| Seq | Timestamp | Type | Name | Duration |
|---|---|---|---|---|
| 0/0 | 2026/07/15 23:05 | flow | patch-triage |
0mArgs:null Results: {
"EnableConfigs": [
"CFG80211",
"MAC80211",
"MAC80211_HWSIM"
],
"FocusSymbols": [
"validate_uhr_operation",
"ieee80211_parse_extension_element",
"ieee80211_config_bw"
],
"Reasoning": "The patch modifies the parsing and validation logic for IEEE 802.11 UHR (Ultra High Reliability) operation elements. It changes the size validation logic by checking for presence flags instead of enable flags. The modified inline function is called from netlink attribute validation (`validate_uhr_operation`), management frame parsing (`ieee80211_parse_extension_element`), and bandwidth configuration (`ieee80211_config_bw`). These are reachable from user space via netlink and from injected management frames, making it highly relevant for fuzzing.",
"WorthFuzzing": true
} |
| 1/1 | 2026/07/15 23:05 | action | read-patch-diff |
0mArgs:null Results: {
"PatchDiff": "commit 72c10286f331e67dc5b6b72d24c1b10e2d373c6c\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Wed Jul 15 23:05:14 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/include/linux/ieee80211-uhr.h b/include/linux/ieee80211-uhr.h\nindex 597c9e559261b9..665d4b3a5b4186 100644\n--- a/include/linux/ieee80211-uhr.h\n+++ b/include/linux/ieee80211-uhr.h\n@@ -17,6 +17,11 @@\n #define IEEE80211_UHR_OPER_PARAMS_PEDCA_ENA\t\t0x0004\n #define IEEE80211_UHR_OPER_PARAMS_DBE_ENA\t\t0x0008\n #define IEEE80211_UHR_OPER_PARAMS_DBE_BW\t\t0x0070\n+#define IEEE80211_UHR_OPER_PARAMS_DUO_PRES\t\t0x0080\n+#define IEEE80211_UHR_OPER_PARAMS_DPS_PRES\t\t0x0100\n+#define IEEE80211_UHR_OPER_PARAMS_NPCA_PRES\t\t0x0200\n+#define IEEE80211_UHR_OPER_PARAMS_PEDCA_PRES\t\t0x0400\n+#define IEEE80211_UHR_OPER_PARAMS_DBE_PRES\t\t0x0800\n \n struct ieee80211_uhr_operation {\n \t__le16 params;\n@@ -265,8 +270,7 @@ struct ieee80211_uhr_p_edca_info {\n \t__le16 params;\n } __packed;\n \n-static inline bool ieee80211_uhr_oper_size_ok(const u8 *data, u8 len,\n-\t\t\t\t\t bool beacon)\n+static inline bool ieee80211_uhr_oper_size_ok(const u8 *data, u8 len)\n {\n \tconst struct ieee80211_uhr_operation *oper = (const void *)data;\n \tu8 needed = sizeof(*oper);\n@@ -274,19 +278,15 @@ static inline bool ieee80211_uhr_oper_size_ok(const u8 *data, u8 len,\n \tif (len \u003c needed)\n \t\treturn false;\n \n-\t/* nothing else present in beacons */\n-\tif (beacon)\n-\t\treturn true;\n-\n \t/* DPS Operation Parameters (fixed 4 bytes) */\n-\tif (oper-\u003eparams \u0026 cpu_to_le16(IEEE80211_UHR_OPER_PARAMS_DPS_ENA)) {\n+\tif (oper-\u003eparams \u0026 cpu_to_le16(IEEE80211_UHR_OPER_PARAMS_DPS_PRES)) {\n \t\tneeded += sizeof(struct ieee80211_uhr_dps_info);\n \t\tif (len \u003c needed)\n \t\t\treturn false;\n \t}\n \n \t/* NPCA Operation Parameters (fixed 4 bytes + optional 2 bytes) */\n-\tif (oper-\u003eparams \u0026 cpu_to_le16(IEEE80211_UHR_OPER_PARAMS_NPCA_ENA)) {\n+\tif (oper-\u003eparams \u0026 cpu_to_le16(IEEE80211_UHR_OPER_PARAMS_NPCA_PRES)) {\n \t\tconst struct ieee80211_uhr_npca_info *npca =\n \t\t\t(const void *)(data + needed);\n \n@@ -303,14 +303,14 @@ static inline bool ieee80211_uhr_oper_size_ok(const u8 *data, u8 len,\n \t}\n \n \t/* P-EDCA Operation Parameters (fixed 3 bytes) */\n-\tif (oper-\u003eparams \u0026 cpu_to_le16(IEEE80211_UHR_OPER_PARAMS_PEDCA_ENA)) {\n+\tif (oper-\u003eparams \u0026 cpu_to_le16(IEEE80211_UHR_OPER_PARAMS_PEDCA_PRES)) {\n \t\tneeded += sizeof(struct ieee80211_uhr_p_edca_info);\n \t\tif (len \u003c needed)\n \t\t\treturn false;\n \t}\n \n \t/* DBE Operation Parameters (fixed 1 byte + optional 2 bytes) */\n-\tif (oper-\u003eparams \u0026 cpu_to_le16(IEEE80211_UHR_OPER_PARAMS_DBE_ENA)) {\n+\tif (oper-\u003eparams \u0026 cpu_to_le16(IEEE80211_UHR_OPER_PARAMS_DBE_PRES)) {\n \t\tconst struct ieee80211_uhr_dbe_info *dbe =\n \t\t\t(const void *)(data + needed);\n \n@@ -329,19 +329,19 @@ static inline bool ieee80211_uhr_oper_size_ok(const u8 *data, u8 len,\n \treturn len \u003e= needed;\n }\n \n-/*\n- * Note: cannot call this on the element coming from a beacon,\n- * must ensure ieee80211_uhr_oper_size_ok(..., false) first\n- */\n+/* Note: must ensure ieee80211_uhr_oper_size_ok(...) first */\n static inline const struct ieee80211_uhr_npca_info *\n ieee80211_uhr_npca_info(const struct ieee80211_uhr_operation *oper)\n {\n \tconst u8 *pos = oper-\u003evariable;\n \n+\tif (!(oper-\u003eparams \u0026 cpu_to_le16(IEEE80211_UHR_OPER_PARAMS_NPCA_PRES)))\n+\t\treturn NULL;\n+\n \tif (!