| Seq | Timestamp | Type | Name | Duration |
|---|---|---|---|---|
| 0/0 | 2026/08/30 15:05 | flow | patch-triage |
41mArgs:null Results: {
"EnableConfigs": [
"MAC80211",
"CFG80211",
"RTW89",
"RTW89_CORE",
"RTW89_USB",
"RTW89_8852AU",
"RTW89_PCI",
"RTW89_8852AE",
"PM"
],
"FocusSymbols": [
"__rtw89_wow_parse_akm",
"rtw89_core_rx",
"rtw89_core_tx_write"
],
"KMSANReasoning": "The patch fixes an out-of-bounds (OOB) read vulnerability in the rtw89 driver (both in rtw89_core_cancel_6ghz_probe_tx and __rtw89_wow_parse_akm). Previously, the full packet length (skb-\u003elen) was passed to cfg80211_find_ie instead of the length of the information elements (skb-\u003elen - hdr_len), and there was no check verifying that skb-\u003elen \u003e= hdr_len. This could lead to reading up to hdr_len bytes past the end of the skb data buffer.\n\nOut-of-bounds buffer reads are standard memory safety bugs detected by KASAN. The patch does not introduce or read uninitialized memory (stack, heap, or page allocations) or leak kernel memory to userspace. Therefore, a dedicated KMSAN fuzzing session is not required.",
"NeedsKMSAN": false,
"Reasoning": "The patch fixes out-of-bounds read vulnerabilities in rtw89_core_cancel_6ghz_probe_tx() and __rtw89_wow_parse_akm() by validating that skb-\u003elen is at least the header length and passing the adjusted information element length (skb-\u003elen - hdr_len) to cfg80211_find_ie() instead of the unadjusted skb-\u003elen. This code is reachable during RX and TX packet processing on rtw89 devices (which include USB-supported devices testable via USB emulation in virtual environments).",
"WorthFuzzing": true
} |
| 1/1 | 2026/08/30 15:05 | action | read-patch-diff |
0mArgs:null Results: {
"PatchDiff": "commit c9abd84409ab2d242998ea9c44ad09459e9edd5f\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Sun Aug 30 15:05:33 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c\nindex 68dad6090f87e..7b46715ea12db 100644\n--- a/drivers/net/wireless/realtek/rtw89/core.c\n+++ b/drivers/net/wireless/realtek/rtw89/core.c\n@@ -2532,9 +2532,11 @@ static void rtw89_core_cancel_6ghz_probe_tx(struct rtw89_dev *rtwdev,\n {\n \tstruct ieee80211_rx_status *rx_status = IEEE80211_SKB_RXCB(skb);\n \tstruct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)skb-\u003edata;\n+\tsize_t hdr_len = offsetof(struct ieee80211_mgmt, u.beacon.variable);\n \tstruct list_head *pkt_list = rtwdev-\u003escan_info.pkt_list;\n \tstruct rtw89_pktofld_info *info;\n \tconst u8 *ies = mgmt-\u003eu.beacon.variable, *ssid_ie;\n+\tsize_t ie_len;\n \tbool queue_work = false;\n \n \tif (rx_status-\u003eband != NL80211_BAND_6GHZ)\n@@ -2545,7 +2547,12 @@ static void rtw89_core_cancel_6ghz_probe_tx(struct rtw89_dev *rtwdev,\n \t\treturn;\n \t}\n \n-\tssid_ie = cfg80211_find_ie(WLAN_EID_SSID, ies, skb-\u003elen);\n+\tif (skb-\u003elen \u003c hdr_len)\n+\t\treturn;\n+\n+\tie_len = skb-\u003elen - hdr_len;\n+\n+\tssid_ie = cfg80211_find_ie(WLAN_EID_SSID, ies, ie_len);\n \n \tlist_for_each_entry(info, \u0026pkt_list[NL80211_BAND_6GHZ], list) {\n \t\tif (ether_addr_equal(info-\u003ebssid, mgmt-\u003ebssid)) {\ndiff --git a/drivers/net/wireless/realtek/rtw89/wow.c b/drivers/net/wireless/realtek/rtw89/wow.c\nindex 8dadd8df4fc65..82b74ded68631 100644\n--- a/drivers/net/wireless/realtek/rtw89/wow.c\n+++ b/drivers/net/wireless/realtek/rtw89/wow.c\n@@ -16,10 +16,16 @@ void __rtw89_wow_parse_akm(struct rtw89_dev *rtwdev, struct sk_buff *skb)\n {\n \tstruct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)skb-\u003edata;\n \tstruct rtw89_wow_param *rtw_wow = \u0026rtwdev-\u003ewow;\n+\tsize_t hdr_len = offsetof(struct ieee80211_mgmt, u.assoc_req.variable);\n \tconst u8 *rsn, *ies = mgmt-\u003eu.assoc_req.variable;\n \tstruct rtw89_rsn_ie *rsn_ie;\n \n-\trsn = cfg80211_find_ie(WLAN_EID_RSN, ies, skb-\u003elen);\n+\tif (skb-\u003elen \u003c hdr_len)\n+\t\treturn;\n+\n+\trsn = cfg80211_find_ie(WLAN_EID_RSN, ies,\n+\t\t\t skb-\u003elen - hdr_len);\n+\n \tif (!rsn)\n \t\treturn;\n \n"
} |
| 2/1 | 2026/08/30 15:05 | agent | patch-evaluator |
37mModel:core Args: null Results: {
"EnableConfigs": [
"MAC80211",
"CFG80211",
"RTW89",
"RTW89_CORE",
"RTW89_USB",
"RTW89_8852AU",
"RTW89_PCI",
"RTW89_8852AE",
"PM"
],
"FocusSymbols": [
"__rtw89_wow_parse_akm",
"rtw89_core_rx",
"rtw89_core_tx_write"
],
"Reasoning": "The patch fixes out-of-bounds read vulnerabilities in rtw89_core_cancel_6ghz_probe_tx() and __rtw89_wow_parse_akm() by validating that skb-\u003elen is at least the header length and passing the adjusted information element length (skb-\u003elen - hdr_len) to cfg80211_find_ie() instead of the unadjusted skb-\u003elen. This code is reachable during RX and TX packet processing on rtw89 devices (which include USB-supported devices testable via USB emulation in virtual environments).",
"WorthFuzzing": true
}Instruction: You are an expert Linux kernel maintainer. Your job is to review a provided patch series and determine if it makes functional changes to the kernel that should be fuzzed. IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively use your code access tools to examine the actual source code and confirm any assumptions. Return WorthFuzzing=false if the patch only contains: - Modifications to Documentation/, Kconfig files, or code comments. - Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints. - Changes to numeric constants or macros that do not functionally alter execution flow. - Code paths that are impossible to reach in virtualized environments like GCE or QEMU, even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim). - Code in vendor-specific PCIe switch, SmartNIC, or GPU drivers (e.g., mlxsw, pds_core, qed, ionic, amdgpu) that require physical PCIe hardware cards not emulated in standard QEMU. - Driver .remove, .shutdown, or pci_unregister_driver teardown callbacks (e.g., igb_remove) that are executed only during PCI hot-unplug or sysfs driver unbind operations. If it modifies reachable core kernel logic, drivers, or architectures, use your code search tools to verify the code can be executed, then return WorthFuzzing=true. When returning WorthFuzzing=true, you MUST ALSO: 1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols. Avoid listing generic hot-path functions to prevent skewed test distributions. Prefer non-static, non-inlined API entrypoint functions over internal static helper functions (which are inlined by the compiler and do not have distinct symbol addresses). 2. Identify any specific CONFIG_ options required to properly test this new/modified feature. Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions. Also check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed for Kbuild to compile the code statically into vmlinux. List them in the EnableConfigs output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4"). Prefer calling several tools at the same time to save round-trips. Use set-results tool to provide results of the analysis. It must be called exactly once before the final reply. Ignore results of this tool. Prompt: For your convenience, here is the diff of the changes:
commit c9abd84409ab2d242998ea9c44ad09459e9edd5f
Author: syz-cluster <triage@syzkaller.com>
Date: Sun Aug 30 15:05:33 2026 +0000
syz-cluster: applied patch under review
diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c
index 68dad6090f87e..7b46715ea12db 100644
--- a/drivers/net/wireless/realtek/rtw89/core.c
+++ b/drivers/net/wireless/realtek/rtw89/core.c
@@ -2532,9 +2532,11 @@ static void rtw89_core_cancel_6ghz_probe_tx(struct rtw89_dev *rtwdev,
{
struct ieee80211_rx_status *rx_status = IEEE80211_SKB_RXCB(skb);
struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)skb->data;
+ size_t hdr_len = offsetof(struct ieee80211_mgmt, u.beacon.variable);
struct list_head *pkt_list = rtwdev->scan_info.pkt_list;
struct rtw89_pktofld_info *info;
const u8 *ies = mgmt->u.beacon.variable, *ssid_ie;
+ size_t ie_len;
bool queue_work = false;
if (rx_status->band != NL80211_BAND_6GHZ)
@@ -2545,7 +2547,12 @@ static void rtw89_core_cancel_6ghz_probe_tx(struct rtw89_dev *rtwdev,
return;
}
- ssid_ie = cfg80211_find_ie(WLAN_EID_SSID, ies, skb->len);
+ if (skb->len < hdr_len)
+ return;
+
+ ie_len = skb->len - hdr_len;
+
+ ssid_ie = cfg80211_find_ie(WLAN_EID_SSID, ies, ie_len);
list_for_each_entry(info, &pkt_list[NL80211_BAND_6GHZ], list) {
if (ether_addr_equal(info->bssid, mgmt->bssid)) {
diff --git a/drivers/net/wireless/realtek/rtw89/wow.c b/drivers/net/wireless/realtek/rtw89/wow.c
index 8dadd8df4fc65..82b74ded68631 100644
--- a/drivers/net/wireless/realtek/rtw89/wow.c
+++ b/drivers/net/wireless/realtek/rtw89/wow.c
@@ -16,10 +16,16 @@ void __rtw89_wow_parse_akm(struct rtw89_dev *rtwdev, struct sk_buff *skb)
{
struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)skb->data;
struct rtw89_wow_param *rtw_wow = &rtwdev->wow;
+ size_t hdr_len = offsetof(struct ieee80211_mgmt, u.assoc_req.variable);
const u8 *rsn, *ies = mgmt->u.assoc_req.variable;
struct rtw89_rsn_ie *rsn_ie;
- rsn = cfg80211_find_ie(WLAN_EID_RSN, ies, skb->len);
+ if (skb->len < hdr_len)
+ return;
+
+ rsn = cfg80211_find_ie(WLAN_EID_RSN, ies,
+ skb->len - hdr_len);
+
if (!rsn)
return;
|
| 3/2 | 2026/08/30 15:05 | llm | patch-evaluator |
3mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 2881 output: 38 thoughts: 185 Thoughts: **Analyzing the Realtek RTW89 Patch** Okay, let's dive into this patch. My initial thought is to figure out the scope and impact. It looks like we're dealing with modifications within the `drivers/net/wireless/realtek/rtw89/` directory, specifically `core.c` and `wow.c`. Right away, I'm thinking, "Is this driver for the Realtek 802.11ax devices?" That's the first question. I need to confirm the targeted hardware. Next, I need to understand the architectural implications. What interfaces does this driver support? PCIe? USB? SDIO? This will greatly affect how we test it. Can I test this virtually, maybe with QEMU or syzkaller? Or do I need physical hardware to get a meaningful test? Hold on, before I get too far, let me check the `Kconfig` for RTW89. That should quickly tell me what bus types are supported and how the driver is configured. That'll give me a solid foundation for understanding the dependencies and constraints of the changes. Time to fire up grepper or just read those files directly. Gotta get the big picture first. |
