic const u32 adda_regs[RTL8XXXU_ADDA_REGS] = {\ndrivers/net/wireless/realtek/rtl8xxxu/8710b.c-1263-\t\tREG_FPGA0_XCD_SWITCH_CTRL, REG_BLUETOOTH,\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8710b.c-1271-\t};\ndrivers/net/wireless/realtek/rtl8xxxu/8710b.c:1272:\tstatic const u32 iqk_mac_regs[RTL8XXXU_MAC_REGS] = {\ndrivers/net/wireless/realtek/rtl8xxxu/8710b.c-1273-\t\tREG_TXPAUSE, REG_BEACON_CTRL,\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8710b.c-1275-\t};\ndrivers/net/wireless/realtek/rtl8xxxu/8710b.c:1276:\tstatic const u32 iqk_bb_regs[RTL8XXXU_BB_REGS] = {\ndrivers/net/wireless/realtek/rtl8xxxu/8710b.c-1277-\t\tREG_OFDM0_TRX_PATH_ENABLE, REG_OFDM0_TR_MUX_PAR,\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8710b.c-1292-\t\trtl8xxxu_save_regs(priv, adda_regs, priv-\u003eadda_backup,\ndrivers/net/wireless/realtek/rtl8xxxu/8710b.c:1293:\t\t\t\t   RTL8XXXU_ADDA_REGS);\ndrivers/net/wireless/realtek/rtl8xxxu/8710b.c-1294-\t\trtl8xxxu_save_mac_regs(priv, iqk_mac_regs, priv-\u003emac_backup);\ndrivers/net/wireless/realtek/rtl8xxxu/8710b.c-1295-\t\trtl8xxxu_save_regs(priv, iqk_bb_regs,\ndrivers/net/wireless/realtek/rtl8xxxu/8710b.c:1296:\t\t\t\t   priv-\u003ebb_backup, RTL8XXXU_BB_REGS);\ndrivers/net/wireless/realtek/rtl8xxxu/8710b.c-1297-\t}\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8710b.c-1380-\t/* Reload ADDA power saving parameters */\ndrivers/net/wireless/realtek/rtl8xxxu/8710b.c:1381:\trtl8xxxu_restore_regs(priv, adda_regs, priv-\u003eadda_backup, RTL8XXXU_ADDA_REGS);\ndrivers/net/wireless/realtek/rtl8xxxu/8710b.c-1382-\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8710b.c-1386-\t/* Reload BB parameters */\ndrivers/net/wireless/realtek/rtl8xxxu/8710b.c:1387:\trtl8xxxu_restore_regs(priv, iqk_bb_regs, priv-\u003ebb_backup, RTL8XXXU_BB_REGS);\ndrivers/net/wireless/realtek/rtl8xxxu/8710b.c-1388-\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8710b.c=1406=static void rtl8710bu_phy_iq_calibrate(struct rtl8xxxu_priv *priv)\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8710b.c-1475-\trtl8xxxu_save_regs(priv, rtl8xxxu_iqk_phy_iq_bb_reg,\ndrivers/net/wireless/realtek/rtl8xxxu/8710b.c:1476:\t\t\t   priv-\u003ebb_recovery_backup, RTL8XXXU_BB_REGS);\ndrivers/net/wireless/realtek/rtl8xxxu/8710b.c-1477-\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8710b.c=1481=static int rtl8710b_emu_to_active(struct rtl8xxxu_priv *priv)\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8710b.c-1500-\ndrivers/net/wireless/realtek/rtl8xxxu/8710b.c:1501:\tfor (count = RTL8XXXU_MAX_REG_POLL; count; count--) {\ndrivers/net/wireless/realtek/rtl8xxxu/8710b.c-1502-\t\tval8 = rtl8xxxu_read8(priv, 0x20);\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8710b.c=1515=static int rtl8710bu_active_to_emu(struct rtl8xxxu_priv *priv)\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8710b.c-1535-\ndrivers/net/wireless/realtek/rtl8xxxu/8710b.c:1536:\tfor (count = RTL8XXXU_MAX_REG_POLL; count; count--) {\ndrivers/net/wireless/realtek/rtl8xxxu/8710b.c-1537-\t\tval8 = rtl8xxxu_read8(priv, 0x20);\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8723a.c-2-/*\ndrivers/net/wireless/realtek/rtl8xxxu/8723a.c:3: * RTL8XXXU mac80211 USB driver - 8723a specific