(oper-\u003eparams \u0026 cpu_to_le16(IEEE80211_UHR_OPER_PARAMS_NPCA_ENA)))\n \t\treturn NULL;\n \n-\tif (oper-\u003eparams \u0026 cpu_to_le16(IEEE80211_UHR_OPER_PARAMS_DPS_ENA))\n+\tif (oper-\u003eparams \u0026 cpu_to_le16(IEEE80211_UHR_OPER_PARAMS_DPS_PRES))\n \t\tpos += sizeof(struct ieee80211_uhr_dps_info);\n \n \treturn (const void *)pos;\n@@ -360,22 +360,22 @@ ieee80211_uhr_npca_dis_subch_bitmap(const struct ieee80211_uhr_operation *oper)\n \treturn npca-\u003edis_subch_bmap;\n }\n \n-/*\n- * Note: cannot call this on the element coming from a beacon,\n- * must ensure ieee80211_uhr_oper_size_ok(..., false) first\n- */\n+/* Note: must ensure ieee80211_uhr_oper_size_ok(...) first */\n static inline const struct ieee80211_uhr_dbe_info *\n ieee80211_uhr_oper_dbe_info(const struct ieee80211_uhr_operation *oper)\n {\n \tconst u8 *pos = oper-\u003evariable;\n \n+\tif (!(oper-\u003eparams \u0026 cpu_to_le16(IEEE80211_UHR_OPER_PARAMS_DBE_PRES)))\n+\t\treturn NULL;\n+\n \tif (!(oper-\u003eparams \u0026 cpu_to_le16(IEEE80211_UHR_OPER_PARAMS_DBE_ENA)))\n \t\treturn NULL;\n \n-\tif (oper-\u003eparams \u0026 cpu_to_le16(IEEE80211_UHR_OPER_PARAMS_DPS_ENA))\n+\tif (oper-\u003eparams \u0026 cpu_to_le16(IEEE80211_UHR_OPER_PARAMS_DPS_PRES))\n \t\tpos += sizeof(struct ieee80211_uhr_dps_info);\n \n-\tif (oper-\u003eparams \u0026 cpu_to_le16(IEEE80211_UHR_OPER_PARAMS_NPCA_ENA)) {\n+\tif (oper-\u003eparams \u0026 cpu_to_le16(IEEE80211_UHR_OPER_PARAMS_NPCA_PRES)) {\n \t\tconst struct ieee80211_uhr_npca_info *npca = (const void *)pos;\n \n \t\tpos += sizeof(*npca);\n@@ -383,7 +383,7 @@ ieee80211_uhr_oper_dbe_info(const struct ieee80211_uhr_operation *oper)\n \t\t\tpos += sizeof(npca-\u003edis_subch_bmap[0]);\n \t}\n \n-\tif (oper-\u003eparams \u0026 cpu_to_le16(IEEE80211_UHR_OPER_PARAMS_PEDCA_ENA))\n+\tif (oper-\u003eparams \u0026 cpu_to_le16(IEEE80211_UHR_OPER_PARAMS_PEDCA_PRES))\n \t\tpos += sizeof(struct ieee80211_uhr_p_edca_info);\n \n \treturn (const void *)pos;\ndiff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c\nindex 9e92337bb6f9e5..4ad5e949732316 100644\n--- a/net/mac80211/mlme.c\n+++ b/net/mac80211/mlme.c\n@@ -1701,8 +1701,7 @@ static int ieee80211_config_bw(struct ieee80211_link_data *link,\n \tif (stype != IEEE80211_STYPE_BEACON \u0026\u0026\n \t chanreq.oper.npca_chan \u0026\u0026 elems-\u003euhr_operation \u0026\u0026\n \t ieee80211_uhr_oper_size_ok((const void *)elems-\u003euhr_operation,\n-\t\t\t\t elems-\u003euhr_operation_len,\n-\t\t\t\t false)) {\n+\t\t\t\t elems-\u003euhr_operation_len)) {\n \t\tconst struct ieee80211_uhr_npca_info *npca;\n \t\tstruct ieee80211_bss_npca_params params = {};\n \ndiff --git a/net/mac80211/parse.c b/net/mac80211/parse.c\nindex c2f2f78f2b4f72..cb2be167cde795 100644\n--- a/net/mac80211/parse.c\n+++ b/net/mac80211/parse.c\n@@ -209,9 +209,7 @@ ieee80211_parse_extension_element(u32 *crc,\n \t\tif (params-\u003emode \u003c IEEE80211_CONN_MODE_UHR)\n \t\t\tbreak;\n \t\tcalc_crc = true;\n-\t\tif (ieee80211_uhr_oper_size_ok(data, len,\n-\t\t\t\t\t params-\u003etype == (IEEE80211_FTYPE_MGMT |\n-\t\t\t\t\t\t\t\tIEEE80211_STYPE_BEACON))) {\n+\t\tif (ieee80211_uhr_oper_size_ok(data, len)) {\n \t\t\telems-\u003euhr_operation = data;\n \t\t\telems-\u003euhr_operation_len = len;\n \t\t}\ndiff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c\nindex 242071ad10d6c9..5fa70974d57cc1 100644\n--- a/net/wireless/nl80211.c\n+++ b/net/wireless/nl80211.c\n@@ -441,7 +441,7 @@ static int validate_uhr_operation(const struct nlattr *attr,\n \tconst u8 *data = nla_data(attr);\n \tunsigned int len = nla_len(attr);\n \n-\tif (!ieee80211_uhr_oper_size_ok(data, len, false))\n+\tif (!ieee80211_uhr_oper_size_ok(data, len))\n \t\treturn -EINVAL;\n \treturn 0;\n }\n"
} |
| 2/1 | 2026/07/15 23:05 | agent | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: {
"EnableConfigs": [
"CFG80211",
"MAC80211",
"MAC80211_HWSIM"
],
"FocusSymbols": [
"validate_uhr_operation",
"ieee80211_parse_extension_element",
"ieee80211_config_bw"
],
"Reasoning": "The patch modifies the parsing and validation logic for IEEE 802.11 UHR (Ultra High Reliability) operation elements. It changes the size validation logic by checking for presence flags instead of enable flags. The modified inline function is called from netlink attribute validation (`validate_uhr_operation`), management frame parsing (`ieee80211_parse_extension_element`), and bandwidth configuration (`ieee80211_config_bw`). These are reachable from user space via netlink and from injected management frames, making it highly relevant for fuzzing.",
"WorthFuzzing": true