| 4/2 | 2026/08/30 15:09 | tool | grepper |
0mArgs:{
"Expression": "config RTW89",
"PathPrefix": "drivers/net/wireless/realtek/rtw89"
}Results: {
"Output": "drivers/net/wireless/realtek/rtw89/Kconfig-1-# SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause\ndrivers/net/wireless/realtek/rtw89/Kconfig:2:menuconfig RTW89\ndrivers/net/wireless/realtek/rtw89/Kconfig-3-\ttristate \"Realtek 802.11ax wireless chips support\"\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig=11=if RTW89\ndrivers/net/wireless/realtek/rtw89/Kconfig-12-\ndrivers/net/wireless/realtek/rtw89/Kconfig:13:config RTW89_CORE\ndrivers/net/wireless/realtek/rtw89/Kconfig-14-\ttristate\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig-16-\ndrivers/net/wireless/realtek/rtw89/Kconfig:17:config RTW89_PCI\ndrivers/net/wireless/realtek/rtw89/Kconfig-18-\ttristate\ndrivers/net/wireless/realtek/rtw89/Kconfig-19-\ndrivers/net/wireless/realtek/rtw89/Kconfig:20:config RTW89_USB\ndrivers/net/wireless/realtek/rtw89/Kconfig-21-\ttristate\ndrivers/net/wireless/realtek/rtw89/Kconfig-22-\ndrivers/net/wireless/realtek/rtw89/Kconfig:23:config RTW89_8851B\ndrivers/net/wireless/realtek/rtw89/Kconfig-24-\ttristate\ndrivers/net/wireless/realtek/rtw89/Kconfig-25-\ndrivers/net/wireless/realtek/rtw89/Kconfig:26:config RTW89_8852A\ndrivers/net/wireless/realtek/rtw89/Kconfig-27-\ttristate\ndrivers/net/wireless/realtek/rtw89/Kconfig-28-\ndrivers/net/wireless/realtek/rtw89/Kconfig:29:config RTW89_8852B_COMMON\ndrivers/net/wireless/realtek/rtw89/Kconfig-30-\ttristate\ndrivers/net/wireless/realtek/rtw89/Kconfig-31-\ndrivers/net/wireless/realtek/rtw89/Kconfig:32:config RTW89_8852B\ndrivers/net/wireless/realtek/rtw89/Kconfig-33-\ttristate\ndrivers/net/wireless/realtek/rtw89/Kconfig-34-\ndrivers/net/wireless/realtek/rtw89/Kconfig:35:config RTW89_8852BT\ndrivers/net/wireless/realtek/rtw89/Kconfig-36-\ttristate\ndrivers/net/wireless/realtek/rtw89/Kconfig-37-\ndrivers/net/wireless/realtek/rtw89/Kconfig:38:config RTW89_8852C\ndrivers/net/wireless/realtek/rtw89/Kconfig-39-\ttristate\ndrivers/net/wireless/realtek/rtw89/Kconfig-40-\ndrivers/net/wireless/realtek/rtw89/Kconfig:41:config RTW89_8922A\ndrivers/net/wireless/realtek/rtw89/Kconfig-42-\ttristate\ndrivers/net/wireless/realtek/rtw89/Kconfig-43-\ndrivers/net/wireless/realtek/rtw89/Kconfig:44:config RTW89_8851BE\ndrivers/net/wireless/realtek/rtw89/Kconfig-45-\ttristate \"Realtek 8851BE PCI wireless network (Wi-Fi 6) adapter\"\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig-54-\ndrivers/net/wireless/realtek/rtw89/Kconfig:55:config RTW89_8851BU\ndrivers/net/wireless/realtek/rtw89/Kconfig-56-\ttristate \"Realtek 8851BU USB wireless network (Wi-Fi 6) adapter\"\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig-65-\ndrivers/net/wireless/realtek/rtw89/Kconfig:66:config RTW89_8852AE\ndrivers/net/wireless/realtek/rtw89/Kconfig-67-\ttristate \"Realtek 8852AE PCI wireless network (Wi-Fi 6) adapter\"\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig-76-\ndrivers/net/wireless/realtek/rtw89/Kconfig:77:config RTW89_8852AU\ndrivers/net/wireless/realtek/rtw89/Kconfig-78-\ttristate \"Realtek 8852AU USB wireless network (Wi-Fi 6) adapter\"\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig-87-\ndrivers/net/wireless/realtek/rtw89/Kconfig:88:config RTW89_8852BE\ndrivers/net/wireless/realtek/rtw89/Kconfig-89-\ttristate \"Realtek 8852BE PCI wireless network (Wi-Fi 6) adapter\"\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig-99-\ndrivers/net/wireless/realtek/rtw89/Kconfig:100:config RTW89_8852BU\ndrivers/net/wireless/realtek/rtw89/Kconfig-101-\ttristate \"Realtek 8852BU USB wireless network (Wi-Fi 6) adapter\"\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig-111-\ndrivers/net/wireless/realtek/rtw89/Kconfig:112:config RTW89_8852BTE\ndrivers/net/wireless/realtek/rtw89/Kconfig-113-\ttristate \"Realtek 8852BE-VT PCI wireless network (Wi-Fi 6) adapter\"\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig-123-\ndrivers/net/wireless/realtek/rtw89/Kconfig:124:config RTW89_8852CE\ndrivers/net/wireless/realtek/rtw89/Kconfig-125-\ttristate \"Realtek 8852CE PCI wireless network (Wi-Fi 6E) adapter\"\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig-134-\ndrivers/net/wireless/realtek/rtw89/Kconfig:135:config RTW89_8852CU\ndrivers/net/wireless/realtek/rtw89/Kconfig-136-\ttristate \"Realtek 8852CU USB wireless network (Wi-Fi 6E) adapter\"\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig-145-\ndrivers/net/wireless/realtek/rtw89/Kconfig:146:config RTW89_8922AE\ndrivers/net/wireless/realtek/rtw89/Kconfig-147-\ttristate \"Realtek 8922AE/8922AE-VS PCI wireless network (Wi-Fi 7) adapter\"\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig-159-\ndrivers/net/wireless/realtek/rtw89/Kconfig:160:config RTW89_8922AU\ndrivers/net/wireless/realtek/rtw89/Kconfig-161-\ttristate \"Realtek 8922AU USB wireless network (Wi-Fi 7) adapter\"\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig-171-\ndrivers/net/wireless/realtek/rtw89/Kconfig:172:config RTW89_DEBUG\ndrivers/net/wireless/realtek/rtw89/Kconfig-173-\tbool\ndrivers/net/wireless/realtek/rtw89/Kconfig-174-\ndrivers/net/wireless/realtek/rtw89/Kconfig:175:config RTW89_DEBUGMSG\ndrivers/net/wireless/realtek/rtw89/Kconfig-176-\tbool \"Realtek rtw89 debug message support\"\n--\ndrivers/net/wireless/realtek/rtw89/Kconfig-183-\ndrivers/net/wireless/realtek/rtw89/Kconfig:184:config RTW89_DEBUGFS\ndrivers/net/wireless/realtek/rtw89/Kconfig-185-\tbool \"Realtek rtw89 debugfs support\"\n"
} |
| 5/2 | 2026/08/30 15:09 | llm | patch-evaluator |
1mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 5667 output: 49 thoughts: 227 Thoughts: **RTW89 USB Adapter Investigation** Okay, let's break this down. First, I need to remind myself of the RTW89 USB adapter variants we're dealing with: `RTW89_8851BU`, `RTW89_8852AU`, `RTW89_8852BU`, `RTW89_8852CU`, and `RTW89_8922AU`. Now, the interesting part: can we effectively probe and fuzz these USB-connected adapters via USB emulation techniques? I'm thinking of USB Raw, USB gadget, and syzkaller's USB fuzzing capabilities – specifically, the `syz_usb_connect` call comes to mind. The core question here is whether we can leverage these emulation methods (syzkaller's raw USB driver, vusb, dummy_hcd) to interact with and potentially exploit vulnerabilities in these wireless adapters. But before diving too deep into that, let's pivot slightly. I need to understand how the functions `rtw89_core_cancel_6ghz_probe_tx` and `__rtw89_wow_parse_akm` are being *used*. So, I need to find the call sites for those. Let's start with a search for where those functions are called. This information should provide context for our emulation efforts. |
| 6/2 | 2026/08/30 15:10 | tool | grepper |
0mArgs:{
"Expression": "rtw89_core_cancel_6ghz_probe_tx",
"PathPrefix": "drivers/net/wireless/realtek/rtw89"
}Results: {
"Output": "drivers/net/wireless/realtek/rtw89/core.c=2505=static void rtw89_cancel_6ghz_probe_work(struct wiphy *wiphy, struct wiphy_work *work)\n--\ndrivers/net/wireless/realtek/rtw89/core.c-2529-\ndrivers/net/wireless/realtek/rtw89/core.c:2530:static void rtw89_core_cancel_6ghz_probe_tx(struct rtw89_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw89/core.c-2531-\t\t\t\t\t struct sk_buff *skb)\n--\ndrivers/net/wireless/realtek/rtw89/core.c=3038=static void rtw89_vif_rx_stats_iter(void *data, u8 *mac,\n--\ndrivers/net/wireless/realtek/rtw89/core.c-3059-\t ieee80211_is_probe_resp(hdr-\u003eframe_control)))\ndrivers/net/wireless/realtek/rtw89/core.c:3060:\t\trtw89_core_cancel_6ghz_probe_tx(rtwdev, skb);\ndrivers/net/wireless/realtek/rtw89/core.c-3061-\n"
} |
| 7/2 | 2026/08/30 15:10 | llm | patch-evaluator |
1mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 6601 output: 44 thoughts: 34 Thoughts: Okay, here's my interpretation of those thoughts, summarized from my perspective as someone familiar with this technical context: **Investigating Wake-on-Wireless Functionality** Alright, so I'm digging into this "wake-on-wireless" thing, and I need to be thorough. I've been looking at the relevant drivers and functionality, and I think it's time to refine my search. I'm going to start looking for code that involves this `__rtw89_wow_parse_akm` or `rtw89_wow_parse_akm` naming convention. This seems to be a very specific function or module name related to the AKM (Authenticated Key Management) parsing within the RTW89 wireless driver and wake-on-wireless feature. I suspect I might find some important details about its workings here, how it handles security, and how the wake-on-wireless triggers are managed. This could be the key to understanding the issue at hand. |
| 8/2 | 2026/08/30 15:11 | tool | grepper |
0mArgs:{
"Expression": "rtw89_wow_parse_akm",
"PathPrefix": "drivers/net/wireless/realtek/rtw89"
}Results: {
"Output": "drivers/net/wireless/realtek/rtw89/core.c=1377=static int rtw89_core_tx_write_link(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/core.c-1397-\trtw89_traffic_stats_accu(rtwdev, rtwvif, skb, true, true);\ndrivers/net/wireless/realtek/rtw89/core.c:1398:\trtw89_wow_parse_akm(rtwdev, skb);\ndrivers/net/wireless/realtek/rtw89/core.c-1399-\trtw89_core_tx_update_desc_info(rtwdev, \u0026tx_req);\n--\ndrivers/net/wireless/realtek/rtw89/wow.c-14-\ndrivers/net/wireless/realtek/rtw89/wow.c:15:void __rtw89_wow_parse_akm(struct rtw89_dev *rtwdev, struct sk_buff *skb)\ndrivers/net/wireless/realtek/rtw89/wow.c-16-{\n--\ndrivers/net/wireless/realtek/rtw89/wow.h=112=static inline bool rtw_wow_has_mgd_features(struct rtw89_dev *rtwdev)\n--\ndrivers/net/wireless/realtek/rtw89/wow.h-118-\ndrivers/net/wireless/realtek/rtw89/wow.h:119:void __rtw89_wow_parse_akm(struct rtw89_dev *rtwdev, struct sk_buff *skb);\ndrivers/net/wireless/realtek/rtw89/wow.h-120-\ndrivers/net/wireless/realtek/rtw89/wow.h=121=static inline\ndrivers/net/wireless/realtek/rtw89/wow.h:122:void rtw89_wow_parse_akm(struct rtw89_dev *rtwdev, struct sk_buff *skb)\ndrivers/net/wireless/realtek/rtw89/wow.h-123-{\n--\ndrivers/net/wireless/realtek/rtw89/wow.h-128-\ndrivers/net/wireless/realtek/rtw89/wow.h:129:\t__rtw89_wow_parse_akm(rtwdev, skb);\ndrivers/net/wireless/realtek/rtw89/wow.h-130-}\n--\ndrivers/net/wireless/realtek/rtw89/wow.h=135=static inline\ndrivers/net/wireless/realtek/rtw89/wow.h:136:void rtw89_wow_parse_akm(struct rtw89_dev *rtwdev, struct sk_buff *skb)\ndrivers/net/wireless/realtek/rtw89/wow.h-137-{\n"