subdriver\ndrivers/net/wireless/realtek/rtl8xxxu/8723a.c-4- *\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8723a.c=276=static int rtl8723a_emu_to_active(struct rtl8xxxu_priv *priv)\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8723a.c-304-\t/* wait till 0x04[17] = 1 power ready*/\ndrivers/net/wireless/realtek/rtl8xxxu/8723a.c:305:\tfor (count = RTL8XXXU_MAX_REG_POLL; count; count--) {\ndrivers/net/wireless/realtek/rtl8xxxu/8723a.c-306-\t\tval32 = rtl8xxxu_read32(priv, REG_APS_FSMCO);\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8723a.c-339-\ndrivers/net/wireless/realtek/rtl8xxxu/8723a.c:340:\tfor (count = RTL8XXXU_MAX_REG_POLL; count; count--) {\ndrivers/net/wireless/realtek/rtl8xxxu/8723a.c-341-\t\tval32 = rtl8xxxu_read32(priv, REG_APS_FSMCO);\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8723a.c=414=static int rtl8723au_active_to_emu(struct rtl8xxxu_priv *priv)\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8723a.c-433-\ndrivers/net/wireless/realtek/rtl8xxxu/8723a.c:434:\tfor (count = RTL8XXXU_MAX_REG_POLL; count; count--) {\ndrivers/net/wireless/realtek/rtl8xxxu/8723a.c-435-\t\tval8 = rtl8xxxu_read8(priv, REG_APS_FSMCO + 1);\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8723a.c=579=static int rtl8723au_led_brightness_set(struct led_classdev *led_cdev,\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8723a.c-592-\t\tledcfg |= LEDCFG2_SW_LED_CONTROL;\ndrivers/net/wireless/realtek/rtl8xxxu/8723a.c:593:\t} else if (brightness == RTL8XXXU_HW_LED_CONTROL) {\ndrivers/net/wireless/realtek/rtl8xxxu/8723a.c-594-\t\tledcfg \u0026= ~LEDCFG2_SW_LED_DISABLE;\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8723b.c-2-/*\ndrivers/net/wireless/realtek/rtl8xxxu/8723b.c:3: * RTL8XXXU mac80211 USB driver - 8723b specific subdriver\ndrivers/net/wireless/realtek/rtl8xxxu/8723b.c-4- *\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8723b.c=894=static void rtl8723bu_phy_iqcalibrate(struct rtl8xxxu_priv *priv,\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8723b.c-900-\tint retry = 2;\ndrivers/net/wireless/realtek/rtl8xxxu/8723b.c:901:\tstatic const u32 adda_regs[RTL8XXXU_ADDA_REGS] = {\ndrivers/net/wireless/realtek/rtl8xxxu/8723b.c-902-\t\tREG_FPGA0_XCD_SWITCH_CTRL, REG_BLUETOOTH,\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8723b.c-910-\t};\ndrivers/net/wireless/realtek/rtl8xxxu/8723b.c:911:\tstatic const u32 iqk_mac_regs[RTL8XXXU_MAC_REGS] = {\ndrivers/net/wireless/realtek/rtl8xxxu/8723b.c-912-\t\tREG_TXPAUSE, REG_BEACON_CTRL,\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8723b.c-914-\t};\ndrivers/net/wireless/realtek/rtl8xxxu/8723b.c:915:\tstatic const u32 iqk_bb_regs[RTL8XXXU_BB_REGS] = {\ndrivers/net/wireless/realtek/rtl8xxxu/8723b.c-916-\t\tREG_OFDM0_TRX_PATH_ENABLE, REG_OFDM0_TR_MUX_PAR,\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8723b.c-931-\t\trtl8xxxu_save_regs(priv, adda_regs, priv-\u003eadda_backup,\ndrivers/net/wireless/realtek/rtl8xxxu/8723b.c:932:\t\t\t\t   RTL8XXXU_ADDA_REGS);\ndrivers/net/wireless/realtek/rtl8xxxu/8723b.c-933-\t\trtl8xxxu_save_mac_regs(priv, iqk_mac_regs, priv-\u003emac_backup);\ndrivers/net/wireless/realtek/rtl8xxxu/8723b.c-934-\t\trtl8xxxu_save_regs(priv, iqk_bb_regs,\ndrivers/net/wireless/realtek/rtl8xxxu/8723b.c:935:\t\t\t\t   