}Instruction: You are an expert Linux kernel maintainer. Your job is to review a provided patch series and determine if it makes functional changes to the kernel that should be fuzzed. IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively use your code access tools to examine the actual source code and confirm any assumptions. Return WorthFuzzing=false if the patch only contains: - Modifications to Documentation/, Kconfig files, or code comments. - Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints. - Changes to numeric constants or macros that do not functionally alter execution flow. - Code paths that are impossible to reach in virtualized environments like GCE or QEMU, even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim). If it modifies reachable core kernel logic, drivers, or architectures, use your code search tools to verify the code can be executed, then return WorthFuzzing=true. When returning WorthFuzzing=true, you MUST ALSO: 1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols. Avoid listing generic hot-path functions to prevent skewed test distributions. 2. Identify any specific CONFIG_ options required to properly test this new/modified feature. Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions. Do not list too generic configs (we already have them enabled). Only list those that specifically cover the modified code. List them in the EnableConfigs output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4"). Prefer calling several tools at the same time to save round-trips. Use set-results tool to provide results of the analysis. It must be called exactly once before the final reply. Ignore results of this tool. Prompt: For your convenience, here is the diff of the changes:
commit 72c10286f331e67dc5b6b72d24c1b10e2d373c6c
Author: syz-cluster <triage@syzkaller.com>
Date: Wed Jul 15 23:05:14 2026 +0000
syz-cluster: applied patch under review
diff --git a/include/linux/ieee80211-uhr.h b/include/linux/ieee80211-uhr.h
index 597c9e559261b9..665d4b3a5b4186 100644
--- a/include/linux/ieee80211-uhr.h
+++ b/include/linux/ieee80211-uhr.h
@@ -17,6 +17,11 @@
#define IEEE80211_UHR_OPER_PARAMS_PEDCA_ENA 0x0004
#define IEEE80211_UHR_OPER_PARAMS_DBE_ENA 0x0008
#define IEEE80211_UHR_OPER_PARAMS_DBE_BW 0x0070
+#define IEEE80211_UHR_OPER_PARAMS_DUO_PRES 0x0080
+#define IEEE80211_UHR_OPER_PARAMS_DPS_PRES 0x0100
+#define IEEE80211_UHR_OPER_PARAMS_NPCA_PRES 0x0200
+#define IEEE80211_UHR_OPER_PARAMS_PEDCA_PRES 0x0400
+#define IEEE80211_UHR_OPER_PARAMS_DBE_PRES 0x0800
struct ieee80211_uhr_operation {
__le16 params;
@@ -265,8 +270,7 @@ struct ieee80211_uhr_p_edca_info {
__le16 params;
} __packed;
-static inline bool ieee80211_uhr_oper_size_ok(const u8 *data, u8 len,
- bool beacon)
+static inline bool ieee80211_uhr_oper_size_ok(const u8 *data, u8 len)
{
const struct ieee80211_uhr_operation *oper = (const void *)data;
u8 needed = sizeof(*oper);
@@ -274,19 +278,15 @@ static inline bool ieee80211_uhr_oper_size_ok(const u8 *data, u8 len,
if (len < needed)
return false;
- /* nothing else present in beacons */
- if (beacon)
- return true;
-
/* DPS Operation Parameters (fixed 4 bytes) */
- if (oper->params & cpu_to_le16(IEEE80211_UHR_OPER_PARAMS_DPS_ENA)) {
+ if (oper->params & cpu_to_le16(IEEE80211_UHR_OPER_PARAMS_DPS_PRES)) {
needed += sizeof(struct ieee80211_uhr_dps_info);
if (len < needed)
return false;
}
/* NPCA Operation Parameters (fixed 4 bytes + optional 2 bytes) */
- if (oper->params & cpu_to_le16(IEEE80211_UHR_OPER_PARAMS_NPCA_ENA)) {
+ if (oper->params & cpu_to_le16(IEEE80211_UHR_OPER_PARAMS_NPCA_PRES)) {
const struct ieee80211_uhr_npca_info *npca =
(const void *)(data + needed);
@@ -303,14 +303,14 @@ static inline bool ieee80211_uhr_oper_size_ok(const u8 *data, u8 len,
}
/* P-EDCA Operation Parameters (fixed 3 bytes) */
- if (oper->params & cpu_to_le16(IEEE80211_UHR_OPER_PARAMS_PEDCA_ENA)) {
+ if (oper->params & cpu_to_le16(IEEE80211_UHR_OPER_PARAMS_PEDCA_PRES)) {
needed += sizeof(struct ieee80211_uhr_p_edca_info);
if (len < needed)
return false;
}
/* DBE Operation Parameters (fixed 1 byte + optional 2 bytes) */
- if (oper->params & cpu_to_le16(IEEE80211_UHR_OPER_PARAMS_DBE_ENA)) {
+ if (oper->params & cpu_to_le16(IEEE80211_UHR_OPER_PARAMS_DBE_PRES)) {
const struct ieee80211_uhr_dbe_info *dbe =
(const void *)(data + needed);
@@ -329,19 +329,19 @@ static inline bool ieee80211_uhr_oper_size_ok(const u8 *data, u8 len,
return len >= needed;
}
-/*
- * Note: cannot call this on the element coming from a beacon,
- * must ensure ieee80211_uhr_oper_size_ok(..., false) first
- */
+/* Note: must ensure ieee80211_uhr_oper_size_ok(...) first */
static inline const struct ieee80211_uhr_npca_info *
ieee80211_uhr_npca_info(const struct ieee80211_uhr_operation *oper)