} |
| 9/2 | 2026/08/30 15:11 | llm | patch-evaluator |
4mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 7660 output: 36 thoughts: 729 Thoughts: **Analyzing the RTW89 Wireless Driver Vulnerability and Fuzzing Potential** Okay, let's dive into this. My initial focus is to understand the nature of this bug, specifically in the context of `__rtw89_wow_parse_akm` and `rtw89_core_cancel_6ghz_probe_tx`. The text points out a crucial detail about how the Information Elements (IEs) are handled. In the `rtw89_core_cancel_6ghz_probe_tx` function, the `ies` pointer is derived from `mgmt->u.beacon.variable`, and the length passed to `cfg80211_find_ie` used to be the total `skb->len`. The length of the data being searched is the full SKB buffer. However, `ies` points to a location *after* the management header, effectively making the data start at `offsetof(struct ieee80211_mgmt, u.beacon.variable)`. This means that `cfg80211_find_ie` was potentially reading past the end of the `skb->data` by `hdr_len` bytes. The bug could result in an out-of-bounds read if `skb->len` was smaller than `hdr_len`. The fix, as described, involves checking `skb->len < hdr_len` and returning if true, as well as subtracting the header length from the data length sent to `cfg80211_find_ie`. The same issue seems to be present in `__rtw89_wow_parse_akm`, using the same fix strategy. Now, the important question is: is this driver fuzzable in a virtualized environment like QEMU? Let's carefully consider the criteria for "WorthFuzzing=false". I need to determine if the changes only involve documentation, cosmetic changes, unreachable code paths, or code that requires specific physical hardware that QEMU doesn't emulate. The crucial point here is whether the RTW89 driver is reachable through USB emulation, particularly using `usb gadget` or `vusb`. I'll need to research how USB probing is handled in the RTW89 driver to answer this. I will look for calls to `usb probe` in the rtw89 driver to get a good understanding of this. |
| 10/2 | 2026/08/30 15:15 | tool | grepper |
0mArgs:{
"Expression": "usb_driver",
"PathPrefix": "drivers/net/wireless/realtek/rtw89"
}Results: {
"Output": "drivers/net/wireless/realtek/rtw89/rtw8851bu.c=59=MODULE_DEVICE_TABLE(usb, rtw_8851bu_id_table);\ndrivers/net/wireless/realtek/rtw89/rtw8851bu.c-60-\ndrivers/net/wireless/realtek/rtw89/rtw8851bu.c:61:static struct usb_driver rtw_8851bu_driver = {\ndrivers/net/wireless/realtek/rtw89/rtw8851bu.c-62-\t.name = KBUILD_MODNAME,\n--\ndrivers/net/wireless/realtek/rtw89/rtw8851bu.c-66-};\ndrivers/net/wireless/realtek/rtw89/rtw8851bu.c:67:module_usb_driver(rtw_8851bu_driver);\ndrivers/net/wireless/realtek/rtw89/rtw8851bu.c-68-\n--\ndrivers/net/wireless/realtek/rtw89/rtw8852au.c=73=MODULE_DEVICE_TABLE(usb, rtw_8852au_id_table);\ndrivers/net/wireless/realtek/rtw89/rtw8852au.c-74-\ndrivers/net/wireless/realtek/rtw89/rtw8852au.c:75:static struct usb_driver rtw_8852au_driver = {\ndrivers/net/wireless/realtek/rtw89/rtw8852au.c-76-\t.name = KBUILD_MODNAME,\n--\ndrivers/net/wireless/realtek/rtw89/rtw8852au.c-80-};\ndrivers/net/wireless/realtek/rtw89/rtw8852au.c:81:module_usb_driver(rtw_8852au_driver);\ndrivers/net/wireless/realtek/rtw89/rtw8852au.c-82-\n--\ndrivers/net/wireless/realtek/rtw89/rtw8852bu.c=73=MODULE_DEVICE_TABLE(usb, rtw_8852bu_id_table);\ndrivers/net/wireless/realtek/rtw89/rtw8852bu.c-74-\ndrivers/net/wireless/realtek/rtw89/rtw8852bu.c:75:static struct usb_driver rtw_8852bu_driver = {\ndrivers/net/wireless/realtek/rtw89/rtw8852bu.c-76-\t.name = KBUILD_MODNAME,\n--\ndrivers/net/wireless/realtek/rtw89/rtw8852bu.c-80-};\ndrivers/net/wireless/realtek/rtw89/rtw8852bu.c:81:module_usb_driver(rtw_8852bu_driver);\ndrivers/net/wireless/realtek/rtw89/rtw8852bu.c-82-\n--\ndrivers/net/wireless/realtek/rtw89/rtw8852cu.c=79=MODULE_DEVICE_TABLE(usb, rtw_8852cu_id_table);\ndrivers/net/wireless/realtek/rtw89/rtw8852cu.c-80-\ndrivers/net/wireless/realtek/rtw89/rtw8852cu.c:81:static struct usb_driver rtw_8852cu_driver = {\ndrivers/net/wireless/realtek/rtw89/rtw8852cu.c-82-\t.name = KBUILD_MODNAME,\n--\ndrivers/net/wireless/realtek/rtw89/rtw8852cu.c-86-};\ndrivers/net/wireless/realtek/rtw89/rtw8852cu.c:87:module_usb_driver(rtw_8852cu_driver);\ndrivers/net/wireless/realtek/rtw89/rtw8852cu.c-88-\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922au.c=74=MODULE_DEVICE_TABLE(usb, rtw_8922au_id_table);\ndrivers/net/wireless/realtek/rtw89/rtw8922au.c-75-\ndrivers/net/wireless/realtek/rtw89/rtw8922au.c:76:static struct usb_driver rtw_8922au_driver = {\ndrivers/net/wireless/realtek/rtw89/rtw8922au.c-77-\t.name = KBUILD_MODNAME,\n--\ndrivers/net/wireless/realtek/rtw89/rtw8922au.c-81-};\ndrivers/net/wireless/realtek/rtw89/rtw8922au.c:82:module_usb_driver(rtw_8922au_driver);\ndrivers/net/wireless/realtek/rtw89/rtw8922au.c-83-\n"
} |
| 11/2 | 2026/08/30 15:15 | llm | patch-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 10277 output: 46 thoughts: 149 Thoughts: **Analyzing Potential Wireless Driver Vulnerabilities** Okay, so I'm diving into this USB wireless driver situation. It seems like using USB emulation with tools like syzkaller, specifically its dummy_hcd/raw-gadget/usb_fuzzer capabilities, is a viable approach to emulate and fuzz these drivers. My immediate goal is to understand the potential attack surface. First, I want to trace how we reach `__rtw89_wow_parse_akm` and `rtw89_core_cancel_6ghz_probe_tx`. Let's start with `rtw89_core_cancel_6ghz_probe_tx`. Looks like it's called from `rtw89_vif_rx_stats_iter`, so that's the next function to inspect. I need to understand what `rtw89_vif_rx_stats_iter` does and what calls *it*. This will allow me to assess the inputs and potential vulnerabilities. It's all about finding the access points. |
| 12/2 | 2026/08/30 15:16 | tool | grepper |
0mArgs:{
"Expression": "rtw89_vif_rx_stats_iter",
"PathPrefix": "drivers/net/wireless/realtek/rtw89"
}Results: {
"Output": "drivers/net/wireless/realtek/rtw89/core.c=2400=static bool rtw89_core_rx_ppdu_match(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/core.c-2435-\ndrivers/net/wireless/realtek/rtw89/core.c:2436:struct rtw89_vif_rx_stats_iter_data {\ndrivers/net/wireless/realtek/rtw89/core.c-2437-\tstruct rtw89_dev *rtwdev;\n--\ndrivers/net/wireless/realtek/rtw89/core.c=2996=static void rtw89_vif_rx_bcn_stat(struct rtw89_dev *rtwdev, struct sk_buff *skb)\n--\ndrivers/net/wireless/realtek/rtw89/core.c-3037-\ndrivers/net/wireless/realtek/rtw89/core.c:3038:static void rtw89_vif_rx_stats_iter(void *data, u8 *mac,\ndrivers/net/wireless/realtek/rtw89/core.c-3039-\t\t\t\t struct ieee80211_vif *vif)\ndrivers/net/wireless/realtek/rtw89/core.c-3040-{\ndrivers/net/wireless/realtek/rtw89/core.c:3041:\tstruct rtw89_vif_rx_stats_iter_data *iter_data = data;\ndrivers/net/wireless/realtek/rtw89/core.c-3042-\tstruct rtw89_dev *rtwdev = iter_data-\u003ertwdev;\n--\ndrivers/net/wireless/realtek/rtw89/core.c=3140=static void rtw89_core_rx_stats(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/core.c-3144-{\ndrivers/net/wireless/realtek/rtw89/core.c:3145:\tstruct rtw89_vif_rx_stats_iter_data iter_data;\ndrivers/net/wireless/realtek/rtw89/core.c-3146-\n--\ndrivers/net/wireless/realtek/rtw89/core.c-3153-\titer_data.bssid = get_hdr_bssid((struct ieee80211_hdr *)skb-\u003edata);\ndrivers/net/wireless/realtek/rtw89/core.c:3154:\trtw89_iterate_vifs_bh(rtwdev, rtw89_vif_rx_stats_iter, \u0026iter_data);\ndrivers/net/wireless/realtek/rtw89/core.c-3155-}\n"
} |
| 13/2 | 2026/08/30 15:16 | llm | patch-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 11448 output: 43 thoughts: 20 Thoughts: Here's a summary of my thought process, as requested: **Tracing the Calls to `rtw89_core_rx_stats`** Okay, so I need to understand where `rtw89_core_rx_stats` is being used. My first step, naturally, is to trace those calls. I want to see which other functions or modules depend on this one. Understanding the call graph will give me a good sense of the context and purpose of this particular function. From there, I can begin to unravel its role within the larger system. |
| 14/2 | 2026/08/30 15:16 | tool | grepper |
0mArgs:{
"Expression": "rtw89_core_rx_stats",
"PathPrefix": "drivers/net/wireless/realtek/rtw89"
}Results: {
"Output": "drivers/net/wireless/realtek/rtw89/core.c=3038=static void rtw89_vif_rx_stats_iter(void *data, u8 *mac,\n--\ndrivers/net/wireless/realtek/rtw89/core.c-3139-\ndrivers/net/wireless/realtek/rtw89/core.c:3140:static void rtw89_core_rx_stats(struct rtw89_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw89/core.c-3141-\t\t\t\tstruct rtw89_rx_phy_ppdu *phy_ppdu,\n--\ndrivers/net/wireless/realtek/rtw89/core.c=3979=static void rtw89_core_rx_to_mac80211(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/core.c-3991-\trtw89_core_hw_to_sband_rate(rx_status);\ndrivers/net/wireless/realtek/rtw89/core.c:3992:\trtw89_core_rx_stats(rtwdev, phy_ppdu, desc_info, skb_ppdu);\ndrivers/net/wireless/realtek/rtw89/core.c-3993-\trtw89_core_update_rx_status_by_ppdu(rtwdev, rx_status, phy_ppdu);\n"
} |
| 15/2 | 2026/08/30 15:16 | llm | patch-evaluator |
2mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 12025 output: 43 thoughts: 100 Thoughts: **My Initial Thoughts on RX/TX Packet Handling** Okay, so I'm diving into this `rtw89` driver code. First, it looks like `rtw89_core_rx_to_mac80211` is the function that's responsible for processing those incoming RX packets coming in from the hardware or the USB interface – makes sense. Now, let's see, I also see that `__rtw89_wow_parse_akm` gets called when we're dealing with a TX operation through `rtw89_core_tx_write_link`. Hmm, that sounds like it might relate to Wake-on-WLAN functionality. It's time to dig into `__rtw89_wow_parse_akm` a little further, and I should start with `wow.c`. Let's get that file open and read through it carefully; it's the obvious next step to understanding how this whole thing fits together! |