priv-\u003ebb_backup, RTL8XXXU_BB_REGS);\ndrivers/net/wireless/realtek/rtl8xxxu/8723b.c-936-\t}\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8723b.c-1071-\t\trtl8xxxu_restore_regs(priv, adda_regs, priv-\u003eadda_backup,\ndrivers/net/wireless/realtek/rtl8xxxu/8723b.c:1072:\t\t\t\t      RTL8XXXU_ADDA_REGS);\ndrivers/net/wireless/realtek/rtl8xxxu/8723b.c-1073-\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8723b.c-1078-\t\trtl8xxxu_restore_regs(priv, iqk_bb_regs,\ndrivers/net/wireless/realtek/rtl8xxxu/8723b.c:1079:\t\t\t\t      priv-\u003ebb_backup, RTL8XXXU_BB_REGS);\ndrivers/net/wireless/realtek/rtl8xxxu/8723b.c-1080-\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8723b.c=1102=static void rtl8723bu_phy_iq_calibrate(struct rtl8xxxu_priv *priv)\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8723b.c-1204-\trtl8xxxu_save_regs(priv, rtl8xxxu_iqk_phy_iq_bb_reg,\ndrivers/net/wireless/realtek/rtl8xxxu/8723b.c:1205:\t\t\t   priv-\u003ebb_recovery_backup, RTL8XXXU_BB_REGS);\ndrivers/net/wireless/realtek/rtl8xxxu/8723b.c-1206-\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8723b.c=1226=static int rtl8723bu_active_to_emu(struct rtl8xxxu_priv *priv)\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8723b.c-1250-\ndrivers/net/wireless/realtek/rtl8xxxu/8723b.c:1251:\tfor (count = RTL8XXXU_MAX_REG_POLL; count; count--) {\ndrivers/net/wireless/realtek/rtl8xxxu/8723b.c-1252-\t\tval8 = rtl8xxxu_read8(priv, REG_APS_FSMCO + 1);\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8723b.c=1284=static int rtl8723b_emu_to_active(struct rtl8xxxu_priv *priv)\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8723b.c-1312-\t/* Wait until 0x04[17] = 1 power ready */\ndrivers/net/wireless/realtek/rtl8xxxu/8723b.c:1313:\tfor (count = RTL8XXXU_MAX_REG_POLL; count; count--) {\ndrivers/net/wireless/realtek/rtl8xxxu/8723b.c-1314-\t\tval32 = rtl8xxxu_read32(priv, REG_APS_FSMCO);\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8723b.c-1347-\ndrivers/net/wireless/realtek/rtl8xxxu/8723b.c:1348:\tfor (count = RTL8XXXU_MAX_REG_POLL; count; count--) {\ndrivers/net/wireless/realtek/rtl8xxxu/8723b.c-1349-\t\tval32 = rtl8xxxu_read32(priv, REG_APS_FSMCO);\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8723b.c=1688=static int rtl8723bu_led_brightness_set(struct led_classdev *led_cdev,\n--\ndrivers/net/wireless/realtek/rtl8xxxu/8723b.c-1701-\t\tledcfg |= LEDCFG2_SW_LED_CONTROL;\ndrivers/net/wireless/realtek/rtl8xxxu/8723b.c:1702:\telse if (brightness == RTL8XXXU_HW_LED_CONTROL)\ndrivers/net/wireless/realtek/rtl8xxxu/8723b.c-1703-\t\tledcfg |= LEDCFG2_HW_LED_CONTROL | LEDCFG2_HW_LED_ENABLE;\n--\ndrivers/net/wireless/realtek/rtl8xxxu/Kconfig-2-#\ndrivers/net/wireless/realtek/rtl8xxxu/Kconfig:3:# RTL8XXXU Wireless LAN device configuration\ndrivers/net/wireless/realtek/rtl8xxxu/Kconfig-4-#\ndrivers/net/wireless/realtek/rtl8xxxu/Kconfig:5:config RTL8XXXU\ndrivers/net/wireless/realtek/rtl8xxxu/Kconfig-6-\ttristate \"Realtek 802.11n USB wireless chips support\"\n--\ndrivers/net/wireless/realtek/rtl8xxxu/Kconfig-28-\ndrivers/net/wireless/realtek/rtl8xxxu/Kconfig:29:config RTL8XXXU_UNTESTED\ndrivers/net/wireless/realtek/rtl8xxxu/Kconfig-30-\tbool \"Include support for untested Realtek 