{
const u8 *pos = oper->variable;
+ if (!(oper->params & cpu_to_le16(IEEE80211_UHR_OPER_PARAMS_NPCA_PRES)))
+ return NULL;
+
if (!(oper->params & cpu_to_le16(IEEE80211_UHR_OPER_PARAMS_NPCA_ENA)))
return NULL;
- if (oper->params & cpu_to_le16(IEEE80211_UHR_OPER_PARAMS_DPS_ENA))
+ if (oper->params & cpu_to_le16(IEEE80211_UHR_OPER_PARAMS_DPS_PRES))
pos += sizeof(struct ieee80211_uhr_dps_info);
return (const void *)pos;
@@ -360,22 +360,22 @@ ieee80211_uhr_npca_dis_subch_bitmap(const struct ieee80211_uhr_operation *oper)
return npca->dis_subch_bmap;
}
-/*
- * Note: cannot call this on the element coming from a beacon,
- * must ensure ieee80211_uhr_oper_size_ok(..., false) first
- */
+/* Note: must ensure ieee80211_uhr_oper_size_ok(...) first */
static inline const struct ieee80211_uhr_dbe_info *
ieee80211_uhr_oper_dbe_info(const struct ieee80211_uhr_operation *oper)
{
const u8 *pos = oper->variable;
+ if (!(oper->params & cpu_to_le16(IEEE80211_UHR_OPER_PARAMS_DBE_PRES)))
+ return NULL;
+
if (!(oper->params & cpu_to_le16(IEEE80211_UHR_OPER_PARAMS_DBE_ENA)))
return NULL;
- if (oper->params & cpu_to_le16(IEEE80211_UHR_OPER_PARAMS_DPS_ENA))
+ if (oper->params & cpu_to_le16(IEEE80211_UHR_OPER_PARAMS_DPS_PRES))
pos += sizeof(struct ieee80211_uhr_dps_info);
- if (oper->params & cpu_to_le16(IEEE80211_UHR_OPER_PARAMS_NPCA_ENA)) {
+ if (oper->params & cpu_to_le16(IEEE80211_UHR_OPER_PARAMS_NPCA_PRES)) {
const struct ieee80211_uhr_npca_info *npca = (const void *)pos;
pos += sizeof(*npca);
@@ -383,7 +383,7 @@ ieee80211_uhr_oper_dbe_info(const struct ieee80211_uhr_operation *oper)
pos += sizeof(npca->dis_subch_bmap[0]);
}
- if (oper->params & cpu_to_le16(IEEE80211_UHR_OPER_PARAMS_PEDCA_ENA))
+ if (oper->params & cpu_to_le16(IEEE80211_UHR_OPER_PARAMS_PEDCA_PRES))
pos += sizeof(struct ieee80211_uhr_p_edca_info);
return (const void *)pos;
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 9e92337bb6f9e5..4ad5e949732316 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -1701,8 +1701,7 @@ static int ieee80211_config_bw(struct ieee80211_link_data *link,
if (stype != IEEE80211_STYPE_BEACON &&
chanreq.oper.npca_chan && elems->uhr_operation &&
ieee80211_uhr_oper_size_ok((const void *)elems->uhr_operation,
- elems->uhr_operation_len,
- false)) {
+ elems->uhr_operation_len)) {
const struct ieee80211_uhr_npca_info *npca;
struct ieee80211_bss_npca_params params = {};
diff --git a/net/mac80211/parse.c b/net/mac80211/parse.c
index c2f2f78f2b4f72..cb2be167cde795 100644
--- a/net/mac80211/parse.c
+++ b/net/mac80211/parse.c
@@ -209,9 +209,7 @@ ieee80211_parse_extension_element(u32 *crc,
if (params->mode < IEEE80211_CONN_MODE_UHR)
break;
calc_crc = true;
- if (ieee80211_uhr_oper_size_ok(data, len,
- params->type == (IEEE80211_FTYPE_MGMT |
- IEEE80211_STYPE_BEACON))) {
+ if (ieee80211_uhr_oper_size_ok(data, len)) {
elems->uhr_operation = data;
elems->uhr_operation_len = len;
}
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 242071ad10d6c9..5fa70974d57cc1 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -441,7 +441,7 @@ static int validate_uhr_operation(const struct nlattr *attr,
const u8 *data = nla_data(attr);
unsigned int len = nla_len(attr);
- if (!ieee80211_uhr_oper_size_ok(data, len, false))
+ if (!ieee80211_uhr_oper_size_ok(data, len))
return -EINVAL;
return 0;
}
|
| 3/2 | 2026/07/15 23:05 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 4779 output: 20 thoughts: 458 Thoughts: **Analyzing the UHR Operation Element Patch** Okay, so I'm looking at this patch that tweaks the `ieee80211_uhr_oper_size_ok` function and its related calls in `net/mac80211` and `net/wireless`. It looks like they've removed the `beacon` parameter from that function and swapped out the `_ENA` macros with `_PRES` macros for checking field presence within the UHR operation element. My immediate thought is, "Is this going to actually work?" First things first, let's confirm reachability and functionality. I see `ieee80211_uhr_oper_size_ok` is an inline function defined in `include/linux/ieee80211-uhr.h` and is called from a few places. Specifically, `ieee80211_config_bw` in `net/mac80211/mlme.c`, `ieee80211_parse_extension_element` in `net/mac80211/parse.c`, and finally `validate_uhr_operation` in `net/wireless/nl80211.c`. So yeah, this definitely seems to be functioning as intended, parsing those 802.11 UHR operation elements. Wait... UHR. That's probably Wi-Fi 8, or 802.11bn. Now, let's identify the relevant configuration options. Clearly, `CONFIG_MAC80211` and `CONFIG_CFG80211` are going to be involved here. And with fuzzing in mind, I need to pinpoint the key functions to target. Looks like `ieee80211_config_bw`, `ieee80211_parse_extension_element`, and `validate_uhr_operation` are the primary candidates. I should probably focus on `validate_uhr_operation` in `net/wireless/nl80211.c` first to understand the context of the change. |