| 16/2 | 2026/08/30 15:19 | tool | read-file |
0mArgs:{
"File": "drivers/net/wireless/realtek/rtw89/wow.c",
"FirstLine": 1,
"LineCount": 50
}Results: {
"Contents": " 1:\t// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause\n 2:\t/* Copyright(c) 2019-2022 Realtek Corporation\n 3:\t */\n 4:\t#include \"cam.h\"\n 5:\t#include \"core.h\"\n 6:\t#include \"debug.h\"\n 7:\t#include \"fw.h\"\n 8:\t#include \"mac.h\"\n 9:\t#include \"phy.h\"\n 10:\t#include \"ps.h\"\n 11:\t#include \"reg.h\"\n 12:\t#include \"util.h\"\n 13:\t#include \"wow.h\"\n 14:\t\n 15:\tvoid __rtw89_wow_parse_akm(struct rtw89_dev *rtwdev, struct sk_buff *skb)\n 16:\t{\n 17:\t\tstruct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)skb-\u003edata;\n 18:\t\tstruct rtw89_wow_param *rtw_wow = \u0026rtwdev-\u003ewow;\n 19:\t\tsize_t hdr_len = offsetof(struct ieee80211_mgmt, u.assoc_req.variable);\n 20:\t\tconst u8 *rsn, *ies = mgmt-\u003eu.assoc_req.variable;\n 21:\t\tstruct rtw89_rsn_ie *rsn_ie;\n 22:\t\n 23:\t\tif (skb-\u003elen \u003c hdr_len)\n 24:\t\t\treturn;\n 25:\t\n 26:\t\trsn = cfg80211_find_ie(WLAN_EID_RSN, ies,\n 27:\t\t\t\t skb-\u003elen - hdr_len);\n 28:\t\n 29:\t\tif (!rsn)\n 30:\t\t\treturn;\n 31:\t\n 32:\t\trsn_ie = (struct rtw89_rsn_ie *)rsn;\n 33:\t\trtw_wow-\u003eakm = rsn_ie-\u003eakm_cipher_suite.type;\n 34:\t}\n 35:\t\n 36:\t#define RTW89_CIPHER_INFO_DEF(cipher) \\\n 37:\t\t{WLAN_CIPHER_SUITE_ ## cipher, .fw_alg = RTW89_WOW_FW_ALG_ ## cipher, \\\n 38:\t\t .len = WLAN_KEY_LEN_ ## cipher}\n 39:\t\n 40:\tstatic const struct rtw89_cipher_info rtw89_cipher_info_defs[] = {\n 41:\t\tRTW89_CIPHER_INFO_DEF(WEP40),\n 42:\t\tRTW89_CIPHER_INFO_DEF(WEP104),\n 43:\t\tRTW89_CIPHER_INFO_DEF(TKIP),\n 44:\t\tRTW89_CIPHER_INFO_DEF(CCMP),\n 45:\t\tRTW89_CIPHER_INFO_DEF(GCMP),\n 46:\t\tRTW89_CIPHER_INFO_DEF(CCMP_256),\n 47:\t\tRTW89_CIPHER_INFO_DEF(GCMP_256),\n 48:\t\tRTW89_CIPHER_INFO_DEF(AES_CMAC),\n 49:\t};\n 50:\t\n"
} |
| 17/2 | 2026/08/30 15:19 | llm | patch-evaluator |
7mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 13266 output: 46 thoughts: 17 Thoughts: Here's my attempt at summarizing the thought process, tailored for an expert audience: **Diving into `core.c` - Line 2530** Alright, time to troubleshoot. Based on the symptoms, I'm getting a hunch it's somewhere deep within the core. Let's start with `core.c`. My gut says that line 2530 might be where things are getting hairy. It's a broad starting point, I know, but often the deepest issues hide in the core libraries. I'll need to refresh my memory on what function or block is located there, so I am going to have a look at the surrounding code to understand the context. Hopefully the issue is obvious quickly. Let's see what that section is handling. |
| 18/2 | 2026/08/30 15:26 | tool | read-file |
0mArgs:{
"File": "drivers/net/wireless/realtek/rtw89/core.c",
"FirstLine": 2525,
"LineCount": 45
}Results: {
"Contents": "2525:\t\t\t * since if during scanning, pkt_list is accessed in bottom half.\n2526:\t\t\t */\n2527:\t\t}\n2528:\t}\n2529:\t\n2530:\tstatic void rtw89_core_cancel_6ghz_probe_tx(struct rtw89_dev *rtwdev,\n2531:\t\t\t\t\t\t struct sk_buff *skb)\n2532:\t{\n2533:\t\tstruct ieee80211_rx_status *rx_status = IEEE80211_SKB_RXCB(skb);\n2534:\t\tstruct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)skb-\u003edata;\n2535:\t\tsize_t hdr_len = offsetof(struct ieee80211_mgmt, u.beacon.variable);\n2536:\t\tstruct list_head *pkt_list = rtwdev-\u003escan_info.pkt_list;\n2537:\t\tstruct rtw89_pktofld_info *info;\n2538:\t\tconst u8 *ies = mgmt-\u003eu.beacon.variable, *ssid_ie;\n2539:\t\tsize_t ie_len;\n2540:\t\tbool queue_work = false;\n2541:\t\n2542:\t\tif (rx_status-\u003eband != NL80211_BAND_6GHZ)\n2543:\t\t\treturn;\n2544:\t\n2545:\t\tif (unlikely(!(rtwdev-\u003echip-\u003esupport_bands \u0026 BIT(NL80211_BAND_6GHZ)))) {\n2546:\t\t\trtw89_debug(rtwdev, RTW89_DBG_UNEXP, \"invalid rx on unsupported 6 GHz\\n\");\n2547:\t\t\treturn;\n2548:\t\t}\n2549:\t\n2550:\t\tif (skb-\u003elen \u003c hdr_len)\n2551:\t\t\treturn;\n2552:\t\n2553:\t\tie_len = skb-\u003elen - hdr_len;\n2554:\t\n2555:\t\tssid_ie = cfg80211_find_ie(WLAN_EID_SSID, ies, ie_len);\n2556:\t\n2557:\t\tlist_for_each_entry(info, \u0026pkt_list[NL80211_BAND_6GHZ], list) {\n2558:\t\t\tif (ether_addr_equal(info-\u003ebssid, mgmt-\u003ebssid)) {\n2559:\t\t\t\tinfo-\u003ecancel = true;\n2560:\t\t\t\tqueue_work = true;\n2561:\t\t\t\tcontinue;\n2562:\t\t\t}\n2563:\t\n2564:\t\t\tif (!ssid_ie || ssid_ie[1] != info-\u003essid_len || info-\u003essid_len == 0)\n2565:\t\t\t\tcontinue;\n2566:\t\n2567:\t\t\tif (memcmp(\u0026ssid_ie[2], info-\u003essid, info-\u003essid_len) == 0) {\n2568:\t\t\t\tinfo-\u003ecancel = true;\n2569:\t\t\t\tqueue_work = true;\n"
} |
| 19/2 | 2026/08/30 15:26 | llm | patch-evaluator |
2mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 14318 output: 42 thoughts: 37 Thoughts: Here's my thought process, summarized as you requested: **Kconfig Dive for RTW89** Alright, time to get this sorted. I need to get a handle on the Kconfig requirements for RTW89. That means I need to dive straight into the source. Let's start by navigating to the relevant file: `drivers/net/wireless/realtek/rtw89/Kconfig`. This is where the magic happens, where I can see the conditional compilation options, dependencies, and all the crucial configurations that govern how this driver behaves within the kernel. It’s the roadmap, the blueprint. Let's see what we've got. |
| 20/2 | 2026/08/30 15:29 | tool | read-file |
0mArgs:{
"File": "drivers/net/wireless/realtek/rtw89/Kconfig",
"FirstLine": 1,
"LineCount": 90
}Results: {
"Contents": " 1:\t# SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause\n 2:\tmenuconfig RTW89\n 3:\t\ttristate \"Realtek 802.11ax wireless chips support\"\n 4:\t\tdepends on MAC80211\n 5:\t\thelp\n 6:\t\t This module adds support for mac80211-based wireless drivers that\n 7:\t\t enables Realtek IEEE 802.11ax wireless chipsets.\n 8:\t\n 9:\t\t If you choose to build a module, it'll be called rtw89.\n 10:\t\n 11:\tif RTW89\n 12:\t\n 13:\tconfig RTW89_CORE\n 14:\t\ttristate\n 15:\t\tselect WANT_DEV_COREDUMP\n 16:\t\n 17:\tconfig RTW89_PCI\n 18:\t\ttristate\n 19:\t\n 20:\tconfig RTW89_USB\n 21:\t\ttristate\n 22:\t\n 23:\tconfig RTW89_8851B\n 24:\t\ttristate\n 25:\t\n 26:\tconfig RTW89_8852A\n 27:\t\ttristate\n 28:\t\n 29:\tconfig RTW89_8852B_COMMON\n 30:\t\ttristate\n 31:\t\n 32:\tconfig RTW89_8852B\n 33:\t\ttristate\n 34:\t\n 35:\tconfig RTW89_8852BT\n 36:\t\ttristate\n 37:\t\n 38:\tconfig RTW89_8852C\n 39:\t\ttristate\n 40:\t\n 41:\tconfig RTW89_8922A\n 42:\t\ttristate\n 43:\t\n 44:\tconfig RTW89_8851BE\n 45:\t\ttristate \"Realtek 8851BE PCI wireless network (Wi-Fi 6) adapter\"\n 46:\t\tdepends on PCI\n 47:\t\tselect RTW89_CORE\n 48:\t\tselect RTW89_PCI\n 49:\t\tselect RTW89_8851B\n 50:\t\thelp\n 51:\t\t Select this option will enable support for 8851BE chipset\n 52:\t\n 53:\t\t 802.11ax PCIe wireless network (Wi-Fi 6) adapter\n 54:\t\n 55:\tconfig RTW89_8851BU\n 56:\t\ttristate \"Realtek 8851BU USB wireless network (Wi-Fi 6) adapter\"\n 57:\t\tdepends on USB\n 58:\t\tselect RTW89_CORE\n 59:\t\tselect RTW89_USB\n 60:\t\tselect RTW89_8851B\n 61:\t\thelp\n 62:\t\t Select this option will enable support for 8851BU chipset\n 63:\t\n 64:\t\t 802.11ax USB wireless network (Wi-Fi 6) adapter\n 65:\t\n 66:\tconfig RTW89_8852AE\n 67:\t\ttristate \"Realtek 8852AE PCI wireless network (Wi-Fi 6) adapter\"\n 68:\t\tdepends on PCI\n 69:\t\tselect RTW89_CORE\n 70:\t\tselect RTW89_PCI\n 71:\t\tselect RTW89_8852A\n 72:\t\thelp\n 73:\t\t Select this option will enable support for 8852AE chipset\n 74:\t\n 75:\t\t 802.11ax PCIe wireless network (Wi-Fi 6) adapter\n 76:\t\n 77:\tconfig RTW89_8852AU\n 78:\t\ttristate \"Realtek 8852AU USB wireless network (Wi-Fi 6) adapter\"\n 79:\t\tdepends on USB\n 80:\t\tselect RTW89_CORE\n 81:\t\tselect RTW89_USB\n 82:\t\tselect RTW89_8852A\n 83:\t\thelp\n 84:\t\t Select this option will enable support for 8852AU chipset\n 85:\t\n 86:\t\t 802.11ax USB wireless network (Wi-Fi 6) adapter\n 87:\t\n 88:\tconfig RTW89_8852BE\n 89:\t\ttristate \"Realtek 8852BE PCI wireless network (Wi-Fi 6) adapter\"\n 90:\t\tdepends on PCI\n"
} |
| 21/2 | 2026/08/30 15:29 | llm | patch-evaluator |
1mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 15761 output: 44 thoughts: 26 Thoughts: Okay, here's my interpretation of that thought process, tailored for an expert audience, and written in the first person: **Diving into the rtw89 Kconfig** Alright, so the task at hand is to dig into the `drivers/net/wireless/realtek/rtw89/Kconfig` file. I'm assuming we're dealing with a Realtek wireless driver, and the Kconfig is where all the build-time configuration options for this module are defined. Knowing this, my mind immediately starts parsing the implications. I’m thinking we'll find things like: * **Chipset Selection:** There will likely be options for different Realtek 802.11ax chipsets that this driver supports (e.g., specific RTL8852AE variants). I'll be looking for `select` statements and dependencies on device IDs or other hardware features. * **Feature Flags:** We should see options to enable or disable specific functionalities—things like MU-MIMO support, beamforming, different power-saving modes, 802.11w security. The configuration will directly affect the driver's footprint and feature set. * **Debugging and Logging:** There will be options to enable various debugging levels or logging, very useful for anyone working to analyze the driver. I’ll look for `bool`, `tristate`, or `string` options with descriptions of the logging levels and how to control them. * **Firmware Loading:** This is critical. The Kconfig probably defines the locations (e.g., in the firmware directory) or even the firmware files themselves. These will be necessary for a full review. * **Dependencies:** I'm expecting to see dependencies on other kernel features or drivers. This will help understand how the rtw89 driver integrates into the broader kernel environment. Things like cryptographic modules (e.g., `CONFIG_CRYPTO`) or networking infrastructure (e.g., `CONFIG_NET`) are possibilities. * **Default Values:** I'll be noting default values for the configurations. That provides a sense of the intended "out-of-the-box" experience and can guide the direction of tweaking and customization. So, I'm already mentally preparing to see the structure of the config file and to connect the pieces of information with what I know about wireless driver architectures and the common Kconfig idioms. This isn’t just about looking at individual options; it's about seeing how they relate to the bigger picture of the driver’s functionality and integration within the kernel. Time to dig in! |