8xxx USB devices (EXPERIMENTAL)\"\ndrivers/net/wireless/realtek/rtl8xxxu/Kconfig:31:\tdepends on RTL8XXXU\ndrivers/net/wireless/realtek/rtl8xxxu/Kconfig-32-\thelp\n--\ndrivers/net/wireless/realtek/rtl8xxxu/Makefile-1-# SPDX-License-Identifier: GPL-2.0-only\ndrivers/net/wireless/realtek/rtl8xxxu/Makefile:2:obj-$(CONFIG_RTL8XXXU)\t+= rtl8xxxu.o\ndrivers/net/wireless/realtek/rtl8xxxu/Makefile-3-\n--\ndrivers/net/wireless/realtek/rtl8xxxu/core.c-2-/*\ndrivers/net/wireless/realtek/rtl8xxxu/core.c:3: * RTL8XXXU mac80211 USB driver\ndrivers/net/wireless/realtek/rtl8xxxu/core.c-4- *\n--\ndrivers/net/wireless/realtek/rtl8xxxu/core.c=52=MODULE_PARM_DESC(dma_agg_pages, \"Set DMA aggregation pages (range 1-127, 0 to disable)\");\n--\ndrivers/net/wireless/realtek/rtl8xxxu/core.c-54-#define USB_VENDOR_ID_REALTEK\t\t0x0bda\ndrivers/net/wireless/realtek/rtl8xxxu/core.c:55:#define RTL8XXXU_RX_URBS\t\t32\ndrivers/net/wireless/realtek/rtl8xxxu/core.c:56:#define RTL8XXXU_RX_URB_PENDING_WATER\t8\ndrivers/net/wireless/realtek/rtl8xxxu/core.c:57:#define RTL8XXXU_TX_URBS\t\t64\ndrivers/net/wireless/realtek/rtl8xxxu/core.c:58:#define RTL8XXXU_TX_URB_LOW_WATER\t25\ndrivers/net/wireless/realtek/rtl8xxxu/core.c:59:#define RTL8XXXU_TX_URB_HIGH_WATER\t32\ndrivers/net/wireless/realtek/rtl8xxxu/core.c-60-\n--\ndrivers/net/wireless/realtek/rtl8xxxu/core.c=580=static const struct rtl8xxxu_rfregs rtl8xxxu_rfregs[] = {\n--\ndrivers/net/wireless/realtek/rtl8xxxu/core.c-598-\ndrivers/net/wireless/realtek/rtl8xxxu/core.c:599:const u32 rtl8xxxu_iqk_phy_iq_bb_reg[RTL8XXXU_BB_REGS] = {\ndrivers/net/wireless/realtek/rtl8xxxu/core.c-600-\tREG_OFDM0_XA_RX_IQ_IMBALANCE,\n--\ndrivers/net/wireless/realtek/rtl8xxxu/core.c=611=u8 rtl8xxxu_read8(struct rtl8xxxu_priv *priv, u16 addr)\n--\ndrivers/net/wireless/realtek/rtl8xxxu/core.c-627-\ndrivers/net/wireless/realtek/rtl8xxxu/core.c:628:\tif (rtl8xxxu_debug \u0026 RTL8XXXU_DEBUG_REG_READ)\ndrivers/net/wireless/realtek/rtl8xxxu/core.c-629-\t\tdev_info(\u0026udev-\u003edev, \"%s(%04x)   = 0x%02x, len %i\\n\",\n--\ndrivers/net/wireless/realtek/rtl8xxxu/core.c=634=u16 rtl8xxxu_read16(struct rtl8xxxu_priv *priv, u16 addr)\n--\ndrivers/net/wireless/realtek/rtl8xxxu/core.c-650-\ndrivers/net/wireless/realtek/rtl8xxxu/core.c:651:\tif (rtl8xxxu_debug \u0026 RTL8XXXU_DEBUG_REG_READ)\ndrivers/net/wireless/realtek/rtl8xxxu/core.c-652-\t\tdev_info(\u0026udev-\u003edev, \"%s(%04x)  = 0x%04x, len %i\\n\",\n--\ndrivers/net/wireless/realtek/rtl8xxxu/core.c=657=u32 rtl8xxxu_read32(struct rtl8xxxu_priv *priv, u16 addr)\n--\ndrivers/net/wireless/realtek/rtl8xxxu/core.c-673-\ndrivers/net/wireless/realtek/rtl8xxxu/core.c:674:\tif (rtl8xxxu_debug \u0026 RTL8XXXU_DEBUG_REG_READ)\ndrivers/net/wireless/realtek/rtl8xxxu/core.c-675-\t\tdev_info(\u0026udev-\u003edev, \"%s(%04x)  = 0x%08x, len %i\\n\",\n--\ndrivers/net/wireless/realtek/rtl8xxxu/core.c=680=int rtl8xxxu_write8(struct rtl8xxxu_priv *priv, u16 addr, u8 val)\n--\ndrivers/net/wireless/realtek/rtl8xxxu/core.c-696-\ndrivers/net/wireless/realtek/rtl8xxxu/core.c:697:\tif (rtl8xxxu_debug \u0026 RTL8XXXU_DEBUG_REG_WRITE)\ndrivers/net/wireless/realtek/rtl8xxxu/core.c-698-\t\tdev_info(\u0026udev-\u003edev, \"%s(%04x) = 0x%02x\\n\",\n--\ndrivers/net/wireless/realtek/rtl8xxxu/core.c=703=int