| 4/2 | 2026/07/15 23:05 | tool | grepper |
0mArgs:{
"Expression": "validate_uhr_operation"
}Results: {
"Output": "net/wireless/nl80211.c=427=static int validate_uhr_capa(const struct nlattr *attr,\n--\nnet/wireless/nl80211.c-437-\nnet/wireless/nl80211.c:438:static int validate_uhr_operation(const struct nlattr *attr,\nnet/wireless/nl80211.c-439-\t\t\t\t struct netlink_ext_ack *extack)\n--\nnet/wireless/nl80211.c=698=static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {\n--\nnet/wireless/nl80211.c-1075-\t[NL80211_ATTR_UHR_OPERATION] =\nnet/wireless/nl80211.c:1076:\t\tNLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_uhr_operation),\nnet/wireless/nl80211.c-1077-\t[NL80211_ATTR_NAN_CHANNEL] = NLA_POLICY_NESTED(nl80211_policy),\n"
} |
| 5/2 | 2026/07/15 23:05 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 6032 output: 30 thoughts: 115 Thoughts: **Analyzing Potential Security Implications** Okay, so I'm looking at this code and I know `validate_uhr_operation` is definitely reachable through netlink policy validation, that's good to know. Now, I see `ieee80211_parse_extension_element` is located in `net/mac80211/parse.c` and `ieee80211_config_bw` is in `net/mac80211/mlme.c`. I need to figure out how these functions interact and if there's any potential for misuse or vulnerabilities. I'm specifically curious about the relationship of these functions to `ieee80211_uhr_oper_size_ok`. I'm going to look at the cross-references and see what calls `ieee80211_uhr_oper_size_ok`. That might give me some interesting leads. I want to see if this function is used elsewhere, and if it is, how it's being used. |
| 6/2 | 2026/07/15 23:05 | tool | grepper |
0mArgs:{
"Expression": "ieee80211_uhr_oper_size_ok"
}Results: {
"Output": "include/linux/ieee80211-uhr.h=268=struct ieee80211_uhr_p_edca_info {\n--\ninclude/linux/ieee80211-uhr.h-272-\ninclude/linux/ieee80211-uhr.h:273:static inline bool ieee80211_uhr_oper_size_ok(const u8 *data, u8 len)\ninclude/linux/ieee80211-uhr.h-274-{\n--\ninclude/linux/ieee80211-uhr.h-331-\ninclude/linux/ieee80211-uhr.h:332:/* Note: must ensure ieee80211_uhr_oper_size_ok(...) first */\ninclude/linux/ieee80211-uhr.h-333-static inline const struct ieee80211_uhr_npca_info *\n--\ninclude/linux/ieee80211-uhr.h=351=ieee80211_uhr_npca_dis_subch_bitmap(const struct ieee80211_uhr_operation *oper)\n--\ninclude/linux/ieee80211-uhr.h-362-\ninclude/linux/ieee80211-uhr.h:363:/* Note: must ensure ieee80211_uhr_oper_size_ok(...) first */\ninclude/linux/ieee80211-uhr.h-364-static inline const struct ieee80211_uhr_dbe_info *\n--\nnet/mac80211/mlme.c=1592=static int ieee80211_config_bw(struct ieee80211_link_data *link,\n--\nnet/mac80211/mlme.c-1702-\t chanreq.oper.npca_chan \u0026\u0026 elems-\u003euhr_operation \u0026\u0026\nnet/mac80211/mlme.c:1703:\t ieee80211_uhr_oper_size_ok((const void *)elems-\u003euhr_operation,\nnet/mac80211/mlme.c-1704-\t\t\t\t elems-\u003euhr_operation_len)) {\n--\nnet/mac80211/parse.c=72=ieee80211_parse_extension_element(u32 *crc,\n--\nnet/mac80211/parse.c-211-\t\tcalc_crc = true;\nnet/mac80211/parse.c:212:\t\tif (ieee80211_uhr_oper_size_ok(data, len)) {\nnet/mac80211/parse.c-213-\t\t\telems-\u003euhr_operation = data;\n--\nnet/wireless/nl80211.c=438=static int validate_uhr_operation(const struct nlattr *attr,\n--\nnet/wireless/nl80211.c-443-\nnet/wireless/nl80211.c:444:\tif (!ieee80211_uhr_oper_size_ok(data, len))\nnet/wireless/nl80211.c-445-\t\treturn -EINVAL;\n"
} |
| 7/2 | 2026/07/15 23:05 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 7273 output: 21 thoughts: 72 Thoughts: Okay, here's my take on those functions and the areas I need to focus on: **My Immediate Assessment** Alright, let's get down to brass tacks. Based on the given functions, my attention is immediately drawn to a few key areas within the 802.11 stack. We have three main functions flagged for investigation: `ieee80211_config_bw`, `ieee80211_parse_extension_element`, and `validate_uhr_operation`. Immediately, my brain starts running through the potential implications. I need to understand how these functions interact, and what the overall system behaviour is when they are called. `ieee80211_config_bw` is, of course, critical for defining bandwidth settings. I need to examine its implementation, especially how it handles