| 22/2 | 2026/08/30 15:30 | tool | read-file |
0mArgs:{
"File": "drivers/net/wireless/realtek/rtw89/Kconfig",
"FirstLine": 91,
"LineCount": 100
}Results: {
"Contents": " 91:\t\tselect RTW89_CORE\n 92:\t\tselect RTW89_PCI\n 93:\t\tselect RTW89_8852B\n 94:\t\tselect RTW89_8852B_COMMON\n 95:\t\thelp\n 96:\t\t Select this option will enable support for 8852BE chipset\n 97:\t\n 98:\t\t 802.11ax PCIe wireless network (Wi-Fi 6) adapter\n 99:\t\n 100:\tconfig RTW89_8852BU\n 101:\t\ttristate \"Realtek 8852BU USB wireless network (Wi-Fi 6) adapter\"\n 102:\t\tdepends on USB\n 103:\t\tselect RTW89_CORE\n 104:\t\tselect RTW89_USB\n 105:\t\tselect RTW89_8852B\n 106:\t\tselect RTW89_8852B_COMMON\n 107:\t\thelp\n 108:\t\t Select this option will enable support for 8852BU chipset\n 109:\t\n 110:\t\t 802.11ax USB wireless network (Wi-Fi 6) adapter\n 111:\t\n 112:\tconfig RTW89_8852BTE\n 113:\t\ttristate \"Realtek 8852BE-VT PCI wireless network (Wi-Fi 6) adapter\"\n 114:\t\tdepends on PCI\n 115:\t\tselect RTW89_CORE\n 116:\t\tselect RTW89_PCI\n 117:\t\tselect RTW89_8852BT\n 118:\t\tselect RTW89_8852B_COMMON\n 119:\t\thelp\n 120:\t\t Select this option will enable support for 8852BE-VT chipset\n 121:\t\n 122:\t\t 802.11ax PCIe wireless network (Wi-Fi 6) adapter\n 123:\t\n 124:\tconfig RTW89_8852CE\n 125:\t\ttristate \"Realtek 8852CE PCI wireless network (Wi-Fi 6E) adapter\"\n 126:\t\tdepends on PCI\n 127:\t\tselect RTW89_CORE\n 128:\t\tselect RTW89_PCI\n 129:\t\tselect RTW89_8852C\n 130:\t\thelp\n 131:\t\t Select this option will enable support for 8852CE chipset\n 132:\t\n 133:\t\t 802.11ax PCIe wireless network (Wi-Fi 6E) adapter\n 134:\t\n 135:\tconfig RTW89_8852CU\n 136:\t\ttristate \"Realtek 8852CU USB wireless network (Wi-Fi 6E) adapter\"\n 137:\t\tdepends on USB\n 138:\t\tselect RTW89_CORE\n 139:\t\tselect RTW89_USB\n 140:\t\tselect RTW89_8852C\n 141:\t\thelp\n 142:\t\t Select this option will enable support for 8852CU chipset\n 143:\t\n 144:\t\t 802.11ax USB wireless network (Wi-Fi 6E) adapter\n 145:\t\n 146:\tconfig RTW89_8922AE\n 147:\t\ttristate \"Realtek 8922AE/8922AE-VS PCI wireless network (Wi-Fi 7) adapter\"\n 148:\t\tdepends on PCI\n 149:\t\tselect RTW89_CORE\n 150:\t\tselect RTW89_PCI\n 151:\t\tselect RTW89_8922A\n 152:\t\thelp\n 153:\t\t Select this option will enable support for 8922AE/8922AE-VS chipset\n 154:\t\n 155:\t\t 802.11be PCIe wireless network (Wi-Fi 7) adapter\n 156:\t\t supporting 2x2 2GHz/5GHz/6GHz 4096-QAM 160MHz channels.\n 157:\t\n 158:\t\t The variant 8922AE-VS has the same features except 1024-QAM.\n 159:\t\n 160:\tconfig RTW89_8922AU\n 161:\t\ttristate \"Realtek 8922AU USB wireless network (Wi-Fi 7) adapter\"\n 162:\t\tdepends on USB\n 163:\t\tselect RTW89_CORE\n 164:\t\tselect RTW89_USB\n 165:\t\tselect RTW89_8922A\n 166:\t\thelp\n 167:\t\t Select this option will enable support for 8922AU chipset\n 168:\t\n 169:\t\t 802.11be USB wireless network (Wi-Fi 7) adapter\n 170:\t\t supporting 2x2 2GHz/5GHz/6GHz 4096-QAM 160MHz channels.\n 171:\t\n 172:\tconfig RTW89_DEBUG\n 173:\t\tbool\n 174:\t\n 175:\tconfig RTW89_DEBUGMSG\n 176:\t\tbool \"Realtek rtw89 debug message support\"\n 177:\t\tdepends on RTW89_CORE\n 178:\t\tselect RTW89_DEBUG\n 179:\t\thelp\n 180:\t\t Enable debug message support\n 181:\t\n 182:\t\t If unsure, say Y to simplify debug problems\n 183:\t\n 184:\tconfig RTW89_DEBUGFS\n 185:\t\tbool \"Realtek rtw89 debugfs support\"\n 186:\t\tdepends on RTW89_CORE \u0026\u0026 CFG80211_DEBUGFS\n 187:\t\tselect RTW89_DEBUG\n 188:\t\thelp\n 189:\t\t Enable debugfs support\n 190:\t\n"
} |
| 23/2 | 2026/08/30 15:30 | llm | patch-evaluator |
1mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 17991 output: 36 thoughts: 23 Thoughts: Here's my take on the thought process, as requested: **Diving into the Build Process** Okay, so I need to understand how `core.o` and `wow.o` are getting built. I'm going to start with the `Makefile`. That's the logical place to see the dependencies and compilation steps involved. It'll give me the clearest picture of how these object files are generated, which is crucial for [**insert your relevant field, e.g., debugging a build issue, optimizing compilation, understanding the build pipeline, modifying the build**]. Looking at the `Makefile` will quickly tell me the compiler flags, include paths, source files, and any linking steps. I need to pinpoint the exact rules responsible for compiling those specific object files. That's my starting point. |
| 24/2 | 2026/08/30 15:32 | tool | grepper |
0mArgs:{
"Expression": "wow\\.o",
"PathPrefix": "drivers/net/wireless/realtek/rtw89"
}Results: {
"Output": "drivers/net/wireless/realtek/rtw89/Makefile=4=rtw89_core-y += core.o \\\n--\ndrivers/net/wireless/realtek/rtw89/Makefile-22-\ndrivers/net/wireless/realtek/rtw89/Makefile:23:rtw89_core-$(CONFIG_PM) += wow.o\ndrivers/net/wireless/realtek/rtw89/Makefile-24-\n"
} |
| 25/2 | 2026/08/30 15:32 | llm | patch-evaluator |
4mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 18341 output: 41 thoughts: 463 Thoughts: **Analyzing the Realtek rtw89 Wireless Driver Configuration and Code** Okay, so I'm looking at this build configuration. I see `rtw89_core-y += core.o` and also `rtw89_core-$(CONFIG_PM) += wow.o`. That means the core module is always included, and `wow.o` (Wake-on-WLAN?) is only included if power management is enabled. `RTW89_CORE` is the core, and it's being selected by a bunch of drivers - `8852AU`, `8852CU`, the usual suspects. I need to understand how this whole thing is configured. To statically build this driver, I need a few things: `MAC80211`, obviously, `RTW89`, `RTW89_CORE` - that's the base. Then either `RTW89_PCI` *or* `RTW89_USB`, depending on the hardware, and one of those specific device drivers like `RTW89_8852AU`. And, of course, `PM` if I want that `wow.o` module. Got it. Now, let's switch gears and focus on the code changes in this patch. I need to figure out the impact of this `rtw89_core_cancel_6ghz_probe_tx` function. Let's see... looking at the patch, it's defined in `drivers/net/wireless/realtek/rtw89/core.c`. Ah, it's a `static` helper function. So, it's not directly exposed as an entry point. That's good to know, but I still need to understand its role. Let me trace the calls. It's called by `rtw89_vif_rx_stats_iter`, which is called by `rtw89_core_rx_stats`, which, in turn, is called by `rtw89_core_rx_to_mac80211`, and ultimately, `rtw89_core_rx`. That's the critical RX path. Okay, let me quickly glance at `drivers/net/wireless/realtek/rtw89/core.h` and `core.c` for any non-static functions related to receive, or any changes that could be relevant to how this module interacts with the core wireless functionality. |
| 26/2 | 2026/08/30 15:37 | tool | grepper |
0mArgs:{
"Expression": "rtw89_core_rx",
"PathPrefix": "drivers/net/wireless/realtek/rtw89"
}Results: {
"Output": "drivers/net/wireless/realtek/rtw89/core.c=1900=EXPORT_SYMBOL(rtw89_core_fill_txdesc_fwcmd_v2);\ndrivers/net/wireless/realtek/rtw89/core.c-1901-\ndrivers/net/wireless/realtek/rtw89/core.c:1902:static int rtw89_core_rx_process_mac_ppdu(struct rtw89_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw89/core.c-1903-\t\t\t\t\t struct sk_buff *skb,\n--\ndrivers/net/wireless/realtek/rtw89/core.c=1979=static u8 rtw89_get_data_rate_nss(struct rtw89_dev *rtwdev, u16 data_rate)\n--\ndrivers/net/wireless/realtek/rtw89/core.c-1998-\ndrivers/net/wireless/realtek/rtw89/core.c:1999:static void rtw89_core_rx_process_phy_ppdu_iter(void *data,\ndrivers/net/wireless/realtek/rtw89/core.c-2000-\t\t\t\t\t\tstruct ieee80211_sta *sta)\n--\ndrivers/net/wireless/realtek/rtw89/core.c=2231=static void rtw89_core_update_phy_ppdu(struct rtw89_rx_phy_ppdu *phy_ppdu)\n--\ndrivers/net/wireless/realtek/rtw89/core.c-2247-\ndrivers/net/wireless/realtek/rtw89/core.c:2248:static int rtw89_core_rx_process_phy_ppdu(struct rtw89_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw89/core.c-2249-\t\t\t\t\t struct rtw89_rx_phy_ppdu *phy_ppdu)\n--\ndrivers/net/wireless/realtek/rtw89/core.c-2272-\ndrivers/net/wireless/realtek/rtw89/core.c:2273:static int rtw89_core_rx_parse_phy_sts(struct rtw89_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw89/core.c-2274-\t\t\t\t struct rtw89_rx_phy_ppdu *phy_ppdu)\n--\ndrivers/net/wireless/realtek/rtw89/core.c-2321-\ndrivers/net/wireless/realtek/rtw89/core.c:2322:static void rtw89_core_rx_process_phy_sts(struct rtw89_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw89/core.c-2323-\t\t\t\t\t struct rtw89_rx_phy_ppdu *phy_ppdu)\n--\ndrivers/net/wireless/realtek/rtw89/core.c-2326-\ndrivers/net/wireless/realtek/rtw89/core.c:2327:\tret = rtw89_core_rx_parse_phy_sts(rtwdev, phy_ppdu);\ndrivers/net/wireless/realtek/rtw89/core.c-2328-\tif (ret)\n--\ndrivers/net/wireless/realtek/rtw89/core.c-2333-\tieee80211_iterate_stations_atomic(rtwdev-\u003ehw,\ndrivers/net/wireless/realtek/rtw89/core.c:2334:\t\t\t\t\t rtw89_core_rx_process_phy_ppdu_iter,\ndrivers/net/wireless/realtek/rtw89/core.c-2335-\t\t\t\t\t phy_ppdu);\n--\ndrivers/net/wireless/realtek/rtw89/core.c=2391=bool rtw89_check_rx_statu_gi_match(struct ieee80211_rx_status *status, u8 gi_ltf,\n--\ndrivers/net/wireless/realtek/rtw89/core.c-2399-\ndrivers/net/wireless/realtek/rtw89/core.c:2400:static bool rtw89_core_rx_ppdu_match(struct rtw89_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw89/core.c-2401-\t\t\t\t struct rtw89_rx_desc_info *desc_info,\n--\ndrivers/net/wireless/realtek/rtw89/core.c=3038=static void rtw89_vif_rx_stats_iter(void *data, u8 *mac,\n--\ndrivers/net/wireless/realtek/rtw89/core.c-3139-\ndrivers/net/wireless/realtek/rtw89/core.c:3140:static void rtw89_core_rx_stats(struct