rtl8xxxu_write16(struct rtl8xxxu_priv *priv, u16 addr, u16 val)\n--\ndrivers/net/wireless/realtek/rtl8xxxu/core.c-718-\ndrivers/net/wireless/realtek/rtl8xxxu/core.c:719:\tif (rtl8xxxu_debug \u0026 RTL8XXXU_DEBUG_REG_WRITE)\ndrivers/net/wireless/realtek/rtl8xxxu/core.c-720-\t\tdev_info(\u0026udev-\u003edev, \"%s(%04x) = 0x%04x\\n\",\n--\ndrivers/net/wireless/realtek/rtl8xxxu/core.c=725=int rtl8xxxu_write32(struct rtl8xxxu_priv *priv, u16 addr, u32 val)\n--\ndrivers/net/wireless/realtek/rtl8xxxu/core.c-740-\ndrivers/net/wireless/realtek/rtl8xxxu/core.c:741:\tif (rtl8xxxu_debug \u0026 RTL8XXXU_DEBUG_REG_WRITE)\ndrivers/net/wireless/realtek/rtl8xxxu/core.c-742-\t\tdev_info(\u0026udev-\u003edev, \"%s(%04x) = 0x%08x\\n\",\n--\ndrivers/net/wireless/realtek/rtl8xxxu/core.c=827=rtl8xxxu_writeN(struct rtl8xxxu_priv *priv, u16 addr, u8 *buf, u16 len)\n--\ndrivers/net/wireless/realtek/rtl8xxxu/core.c-859-write_error:\ndrivers/net/wireless/realtek/rtl8xxxu/core.c:860:\tif (rtl8xxxu_debug \u0026 RTL8XXXU_DEBUG_REG_WRITE)\ndrivers/net/wireless/realtek/rtl8xxxu/core.c-861-\t\tdev_info(\u0026udev-\u003edev,\n--\ndrivers/net/wireless/realtek/rtl8xxxu/core.c=867=u32 rtl8xxxu_read_rfreg(struct rtl8xxxu_priv *priv,\n--\ndrivers/net/wireless/realtek/rtl8xxxu/core.c-900-\ndrivers/net/wireless/realtek/rtl8xxxu/core.c:901:\tif (rtl8xxxu_debug \u0026 RTL8XXXU_DEBUG_RFREG_READ)\ndrivers/net/wireless/realtek/rtl8xxxu/core.c-902-\t\tdev_info(\u0026priv-\u003eudev-\u003edev, \"%s(%02x) = 0x%06x\\n\",\n--\ndrivers/net/wireless/realtek/rtl8xxxu/core.c=912=int rtl8xxxu_write_rfreg(struct rtl8xxxu_priv *priv,\n--\ndrivers/net/wireless/realtek/rtl8xxxu/core.c-917-\ndrivers/net/wireless/realtek/rtl8xxxu/core.c:918:\tif (rtl8xxxu_debug \u0026 RTL8XXXU_DEBUG_RFREG_WRITE)\ndrivers/net/wireless/realtek/rtl8xxxu/core.c-919-\t\tdev_info(\u0026priv-\u003eudev-\u003edev, \"%s(%02x) = 0x%06x\\n\",\n--\ndrivers/net/wireless/realtek/rtl8xxxu/core.c=950=rtl8xxxu_gen1_h2c_cmd(struct rtl8xxxu_priv *priv, struct h2c_cmd *h2c, int len)\n--\ndrivers/net/wireless/realtek/rtl8xxxu/core.c-983-\t\trtl8xxxu_write16(priv, mbox_ext_reg, le16_to_cpu(h2c-\u003eraw.ext));\ndrivers/net/wireless/realtek/rtl8xxxu/core.c:984:\t\tif (rtl8xxxu_debug \u0026 RTL8XXXU_DEBUG_H2C)\ndrivers/net/wireless/realtek/rtl8xxxu/core.c-985-\t\t\tdev_info(dev, \"H2C_EXT %04x\\n\",\n--\ndrivers/net/wireless/realtek/rtl8xxxu/core.c-988-\trtl8xxxu_write32(priv, mbox_reg, le32_to_cpu(h2c-\u003eraw.data));\ndrivers/net/wireless/realtek/rtl8xxxu/core.c:989:\tif (rtl8xxxu_debug \u0026 RTL8XXXU_DEBUG_H2C)\ndrivers/net/wireless/realtek/rtl8xxxu/core.c-990-\t\tdev_info(dev, \"H2C %08x\\n\", le32_to_cpu(h2c-\u003eraw.data));\n--\ndrivers/net/wireless/realtek/rtl8xxxu/core.c=1000=rtl8xxxu_gen2_h2c_cmd(struct rtl8xxxu_priv *priv, struct h2c_cmd *h2c, int len)\n--\ndrivers/net/wireless/realtek/rtl8xxxu/core.c-1034-\t\t\t\t le32_to_cpu(h2c-\u003eraw_wide.ext));\ndrivers/net/wireless/realtek/rtl8xxxu/core.c:1035:\t\tif (rtl8xxxu_debug \u0026 RTL8XXXU_DEBUG_H2C)\ndrivers/net/wireless/realtek/rtl8xxxu/core.c-1036-\t\t\tdev_info(dev, \"H2C_EXT %08x\\n\",\n--\ndrivers/net/wireless/realtek/rtl8xxxu/core.c-1039-\trtl8xxxu_write32(priv, mbox_reg, le32_to_cpu(h2c-\u003eraw.data));\n\n"
}