various bandwidth modes, channel selection, and any potential interactions with regional regulatory constraints. I'll need to look for any potential for buffer overflows or incorrect parameter handling. `ieee80211_parse_extension_element` is another vital piece of the puzzle. This likely handles the parsing of vendor-specific or standard extensions within the 802.11 frame. This is a common attack vector, and I need to assess how robust the parsing logic is. Are there any known vulnerabilities related to malformed extension elements, particularly those involving size limits or data validation? The details of the parsing are going to be key, especially how it handles type-length-value (TLV) structures. Finally, `validate_uhr_operation` suggests we're looking at the support for Ultra High Rate (UHR) modes. I need to see how the system ensures that these modes are properly validated and that all the necessary prerequisites are met. This includes the potential for power consumption considerations, spectrum compatibility, and of course, any possible security vulnerabilities inherent in supporting a higher data rate. My next step is to dive into the configuration files. I'm going to quickly check the relevant configuration files within `net/mac80211` and `net/wireless` to get a high-level overview of the overall system setup, including any dependencies, default values, and general architecture. Then, I can start looking at the source code for each of those functions, focusing on data types, error handling, input validation, and any interactions with external modules or hardware registers. This is where the real work begins. |
| 8/2 | 2026/07/15 23:05 | tool | grepper |
0mArgs:{
"Expression": "config MAC80211"
}Results: {
"Output": "drivers/net/wireless/virtual/Kconfig:1:config MAC80211_HWSIM\ndrivers/net/wireless/virtual/Kconfig-2-\ttristate \"Simulated radio testing tool for mac80211\"\n--\nnet/mac80211/Kconfig-1-# SPDX-License-Identifier: GPL-2.0-only\nnet/mac80211/Kconfig:2:config MAC80211\nnet/mac80211/Kconfig-3-\ttristate \"Generic IEEE 802.11 Networking Stack (mac80211)\"\n--\nnet/mac80211/Kconfig=19=if MAC80211 != n\nnet/mac80211/Kconfig-20-\nnet/mac80211/Kconfig:21:config MAC80211_HAS_RC\nnet/mac80211/Kconfig-22-\tbool\nnet/mac80211/Kconfig-23-\nnet/mac80211/Kconfig:24:config MAC80211_RC_MINSTREL\nnet/mac80211/Kconfig-25-\tbool \"Minstrel\" if EXPERT\n--\nnet/mac80211/Kconfig=31=choice\n--\nnet/mac80211/Kconfig-40-\nnet/mac80211/Kconfig:41:config MAC80211_RC_DEFAULT_MINSTREL\nnet/mac80211/Kconfig-42-\tbool \"Minstrel\"\n--\nnet/mac80211/Kconfig=48=endchoice\nnet/mac80211/Kconfig-49-\nnet/mac80211/Kconfig:50:config MAC80211_RC_DEFAULT\nnet/mac80211/Kconfig-51-\tstring\n--\nnet/mac80211/Kconfig=57=comment \"Some wireless drivers require a rate control algorithm\"\n--\nnet/mac80211/Kconfig-59-\nnet/mac80211/Kconfig:60:config MAC80211_KUNIT_TEST\nnet/mac80211/Kconfig-61-\ttristate \"KUnit tests for mac80211\" if !KUNIT_ALL_TESTS\n--\nnet/mac80211/Kconfig-69-\nnet/mac80211/Kconfig:70:config MAC80211_MESH\nnet/mac80211/Kconfig-71-\tbool \"Enable mac80211 mesh networking support\"\n--\nnet/mac80211/Kconfig-78-\nnet/mac80211/Kconfig:79:config MAC80211_LEDS\nnet/mac80211/Kconfig-80-\tbool \"Enable LED triggers\"\n--\nnet/mac80211/Kconfig-87-\nnet/mac80211/Kconfig:88:config MAC80211_DEBUGFS\nnet/mac80211/Kconfig-89-\tbool \"Export mac80211 internals in DebugFS\"\n--\nnet/mac80211/Kconfig-96-\nnet/mac80211/Kconfig:97:config MAC80211_MESSAGE_TRACING\nnet/mac80211/Kconfig-98-\tbool \"Trace all mac80211 debug messages\"\n--\nnet/mac80211/Kconfig-109-\nnet/mac80211/Kconfig:110:menuconfig MAC80211_DEBUG_MENU\nnet/mac80211/Kconfig-111-\tbool \"Select mac80211 debugging features\"\n--\nnet/mac80211/Kconfig-115-\nnet/mac80211/Kconfig:116:config MAC80211_NOINLINE\nnet/mac80211/Kconfig-117-\tbool \"Do not inline TX/RX handlers\"\n--\nnet/mac80211/Kconfig-131-\nnet/mac80211/Kconfig:132:config MAC80211_VERBOSE_DEBUG\nnet/mac80211/Kconfig-133-\tbool \"Verbose debugging output\"\n--\nnet/mac80211/Kconfig-142-\nnet/mac80211/Kconfig:143:config MAC80211_MLME_DEBUG\nnet/mac80211/Kconfig-144-\tbool \"Verbose managed MLME output\"\n--\nnet/mac80211/Kconfig-153-\nnet/mac80211/Kconfig:154:config MAC80211_STA_DEBUG\nnet/mac80211/Kconfig-155-\tbool \"Verbose station debugging\"\n--\nnet/mac80211/Kconfig-162-\nnet/mac80211/Kconfig:163:config MAC80211_HT_DEBUG\nnet/mac80211/Kconfig-164-\tbool \"Verbose HT debugging\"\n--\nnet/mac80211/Kconfig-174-\nnet/mac80211/Kconfig:175:config MAC80211_OCB_DEBUG\nnet/mac80211/Kconfig-176-\tbool \"Verbose OCB