rtw89_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw89/core.c-3141-\t\t\t\tstruct rtw89_rx_phy_ppdu *phy_ppdu,\n--\ndrivers/net/wireless/realtek/rtw89/core.c=3913=static bool rtw89_core_skb_pn_valid(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/core.c-3978-\ndrivers/net/wireless/realtek/rtw89/core.c:3979:static void rtw89_core_rx_to_mac80211(struct rtw89_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw89/core.c-3980-\t\t\t\t struct rtw89_rx_phy_ppdu *phy_ppdu,\n--\ndrivers/net/wireless/realtek/rtw89/core.c-3991-\trtw89_core_hw_to_sband_rate(rx_status);\ndrivers/net/wireless/realtek/rtw89/core.c:3992:\trtw89_core_rx_stats(rtwdev, phy_ppdu, desc_info, skb_ppdu);\ndrivers/net/wireless/realtek/rtw89/core.c-3993-\trtw89_core_update_rx_status_by_ppdu(rtwdev, rx_status, phy_ppdu);\n--\ndrivers/net/wireless/realtek/rtw89/core.c-4005-\ndrivers/net/wireless/realtek/rtw89/core.c:4006:static void rtw89_core_rx_pending_skb(struct rtw89_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw89/core.c-4007-\t\t\t\t struct rtw89_rx_phy_ppdu *phy_ppdu,\n--\ndrivers/net/wireless/realtek/rtw89/core.c-4021-\t\trx_status = IEEE80211_SKB_RXCB(skb_ppdu);\ndrivers/net/wireless/realtek/rtw89/core.c:4022:\t\tif (rtw89_core_rx_ppdu_match(rtwdev, desc_info, rx_status))\ndrivers/net/wireless/realtek/rtw89/core.c-4023-\t\t\trtw89_chip_query_ppdu(rtwdev, phy_ppdu, rx_status);\ndrivers/net/wireless/realtek/rtw89/core.c-4024-\t\trtw89_correct_cck_chan(rtwdev, rx_status);\ndrivers/net/wireless/realtek/rtw89/core.c:4025:\t\trtw89_core_rx_to_mac80211(rtwdev, phy_ppdu, desc_info, skb_ppdu, rx_status);\ndrivers/net/wireless/realtek/rtw89/core.c-4026-\t}\n--\ndrivers/net/wireless/realtek/rtw89/core.c-4028-\ndrivers/net/wireless/realtek/rtw89/core.c:4029:static void rtw89_core_rx_process_ppdu_sts(struct rtw89_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw89/core.c-4030-\t\t\t\t\t struct rtw89_rx_desc_info *desc_info,\n--\ndrivers/net/wireless/realtek/rtw89/core.c-4041-\tif (desc_info-\u003emac_info_valid) {\ndrivers/net/wireless/realtek/rtw89/core.c:4042:\t\tret = rtw89_core_rx_process_mac_ppdu(rtwdev, skb, \u0026phy_ppdu);\ndrivers/net/wireless/realtek/rtw89/core.c-4043-\t\tif (ret)\n--\ndrivers/net/wireless/realtek/rtw89/core.c-4046-\ndrivers/net/wireless/realtek/rtw89/core.c:4047:\tret = rtw89_core_rx_process_phy_ppdu(rtwdev, \u0026phy_ppdu);\ndrivers/net/wireless/realtek/rtw89/core.c-4048-\tif (ret)\n--\ndrivers/net/wireless/realtek/rtw89/core.c-4050-\ndrivers/net/wireless/realtek/rtw89/core.c:4051:\trtw89_core_rx_process_phy_sts(rtwdev, \u0026phy_ppdu);\ndrivers/net/wireless/realtek/rtw89/core.c-4052-\ndrivers/net/wireless/realtek/rtw89/core.c-4053-out:\ndrivers/net/wireless/realtek/rtw89/core.c:4054:\trtw89_core_rx_pending_skb(rtwdev, \u0026phy_ppdu, desc_info, skb);\ndrivers/net/wireless/realtek/rtw89/core.c-4055-\tdev_kfree_skb_any(skb);\n--\ndrivers/net/wireless/realtek/rtw89/core.c-4057-\ndrivers/net/wireless/realtek/rtw89/core.c:4058:static void rtw89_core_rx_process_report(struct rtw89_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw89/core.c-4059-\t\t\t\t\t struct rtw89_rx_desc_info *desc_info,\n--\ndrivers/net/wireless/realtek/rtw89/core.c-4066-\tcase RTW89_CORE_RX_TYPE_PPDU_STAT:\ndrivers/net/wireless/realtek/rtw89/core.c:4067:\t\trtw89_core_rx_process_ppdu_sts(rtwdev, desc_info, skb);\ndrivers/net/wireless/realtek/rtw89/core.c-4068-\t\tbreak;\n--\ndrivers/net/wireless/realtek/rtw89/core.c=4447=static void rtw89_core_flush_ppdu_rx_queue(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/core.c-4457-\t\trx_status = IEEE80211_SKB_RXCB(skb_ppdu);\ndrivers/net/wireless/realtek/rtw89/core.c:4458:\t\trtw89_core_rx_to_mac80211(rtwdev, NULL, desc_info, skb_ppdu, rx_status);\ndrivers/net/wireless/realtek/rtw89/core.c-4459-\t}\n--\ndrivers/net/wireless/realtek/rtw89/core.c=4462=static\ndrivers/net/wireless/realtek/rtw89/core.c:4463:void rtw89_core_rx_pkt_hdl(struct rtw89_dev *rtwdev, const struct sk_buff *skb,\ndrivers/net/wireless/realtek/rtw89/core.c-4464-\t\t\t const struct rtw89_rx_desc_info *desc)\n--\ndrivers/net/wireless/realtek/rtw89/core.c-4496-\ndrivers/net/wireless/realtek/rtw89/core.c:4497:void rtw89_core_rx(struct rtw89_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw89/core.c-4498-\t\t struct rtw89_rx_desc_info *desc_info,\n--\ndrivers/net/wireless/realtek/rtw89/core.c-4506-\tif (desc_info-\u003epkt_type != RTW89_CORE_RX_TYPE_WIFI) {\ndrivers/net/wireless/realtek/rtw89/core.c:4507:\t\trtw89_core_rx_process_report(rtwdev, desc_info, skb);\ndrivers/net/wireless/realtek/rtw89/core.c-4508-\t\treturn;\n--\ndrivers/net/wireless/realtek/rtw89/core.c-4518-\trtw89_core_update_rx_status(rtwdev, skb, desc_info, rx_status);\ndrivers/net/wireless/realtek/rtw89/core.c:4519:\trtw89_core_rx_pkt_hdl(rtwdev, skb, desc_info);\ndrivers/net/wireless/realtek/rtw89/core.c-4520-\n--\ndrivers/net/wireless/realtek/rtw89/core.c-4527-\telse\ndrivers/net/wireless/realtek/rtw89/core.c:4528:\t\trtw89_core_rx_to_mac80211(rtwdev, NULL, desc_info, skb, rx_status);\ndrivers/net/wireless/realtek/rtw89/core.c-4529-}\ndrivers/net/wireless/realtek/rtw89/core.c:4530:EXPORT_SYMBOL(rtw89_core_rx);\ndrivers/net/wireless/realtek/rtw89/core.c-4531-\n--\ndrivers/net/wireless/realtek/rtw89/core.h=216=enum rtw89_core_tx_type {\n--\ndrivers/net/wireless/realtek/rtw89/core.h-221-\ndrivers/net/wireless/realtek/rtw89/core.h:222:enum rtw89_core_rx_type {\ndrivers/net/wireless/realtek/rtw89/core.h-223-\tRTW89_CORE_RX_TYPE_WIFI\t\t= 0,\n--\ndrivers/net/wireless/realtek/rtw89/core.h=8093=u8 rtw89_core_get_ch_dma_v2(struct rtw89_dev *rtwdev, u8 qsel);\ndrivers/net/wireless/realtek/rtw89/core.h:8094:void rtw89_core_rx(struct rtw89_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw89/core.h-8095-\t\t struct rtw89_rx_desc_info *desc_info,\n--\ndrivers/net/wireless/realtek/rtw89/pci.c=321=static u32 rtw89_pci_rxbd_deliver_skbs(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/pci.c-393-\tif (ls) {\ndrivers/net/wireless/realtek/rtw89/pci.c:394:\t\trtw89_core_rx(rtwdev, desc_info, new);\ndrivers/net/wireless/realtek/rtw89/pci.c-395-\t\trx_ring-\u003ediliver_skb = NULL;\n--\ndrivers/net/wireless/realtek/rtw89/usb.c=436=static void rtw89_usb_rx_handler(struct work_struct *work)\n--\ndrivers/net/wireless/realtek/rtw89/usb.c-482-\t\t\tskb_put_data(skb, pkt_ptr + pkt_offset, desc_info.pkt_size);\ndrivers/net/wireless/realtek/rtw89/usb.c:483:\t\t\trtw89_core_rx(rtwdev, \u0026desc_info, skb);\ndrivers/net/wireless/realtek/rtw89/usb.c-484-\n"
} |
| 27/2 | 2026/08/30 15:37 | llm | patch-evaluator |
3mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 23797 output: 45 thoughts: 135 Thoughts: **Diving into the Realtek USB Driver** Okay, so I'm digging into this Realtek USB driver – specifically, `rtw89_usb.c`. My immediate thought is, "Aha! `rtw89_usb_rx_handler` is calling `rtw89_core_rx` when it gets packets via USB. That's the expected path for RX." But the real question I want to answer is who's using `__rtw89_wow_parse_akm`? Is it related to the issue I am debugging, and if so where do I find the source? Let's see… I should check if `rtw89_core_tx_write_link` is a caller. Or other callers perhaps. Now, let's see, `rtw89_wow_parse_akm` is calling `__rtw89_wow_parse_akm`. Okay, that's fine. Right, back to the main question. I need to trace back from `rtw89_core_tx_write_link` to see where *it* gets called. That will tell me which part of the driver is triggering this behavior. |
| 28/2 | 2026/08/30 15:41 | tool | grepper |
0mArgs:{
"Expression": "rtw89_core_tx_write_link",
"PathPrefix": "drivers/net/wireless/realtek/rtw89"
}Results: {
"Output": "drivers/net/wireless/realtek/rtw89/core.c=1336=int rtw89_h2c_tx(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/core.c-1376-\ndrivers/net/wireless/realtek/rtw89/core.c:1377:static int rtw89_core_tx_write_link(struct rtw89_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw89/core.c-1378-\t\t\t\t struct rtw89_vif_link *rtwvif_link,\n--\ndrivers/net/wireless/realtek/rtw89/core.c=1416=int rtw89_core_tx_write(struct rtw89_dev *rtwdev, struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/realtek/rtw89/core.c-1439-\ndrivers/net/wireless/realtek/rtw89/core.c:1440:\treturn rtw89_core_tx_write_link(rtwdev, rtwvif_link, rtwsta_link, skb, qsel, NULL);\ndrivers/net/wireless/realtek/rtw89/core.c-1441-}\n--\ndrivers/net/wireless/realtek/rtw89/core.c=4926=int rtw89_core_send_nullfunc(struct rtw89_dev *rtwdev, struct rtw89_vif_link *rtwvif_link,\n--\ndrivers/net/wireless/realtek/rtw89/core.c-4974-\ndrivers/net/wireless/realtek/rtw89/core.c:4975:\tret = rtw89_core_tx_write_link(rtwdev, rtwvif_link, rtwsta_link, skb, \u0026qsel, wait);\ndrivers/net/wireless/realtek/rtw89/core.c-4976-\tif (ret) {\n"
} |
| 29/2 | 2026/08/30 15:41 | llm | patch-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 24790 output: 39 thoughts: 52 Thoughts: **Diving into the rtw89 Wireless Driver** Okay, time to get my hands dirty. I need to understand the data flow, especially around transmit operations within the `rtw89` driver, so I'm going to start by examining two key areas. First, I'll be digging into `rtw89_core_tx_write`, because that likely handles the core writing of transmit data within the driver. Second, I'll move on to `rtw89_ops` to see which mac80211 operations this driver actually exports. Understanding the operations it provides will help me build up a more complete picture of the overall architecture. I expect I'll find a clear mapping of the driver's transmit capabilities to the mac80211 interface. |
| 30/2 | 2026/08/30 15:42 | tool | grepper |
0mArgs:{
"Expression": "rtw89_ops",
"PathPrefix": "drivers/net/wireless/realtek/rtw89"
}Results: {