gemini-3.1-pro-preview

null

null

							input: 18797
							output: 44
							thoughts: 256
						

**Analyzing a Functional Change in the RTL8XXXU Driver**

Okay, so the config in question here is `CONFIG_RTL8XXXU`. First thought: I need to quickly confirm if this config is even enabled in syzbot's environment. Aha, wait a second. The fact that syzbot reported the patch *means* it's enabled, right? Good.

Now, the patch itself... it's moving `schedule_work(&priv->rx_urb_wq);` inside a lock and adding `cancel_work_sync(&priv->rx_urb_wq);` in `rtl8xxxu_stop`. This smells like a functional fix – likely addressing a race condition between workqueue scheduling and cancellation. This is the `rtl8xxxu` driver, so I need to assess whether fuzzing is warranted.

Given that it’s a functional change *and* that syzbot clearly cares about this driver (it's the source of this report), the answer is a resounding yes. Let's see... the author is listed as `syz-cluster <triage@syzkaller.com>`, which is a pretty clear indicator: This is either a reproducer or a bug found by syzbot itself.

To dig in, I need to look at the specific functions modified. Okay, `rtl8xxxu_queue_rx_urb` and `rtl8xxxu_stop`. Let's pull up those functions and see what's actually happening.

{
  "Expression": "rtl8xxxu_queue_rx_urb",
  "PathPrefix": "drivers/net/wireless/realtek/rtl8xxxu/"
}

{
  "Output": "drivers/net/wireless/realtek/rtl8xxxu/core.c=5773=static void rtl8xxxu_free_rx_resources(struct rtl8xxxu_priv *priv)\n--\ndrivers/net/wireless/realtek/rtl8xxxu/core.c-5789-\ndrivers/net/wireless/realtek/rtl8xxxu/core.c:5790:static void rtl8xxxu_queue_rx_urb(struct rtl8xxxu_priv *priv,\ndrivers/net/wireless/realtek/rtl8xxxu/core.c-5791-\t\t\t\t  struct rtl8xxxu_rx_urb *rx_urb)\n--\ndrivers/net/wireless/realtek/rtl8xxxu/core.c=5817=static void rtl8xxxu_rx_urb_work(struct work_struct *work)\n--\ndrivers/net/wireless/realtek/rtl8xxxu/core.c-5848-\t\tcase -EAGAIN:\ndrivers/net/wireless/realtek/rtl8xxxu/core.c:5849:\t\t\trtl8xxxu_queue_rx_urb(priv, rx_urb);\ndrivers/net/wireless/realtek/rtl8xxxu/core.c-5850-\t\t\tbreak;\n--\ndrivers/net/wireless/realtek/rtl8xxxu/core.c=6500=static void rtl8xxxu_rx_complete(struct urb *urb)\n--\ndrivers/net/wireless/realtek/rtl8xxxu/core.c-6515-\t\trx_urb-\u003eurb.context = NULL;\ndrivers/net/wireless/realtek/rtl8xxxu/core.c:6516:\t\trtl8xxxu_queue_rx_urb(priv, rx_urb);\ndrivers/net/wireless/realtek/rtl8xxxu/core.c-6517-\t} else {\n--\ndrivers/net/wireless/realtek/rtl8xxxu/core.c=7363=static int rtl8xxxu_start(struct ieee80211_hw *hw)\n--\ndrivers/net/wireless/realtek/rtl8xxxu/core.c-7423-\t\t\t}\ndrivers/net/wireless/realtek/rtl8xxxu/core.c:7424:\t\t\trtl8xxxu_queue_rx_urb(priv, rx_urb);\ndrivers/net/wireless/realtek/rtl8xxxu/core.c-7425-\t\t}\n"
}

gemini-3.1-pro-preview

null

null

							input: 20027
							output: 40
							thoughts: 332
						

**Analyzing Potential Race Conditions in the RTL8xxxu Driver**

Okay, so I'm looking at some functions within the `rtl8xxxu` driver: `rtl8xxxu_queue_rx_urb` and `rtl8xxxu_stop`. I can see that `rtl8xxxu_queue_rx_urb` is called from a few places: `rtl8xxxu_rx_complete` (which is the URB completion handler, important!), `rtl8xxxu_rx_urb_work`, and also during `rtl8xxxu_start`. And `rtl8xxxu_stop` gets called when the network interface is shut down, which is a key area to consider.

This looks like a functional change, nothing groundbreaking, but this is a good place to start the analysis. So, let's zoom in on `rtl8xxxu_queue_rx_urb` and `rtl8xxxu_stop`. I'm starting to think about potential race conditions. Hmm, `rtl8xxxu_queue_rx_urb` is called from the URB completion handler... that could be a *hot path*. Meaning this might be frequently hit, potentially a performance bottleneck.

Let's quickly check if this is the case. `rtl8xxxu_queue_rx_urb` queues an RX URB. In high throughput, it's called for *every* packet or a batch of packets. That definitely makes it a hot path. And is `rtl8xxxu_rx_complete` a hot path? Yes, of course. It's the RX URB completion handler! What about `rtl8xxxu_stop`? No, that is called only when the interface is down, so not a hot path.