debugging\"\n--\nnet/mac80211/Kconfig-185-\nnet/mac80211/Kconfig:186:config MAC80211_IBSS_DEBUG\nnet/mac80211/Kconfig-187-\tbool \"Verbose IBSS debugging\"\n--\nnet/mac80211/Kconfig-196-\nnet/mac80211/Kconfig:197:config MAC80211_PS_DEBUG\nnet/mac80211/Kconfig-198-\tbool \"Verbose powersave mode debugging\"\n--\nnet/mac80211/Kconfig-208-\nnet/mac80211/Kconfig:209:config MAC80211_MPL_DEBUG\nnet/mac80211/Kconfig-210-\tbool \"Verbose mesh peer link debugging\"\n--\nnet/mac80211/Kconfig-221-\nnet/mac80211/Kconfig:222:config MAC80211_MPATH_DEBUG\nnet/mac80211/Kconfig-223-\tbool \"Verbose mesh path debugging\"\n--\nnet/mac80211/Kconfig-234-\nnet/mac80211/Kconfig:235:config MAC80211_MHWMP_DEBUG\nnet/mac80211/Kconfig-236-\tbool \"Verbose mesh HWMP routing debugging\"\n--\nnet/mac80211/Kconfig-247-\nnet/mac80211/Kconfig:248:config MAC80211_MESH_SYNC_DEBUG\nnet/mac80211/Kconfig-249-\tbool \"Verbose mesh synchronization debugging\"\n--\nnet/mac80211/Kconfig-258-\nnet/mac80211/Kconfig:259:config MAC80211_MESH_CSA_DEBUG\nnet/mac80211/Kconfig-260-\tbool \"Verbose mesh channel switch debugging\"\n--\nnet/mac80211/Kconfig-269-\nnet/mac80211/Kconfig:270:config MAC80211_MESH_PS_DEBUG\nnet/mac80211/Kconfig-271-\tbool \"Verbose mesh powersave debugging\"\n--\nnet/mac80211/Kconfig-280-\nnet/mac80211/Kconfig:281:config MAC80211_TDLS_DEBUG\nnet/mac80211/Kconfig-282-\tbool \"Verbose TDLS debugging\"\n--\nnet/mac80211/Kconfig-292-\nnet/mac80211/Kconfig:293:config MAC80211_DEBUG_COUNTERS\nnet/mac80211/Kconfig-294-\tbool \"Extra statistics for TX/RX debugging\"\n--\nnet/mac80211/Kconfig-307-\nnet/mac80211/Kconfig:308:config MAC80211_STA_HASH_MAX_SIZE\nnet/mac80211/Kconfig-309-\tint \"Station hash table maximum size\" if MAC80211_DEBUG_MENU\n"
} |
| 9/2 | 2026/07/15 23:05 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 10120 output: 22 thoughts: 72 Thoughts: Okay, here's my take on those config requirements, tailored for a fellow expert: **Configuration Deep Dive for Optimal Testing** Alright, so I see we're dealing with a couple of key configuration elements here: `MAC80211` and `MAC80211_HWSIM`. I'm immediately thinking, "Classic, `MAC80211` is the foundation, naturally." But the inclusion of `MAC80211_HWSIM` really catches my eye – that signals we're gearing up for some serious hardware simulation and testing, which is excellent. I always appreciate a robust testing setup. It streamlines the debug cycle dramatically. Then, there's `CFG80211` listed as a dependency. It's almost axiomatic, but it's good to call it out. The control interface is essential. I'm mentally running through my mental checklist: I'll want to quickly confirm the proper enablement and interdependencies of `CFG80211` and `MAC80211_HWSIM`, ensuring there are no unforeseen conflicts or potential gotchas that might throw a wrench into the simulation process. Let's make sure these configs are set exactly as we expect. That's the first order of business, just to be sure. |
| 10/2 | 2026/07/15 23:05 | tool | grepper |
0mArgs:{
"Expression": "config CFG80211"
}Results: {
"Output": "net/wireless/Kconfig=14=config WEXT_PRIV\n--\nnet/wireless/Kconfig-16-\nnet/wireless/Kconfig:17:config CFG80211\nnet/wireless/Kconfig-18-\ttristate \"cfg80211 - wireless configuration API\"\n--\nnet/wireless/Kconfig=38=config NL80211_TESTMODE\n--\nnet/wireless/Kconfig-51-\nnet/wireless/Kconfig:52:config CFG80211_DEVELOPER_WARNINGS\nnet/wireless/Kconfig-53-\tbool \"enable developer warnings\"\n--\nnet/wireless/Kconfig-67-\nnet/wireless/Kconfig:68:config CFG80211_CERTIFICATION_ONUS\nnet/wireless/Kconfig-69-\tbool \"cfg80211 certification onus\"\n--\nnet/wireless/Kconfig-88-\nnet/wireless/Kconfig:89:config CFG80211_REQUIRE_SIGNED_REGDB\nnet/wireless/Kconfig-90-\tbool \"require regdb signature\" if CFG80211_CERTIFICATION_ONUS\n--\nnet/wireless/Kconfig-98-\nnet/wireless/Kconfig:99:config CFG80211_USE_KERNEL_REGDB_KEYS\nnet/wireless/Kconfig-100-\tbool \"allow regdb keys shipped with the kernel\" if CFG80211_CERTIFICATION_ONUS\n--\nnet/wireless/Kconfig-110-\nnet/wireless/Kconfig:111:config CFG80211_EXTRA_REGDB_KEYDIR\nnet/wireless/Kconfig-112-\tstring \"additional regdb key directory\" if CFG80211_CERTIFICATION_ONUS\n--\nnet/wireless/Kconfig-121-\nnet/wireless/Kconfig:122:config CFG80211_REG_CELLULAR_HINTS\nnet/wireless/Kconfig-123-\tbool \"cfg80211 regulatory support for cellular base station hints\"\n--\nnet/wireless/Kconfig-134-\nnet/wireless/Kconfig:135:config CFG80211_REG_RELAX_NO_IR\nnet/wireless/Kconfig-136-\tbool \"cfg80211 support for NO_IR relaxation\"\n--\nnet/wireless/Kconfig-158-\nnet/wireless/Kconfig:159:config