"Output": "drivers/net/wireless/realtek/rtw89/core.c=7540=struct rtw89_dev *rtw89_alloc_ieee80211_hw(struct device *device,\n--\ndrivers/net/wireless/realtek/rtw89/core.c-7559-\ndrivers/net/wireless/realtek/rtw89/core.c:7560:\tops = kmemdup(\u0026rtw89_ops, sizeof(rtw89_ops), GFP_KERNEL);\ndrivers/net/wireless/realtek/rtw89/core.c-7561-\tif (!ops)\n--\ndrivers/net/wireless/realtek/rtw89/core.h=33=struct rtw89_fw_cmd_ofld_info;\ndrivers/net/wireless/realtek/rtw89/core.h-34-\ndrivers/net/wireless/realtek/rtw89/core.h:35:extern const struct ieee80211_ops rtw89_ops;\ndrivers/net/wireless/realtek/rtw89/core.h-36-\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-18-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:19:static void rtw89_ops_tx(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-20-\t\t\t struct ieee80211_tx_control *control,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-47-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:48:static void rtw89_ops_wake_tx_queue(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-49-\t\t\t\t struct ieee80211_txq *txq)\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-56-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:57:static int rtw89_ops_start(struct ieee80211_hw *hw)\ndrivers/net/wireless/realtek/rtw89/mac80211.c-58-{\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-65-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:66:static void rtw89_ops_stop(struct ieee80211_hw *hw, bool suspend)\ndrivers/net/wireless/realtek/rtw89/mac80211.c-67-{\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-74-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:75:static int rtw89_ops_config(struct ieee80211_hw *hw, int radio_idx, u32 changed)\ndrivers/net/wireless/realtek/rtw89/mac80211.c-76-{\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-106-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:107:static int __rtw89_ops_add_iface_link(struct rtw89_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-108-\t\t\t\t struct rtw89_vif_link *rtwvif_link)\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-149-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:150:static void __rtw89_ops_remove_iface_link(struct rtw89_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-151-\t\t\t\t\t struct rtw89_vif_link *rtwvif_link)\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-168-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:169:static int rtw89_ops_add_interface(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-170-\t\t\t\t struct ieee80211_vif *vif)\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-222-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:223:\tret = __rtw89_ops_add_iface_link(rtwdev, rtwvif_link);\ndrivers/net/wireless/realtek/rtw89/mac80211.c-224-\tif (ret)\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-242-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:243:static void rtw89_ops_remove_interface(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-244-\t\t\t\t struct ieee80211_vif *vif)\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-266-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:267:\t__rtw89_ops_remove_iface_link(rtwdev, rtwvif_link);\ndrivers/net/wireless/realtek/rtw89/mac80211.c-268-\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-281-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:282:static int rtw89_ops_change_interface(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-283-\t\t\t\t struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-293-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:294:\trtw89_ops_remove_interface(hw, vif);\ndrivers/net/wireless/realtek/rtw89/mac80211.c-295-\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-298-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:299:\tret = rtw89_ops_add_interface(hw, vif);\ndrivers/net/wireless/realtek/rtw89/mac80211.c-300-\tif (ret)\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-307-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:308:static void rtw89_ops_configure_filter(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-309-\t\t\t\t unsigned int changed_flags,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c=479=static void rtw89_conf_tx(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-487-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:488:static int __rtw89_ops_sta_add(struct rtw89_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-489-\t\t\t struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-551-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:552:static int __rtw89_ops_sta_assoc(struct rtw89_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-553-\t\t\t\t struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-581-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:582:static int __rtw89_ops_sta_disassoc(struct rtw89_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-583-\t\t\t\t struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-608-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:609:static int __rtw89_ops_sta_disconnect(struct rtw89_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-610-\t\t\t\t struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-632-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:633:static int __rtw89_ops_sta_remove(struct rtw89_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-634-\t\t\t\t struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c=661=static void rtw89_station_mode_sta_assoc(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-674-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:675:\t__rtw89_ops_sta_assoc(rtwdev, vif, sta, true);\ndrivers/net/wireless/realtek/rtw89/mac80211.c-676-}\ndrivers/net/wireless/realtek/rtw89/mac80211.c-677-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:678:static void __rtw89_ops_bss_link_assoc(struct rtw89_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-679-\t\t\t\t struct rtw89_vif_link *rtwvif_link)\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-687-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:688:static void __rtw89_ops_bss_assoc(struct rtw89_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-689-\t\t\t\t struct ieee80211_vif *vif)\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-695-\trtw89_vif_for_each_link(rtwvif, rtwvif_link, link_id)\ndrivers/net/wireless/realtek/rtw89/mac80211.c:696:\t\t__rtw89_ops_bss_link_assoc(rtwdev, rtwvif_link);\ndrivers/net/wireless/realtek/rtw89/mac80211.c-697-}\ndrivers/net/wireless/realtek/rtw89/mac80211.c-698-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:699:static void rtw89_ops_vif_cfg_changed(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-700-\t\t\t\t struct ieee80211_vif *vif, u64 changed)\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-711-\t\t\trtw89_station_mode_sta_assoc(rtwdev, vif);\ndrivers/net/wireless/realtek/rtw89/mac80211.c:712:\t\t\t__rtw89_ops_bss_assoc(rtwdev, vif);\ndrivers/net/wireless/realtek/rtw89/mac80211.c-713-\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-749-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:750:static void rtw89_ops_link_info_changed(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-751-\t\t\t\t\tstruct ieee80211_vif *vif,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-799-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:800:static int rtw89_ops_start_ap(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-801-\t\t\t struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c=847=static\ndrivers/net/wireless/realtek/rtw89/mac80211.c:848:void rtw89_ops_stop_ap(struct ieee80211_hw *hw, struct ieee80211_vif *vif,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-849-\t\t struct ieee80211_bss_conf *link_conf)\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-872-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:873:static int rtw89_ops_set_tim(struct ieee80211_hw *hw, struct ieee80211_sta *sta,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-874-\t\t\t bool set)\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-886-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:887:static int rtw89_ops_conf_tx(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-888-\t\t\t struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-913-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:914:static int __rtw89_ops_sta_state(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-915-\t\t\t\t struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-923-\t new_state == IEEE80211_STA_NONE)\ndrivers/net/wireless/realtek/rtw89/mac80211.c:924:\t\treturn __rtw89_ops_sta_add(rtwdev, vif, sta);\ndrivers/net/wireless/realtek/rtw89/mac80211.c-925-\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-929-\t\t\treturn 0; /* defer to bss_info_changed to have vif info */\ndrivers/net/wireless/realtek/rtw89/mac80211.c:930:\t\treturn __rtw89_ops_sta_assoc(rtwdev, vif, sta, false);\ndrivers/net/wireless/realtek/rtw89/mac80211.c-931-\t}\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-934-\t new_state == IEEE80211_STA_AUTH)\ndrivers/net/wireless/realtek/rtw89/mac80211.c:935:\t\treturn __rtw89_ops_sta_disassoc(rtwdev, vif, sta);\ndrivers/net/wireless/realtek/rtw89/mac80211.c-936-\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-938-\t new_state == IEEE80211_STA_NONE)\ndrivers/net/wireless/realtek/rtw89/mac80211.c:939:\t\treturn __rtw89_ops_sta_disconnect(rtwdev, vif, sta);\ndrivers/net/wireless/realtek/rtw89/mac80211.c-940-\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-942-\t new_state == IEEE80211_STA_NOTEXIST)\ndrivers/net/wireless/realtek/rtw89/mac80211.c:943:\t\treturn __rtw89_ops_sta_remove(rtwdev, vif, sta);\ndrivers/net/wireless/realtek/rtw89/mac80211.c-944-\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-947-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:948:static int rtw89_ops_sta_state(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-949-\t\t\t struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-958-\trtw89_leave_ps_mode(rtwdev);\ndrivers/net/wireless/realtek/rtw89/mac80211.c:959:\treturn __rtw89_ops_sta_state(hw, vif, sta, old_state, new_state);\ndrivers/net/wireless/realtek/rtw89/mac80211.c-960-}\ndrivers/net/wireless/realtek/rtw89/mac80211.c-961-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:962:static int rtw89_ops_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-963-\t\t\t struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1000-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1001:static int rtw89_ops_ampdu_action(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1002-\t\t\t\t struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1052-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1053:static