Alright, so if I want to fuzz this code and look for a race, I think the most interesting areas would be around `rtl8xxxu_stop`... and maybe `rtl8xxxu_start` or `rtl8xxxu_queue_rx_urb`. Actually, `rtl8xxxu_stop` seems like the best one to focus on given that its called when the network is stopped, which can cause interesting situations. Time to dig into `rtl8xxxu_stop`.

{
  "Expression": "rtl8xxxu_stop",
  "PathPrefix": "drivers/net/wireless/realtek/rtl8xxxu/"
}

{
  "Output": "drivers/net/wireless/realtek/rtl8xxxu/core.c=1094=void rtl8xxxu_gen1_disable_rf(struct rtl8xxxu_priv *priv)\n--\ndrivers/net/wireless/realtek/rtl8xxxu/core.c-1132-\ndrivers/net/wireless/realtek/rtl8xxxu/core.c:1133:static void rtl8xxxu_stop_tx_beacon(struct rtl8xxxu_priv *priv)\ndrivers/net/wireless/realtek/rtl8xxxu/core.c-1134-{\n--\ndrivers/net/wireless/realtek/rtl8xxxu/core.c=4847=rtl8xxxu_bss_info_changed(struct ieee80211_hw *hw, struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/realtek/rtl8xxxu/core.c-4912-\t\t\tif (rtlvif-\u003eport_num == 0)\ndrivers/net/wireless/realtek/rtl8xxxu/core.c:4913:\t\t\t\trtl8xxxu_stop_tx_beacon(priv);\ndrivers/net/wireless/realtek/rtl8xxxu/core.c-4914-\n--\ndrivers/net/wireless/realtek/rtl8xxxu/core.c-4967-\t\t} else {\ndrivers/net/wireless/realtek/rtl8xxxu/core.c:4968:\t\t\trtl8xxxu_stop_tx_beacon(priv);\ndrivers/net/wireless/realtek/rtl8xxxu/core.c-4969-\t\t}\n--\ndrivers/net/wireless/realtek/rtl8xxxu/core.c=5790=static void rtl8xxxu_queue_rx_urb(struct rtl8xxxu_priv *priv,\n--\ndrivers/net/wireless/realtek/rtl8xxxu/core.c-5803-\t\t * shutdown check: moving it out of the lock would let a\ndrivers/net/wireless/realtek/rtl8xxxu/core.c:5804:\t\t * completion arm the work after rtl8xxxu_stop() canceled it.\ndrivers/net/wireless/realtek/rtl8xxxu/core.c-5805-\t\t */\n--\ndrivers/net/wireless/realtek/rtl8xxxu/core.c=6689=static int rtl8xxxu_add_interface(struct ieee80211_hw *hw,\n--\ndrivers/net/wireless/realtek/rtl8xxxu/core.c-6706-\t\tif (port_num == 0) {\ndrivers/net/wireless/realtek/rtl8xxxu/core.c:6707:\t\t\trtl8xxxu_stop_tx_beacon(priv);\ndrivers/net/wireless/realtek/rtl8xxxu/core.c-6708-\n--\ndrivers/net/wireless/realtek/rtl8xxxu/core.c=7363=static int rtl8xxxu_start(struct ieee80211_hw *hw)\n--\ndrivers/net/wireless/realtek/rtl8xxxu/core.c-7451-\ndrivers/net/wireless/realtek/rtl8xxxu/core.c:7452:static void rtl8xxxu_stop(struct ieee80211_hw *hw, bool suspend)\ndrivers/net/wireless/realtek/rtl8xxxu/core.c-7453-{\n--\ndrivers/net/wireless/realtek/rtl8xxxu/core.c=7548=static const struct ieee80211_ops rtl8xxxu_ops = {\n--\ndrivers/net/wireless/realtek/rtl8xxxu/core.c-7563-\t.start = rtl8xxxu_start,\ndrivers/net/wireless/realtek/rtl8xxxu/core.c:7564:\t.stop = rtl8xxxu_stop,\ndrivers/net/wireless/realtek/rtl8xxxu/core.c-7565-\t.sw_scan_start = rtl8xxxu_sw_scan_start,\n"
}

gemini-3.1-pro-preview

null

null

							input: 21905
							output: 43
							thoughts: 273
						

**My Analysis of the RTL8xxxu Driver Configuration**

Okay, let's break this down. `rtl8xxxu_stop` is the `mac80211` stop callback. I know this isn't a performance-critical function, so its inclusion in the debugging symbols is probably for completeness rather than performance tuning. I need to keep an eye on `rtl8xxxu_queue_rx_urb` which *is* a hot path and where the crucial fix was implemented. Given that, I should absolutely include `rtl8xxxu_stop` in FocusSymbols, just to be thorough. I'll also add `rtl8xxxu_rx_urb_work`, the workqueue function, and `rtl8xxxu_start`, since it initializes the workqueue. They're all likely inter-related here.