CFG80211_DEFAULT_PS\nnet/wireless/Kconfig-160-\tbool \"enable powersave by default\"\n--\nnet/wireless/Kconfig-168-\nnet/wireless/Kconfig:169:config CFG80211_DEBUGFS\nnet/wireless/Kconfig-170-\tbool \"cfg80211 DebugFS entries\"\n--\nnet/wireless/Kconfig-176-\nnet/wireless/Kconfig:177:config CFG80211_CRDA_SUPPORT\nnet/wireless/Kconfig-178-\tbool \"support CRDA\" if EXPERT\n--\nnet/wireless/Kconfig-186-\nnet/wireless/Kconfig:187:config CFG80211_WEXT\nnet/wireless/Kconfig-188-\tbool \"cfg80211 wireless extensions compatibility\"\n--\nnet/wireless/Kconfig-193-\nnet/wireless/Kconfig:194:config CFG80211_KUNIT_TEST\nnet/wireless/Kconfig-195-\ttristate \"KUnit tests for cfg80211\" if !KUNIT_ALL_TESTS\n"
} |
| 11/2 | 2026/07/15 23:05 | llm | patch-evaluator |
0mModel:gemini-3.1-pro-preview Args: null Results: null Tokens: input: 11414 output: 219 thoughts: 549 Thoughts: **My Analysis of the Target Code** Okay, so I'm looking at this patch and immediately the two core configs jump out: `CFG80211` and `MAC80211`. Now, let's break down the functions involved and their context. `validate_uhr_operation` resides in `net/wireless/nl80211.c`, which, as we know, is part of `CFG80211`. Meanwhile, `ieee80211_parse_extension_element` is in `net/mac80211/parse.c` and `ieee80211_config_bw` is in `net/mac80211/mlme.c`, both firmly within `MAC80211`. The initial functions I'm focusing on, then, are `validate_uhr_operation`, `ieee80211_parse_extension_element`, and `ieee80211_config_bw`. I should double-check to make sure there aren't any other functions involved. Ah, right, there's `ieee80211_uhr_oper_size_ok`, which is an inline function. This patch modifies that, and its callers. The callers of `ieee80211_uhr_oper_size_ok` are `ieee80211_config_bw`, `ieee80211_parse_extension_element`, and `validate_uhr_operation`. I remember I grepped the codebase earlier, so I should be confident that those are indeed all the callers. Next, I need to understand the reachability of these functions. `validate_uhr_operation` is accessible from user space, because it's a netlink policy validation function for `NL80211_ATTR_UHR_OPERATION`. That's a good target. `ieee80211_parse_extension_element` is a parser for management frames – beacons, probe responses, that sort of thing. `ieee80211_config_bw`, on the other hand, comes into play during association or channel switches, so that's interesting too. Given all this, this is definitely prime fuzzing material. It has user-space reachability and various potentially interesting inputs. The key configs are clearly `CFG80211`, `MAC80211`, and, for good measure and thorough testing, `MAC80211_HWSIM` to allow for software-based hardware simulation. I'll need to focus on these symbols: `validate_uhr_operation`, `ieee80211_parse_extension_element`, and `ieee80211_config_bw`. Now, let me get these results ready. |
| 12/2 | 2026/07/15 23:05 | tool | set-results |
0mArgs:{
"EnableConfigs": [
"CFG80211",
"MAC80211",
"MAC80211_HWSIM"
],
"FocusSymbols": [
"validate_uhr_operation",
"ieee80211_parse_extension_element",
"ieee80211_config_bw"
],
"Reasoning": "The patch modifies the parsing and validation logic for IEEE 802.11 UHR (Ultra High Reliability) operation elements. It changes the size validation logic by checking for presence flags instead of enable flags. The modified inline function is called from netlink attribute validation (`validate_uhr_operation`), management frame parsing (`ieee80211_parse_extension_element`), and bandwidth configuration (`ieee80211_config_bw`). These are reachable from user space via netlink and from injected management frames, making it highly relevant for fuzzing.",
"WorthFuzzing": true
}Results: {
"EnableConfigs": [
"CFG80211",
"MAC80211",
"MAC80211_HWSIM"
],
"FocusSymbols": [
"validate_uhr_operation",
"ieee80211_parse_extension_element",
"ieee80211_config_bw"
],
"Reasoning": "The patch modifies the parsing and validation logic for IEEE 802.11 UHR (Ultra High Reliability) operation elements. It changes the size validation logic by checking for presence flags instead of enable flags. The modified inline function is called from netlink attribute validation (`validate_uhr_operation`), management frame parsing (`ieee80211_parse_extension_element`), and bandwidth configuration (`ieee80211_config_bw`). These are reachable from user space via netlink and from injected management frames, making it highly relevant for fuzzing.",
"WorthFuzzing": true
} |
| Total Calls | Total Tokens | Avg Tokens | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|
| Total Calls | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|