Now, let's get into the broader configuration. I need to make sure `RTL8XXXU` itself has all its dependencies satisfied. It obviously depends on `MAC80211` and `USB`, which seem to be fine. But, hold on a second... since `RTL8XXXU` is sufficient, that's good.

Right, syzbot uses `dummy_hcd` to fuzz USB drivers. Is that enabled by default in syzbot? Yes, it is! Given that, the required configurations are simply `RTL8XXXU`.

Wait, the patch also mentions `RTL8XXXU_UNTESTED` in the Kconfig. I don't need to enable that unless the device is specifically marked as untested, so I'll need to check the Kconfig documentation for that to be sure.

{
  "Expression": "RTL8XXXU_UNTESTED",
  "PathPrefix": "drivers/net/wireless/realtek/rtl8xxxu/"
}

{
  "Output": "drivers/net/wireless/realtek/rtl8xxxu/8192c.c-18-\ndrivers/net/wireless/realtek/rtl8xxxu/8192c.c:19:#ifdef CONFIG_RTL8XXXU_UNTESTED\ndrivers/net/wireless/realtek/rtl8xxxu/8192c.c-20-static struct rtl8xxxu_power_base rtl8192c_power_base = {\n--\ndrivers/net/wireless/realtek/rtl8xxxu/Kconfig=5=config RTL8XXXU\n--\ndrivers/net/wireless/realtek/rtl8xxxu/Kconfig-28-\ndrivers/net/wireless/realtek/rtl8xxxu/Kconfig:29:config RTL8XXXU_UNTESTED\ndrivers/net/wireless/realtek/rtl8xxxu/Kconfig-30-\tbool \"Include support for untested Realtek 8xxx USB devices (EXPERIMENTAL)\"\n--\ndrivers/net/wireless/realtek/rtl8xxxu/core.c=7950=static const struct usb_device_id dev_table[] = {\n--\ndrivers/net/wireless/realtek/rtl8xxxu/core.c-8041-\t.driver_info = (unsigned long)\u0026rtl8192fu_fops},\ndrivers/net/wireless/realtek/rtl8xxxu/core.c:8042:#ifdef CONFIG_RTL8XXXU_UNTESTED\ndrivers/net/wireless/realtek/rtl8xxxu/core.c-8043-/* Still supported by rtlwifi */\n"
}

gemini-3.1-pro-preview

null

null

							input: 22975
							output: 166
							thoughts: 228
						

**My Approach to Addressing the rtl8xxxu Race Condition**

Okay, so the goal is to safely cover a wide range of devices. I'll start by enabling both `RTL8XXXU` and `RTL8XXXU_UNTESTED`. Wait a minute, that `RTL8XXXU_UNTESTED` is just a boolean, so it's simple to include it. Easy.

Now, let's make sure I'm not missing anything obvious. Right, a quick check of existing syzbot configurations. It looks like `MAC80211` is already enabled, as is `USB`. Good, we are covering the bases.

I need to focus my fuzzing efforts on the critical areas, so I need to focus on these symbols: `rtl8xxxu_stop` and `rtl8xxxu_rx_urb_work`. I'll want to target the race condition between the RX URB completion handler and the driver's stop routine. The fix itself involves moving workqueue scheduling within a spinlock and adding `cancel_work_sync`. I need to verify that this correctly prevents the race and doesn't introduce any new issues.

Fuzzing the driver's initialization and teardown routines seems like the most effective way to shake out similar issues. I'll use either `dummy_hcd` or `mac80211_hwsim` to help with that. That should give me good coverage.

Now, let me just format the output and get on with it.

{
  "EnableConfigs": [
    "RTL8XXXU",
    "RTL8XXXU_UNTESTED"
  ],
  "FocusSymbols": [
    "rtl8xxxu_stop",
    "rtl8xxxu_rx_urb_work"
  ],
  "Reasoning": "The patch fixes a race condition between the RX URB completion handler and the driver stop routine in the rtl8xxxu wireless driver. It moves the workqueue scheduling inside a spinlock and adds a cancel_work_sync call to ensure the workqueue is properly cancelled during shutdown. Fuzzing the driver initialization and teardown paths (via dummy_hcd or mac80211_hwsim) can help verify this fix and uncover similar race conditions.",
  "WorthFuzzing": true
}

{
  "EnableConfigs": [
    "RTL8XXXU",
    "RTL8XXXU_UNTESTED"
  ],
  "FocusSymbols": [
    "rtl8xxxu_stop",
    "rtl8xxxu_rx_urb_work"
  ],
  "Reasoning": "The patch fixes a race condition between the RX URB completion handler and the driver stop routine in the rtl8xxxu wireless driver. It moves the workqueue scheduling inside a spinlock and adds a cancel_work_sync call to ensure the workqueue is properly cancelled during shutdown. Fuzzing the driver initialization and teardown paths (via dummy_hcd or mac80211_hwsim) can help verify this fix and uncover similar race conditions.",
  "WorthFuzzing": true
}