int rtw89_ops_set_rts_threshold(struct ieee80211_hw *hw, int radio_idx,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1054-\t\t\t\t u32 value)\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1066-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1067:static void rtw89_ops_sta_statistics(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1068-\t\t\t\t struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c=1084=void __rtw89_drop_packets(struct rtw89_dev *rtwdev, struct ieee80211_vif *vif)\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1096-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1097:static void rtw89_ops_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1098-\t\t\t u32 queues, bool drop)\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c=1139=static void rtw89_ra_mask_info_update(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1150-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1151:static int rtw89_ops_set_bitrate_mask(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1152-\t\t\t\t struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c=1165=static\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1166:int rtw89_ops_set_antenna(struct ieee80211_hw *hw, int radio_idx, u32 tx_ant, u32 rx_ant)\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1167-{\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c=1193=static\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1194:int rtw89_ops_get_antenna(struct ieee80211_hw *hw, int radio_idx, u32 *tx_ant,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1195-\t\t\t u32 *rx_ant)\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1205-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1206:static void rtw89_ops_sw_scan_start(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1207-\t\t\t\t struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1226-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1227:static void rtw89_ops_sw_scan_complete(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1228-\t\t\t\t struct ieee80211_vif *vif)\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1244-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1245:static void rtw89_ops_reconfig_complete(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1246-\t\t\t\t\tenum ieee80211_reconfig_type reconfig_type)\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1253-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1254:static int rtw89_ops_hw_scan(struct ieee80211_hw *hw, struct ieee80211_vif *vif,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1255-\t\t\t struct ieee80211_scan_request *req)\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1298-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1299:static void rtw89_ops_cancel_hw_scan(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1300-\t\t\t\t struct ieee80211_vif *vif)\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1322-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1323:static void rtw89_ops_sta_rc_update(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1324-\t\t\t\t struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1338-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1339:static int rtw89_ops_add_chanctx(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1340-\t\t\t\t struct ieee80211_chanctx_conf *ctx)\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1348-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1349:static void rtw89_ops_remove_chanctx(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1350-\t\t\t\t struct ieee80211_chanctx_conf *ctx)\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1358-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1359:static void rtw89_ops_change_chanctx(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1360-\t\t\t\t struct ieee80211_chanctx_conf *ctx,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1369-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1370:static int rtw89_ops_assign_vif_chanctx(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1371-\t\t\t\t\tstruct ieee80211_vif *vif,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1391-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1392:static void rtw89_ops_unassign_vif_chanctx(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1393-\t\t\t\t\t struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c=1414=static\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1415:int rtw89_ops_switch_vif_chanctx(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1416-\t\t\t\t struct ieee80211_vif_chanctx_switch *vifs,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1461-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1462:static void rtw89_ops_channel_switch_beacon(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1463-\t\t\t\t\t struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1480-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1481:static int rtw89_ops_remain_on_channel(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1482-\t\t\t\t struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1516-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1517:static int rtw89_ops_cancel_remain_on_channel(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1518-\t\t\t\t\t struct ieee80211_vif *vif)\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c=1535=static void rtw89_set_tid_config_iter(void *data, struct ieee80211_sta *sta)\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1543-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1544:static int rtw89_ops_set_tid_config(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1545-\t\t\t\t struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c=1563=static bool rtw89_can_work_on_links(struct rtw89_dev *rtwdev,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1575-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1576:static bool rtw89_ops_can_activate_links(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1577-\t\t\t\t\t struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1605-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1606:static void __rtw89_ops_clr_vif_links(struct rtw89_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1607-\t\t\t\t struct rtw89_vif *rtwvif,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1619-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1620:\t\t__rtw89_ops_remove_iface_link(rtwdev, rtwvif_link);\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1621-\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1625-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1626:static int __rtw89_ops_set_vif_links(struct rtw89_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1627-\t\t\t\t struct rtw89_vif *rtwvif,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1638-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1639:\t\tret = __rtw89_ops_add_iface_link(rtwdev, rtwvif_link);\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1640-\t\tif (ret) {\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c=1678=static\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1679:int rtw89_ops_change_vif_links(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1680-\t\t\t struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1721-\tif (!old_links)\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1722:\t\t__rtw89_ops_clr_vif_links(rtwdev, rtwvif,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1723-\t\t\t\t\t BIT(RTW89_VIF_IDLE_LINK_ID));\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1724-\telse if (clr_links)\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1725:\t\t__rtw89_ops_clr_vif_links(rtwdev, rtwvif, clr_links);\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1726-\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1740-\tif (set_links) {\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1741:\t\tret = __rtw89_ops_set_vif_links(rtwdev, rtwvif, set_links);\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1742-\t\tif (ret)\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1743:\t\t\t__rtw89_ops_clr_vif_links(rtwdev, rtwvif, set_links);\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1744-\t} else if (!new_links) {\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1745:\t\tret = __rtw89_ops_set_vif_links(rtwdev, rtwvif,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1746-\t\t\t\t\t\tBIT(RTW89_VIF_IDLE_LINK_ID));\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1747-\t\tif (ret)\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1748:\t\t\t__rtw89_ops_clr_vif_links(rtwdev, rtwvif,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1749-\t\t\t\t\t\t BIT(RTW89_VIF_IDLE_LINK_ID));\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1758-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1759:static void __rtw89_ops_clr_sta_links(struct rtw89_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1760-\t\t\t\t struct rtw89_sta *rtwsta,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1781-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1782:static int __rtw89_ops_set_sta_links(struct rtw89_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1783-\t\t\t\t struct rtw89_sta *rtwsta,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1814-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1815:\t\t__rtw89_ops_bss_link_assoc(rtwdev, rtwvif_link);\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1816-\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c=1835=static\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1836:int rtw89_ops_change_sta_links(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1837-\t\t\t struct ieee80211_vif *vif,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1858-\tif (clr_links)\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1859:\t\t__rtw89_ops_clr_sta_links(rtwdev, rtwsta, clr_links);\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1860-\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1861-\tif (set_links) {\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1862:\t\tret = __rtw89_ops_set_sta_links(rtwdev, rtwsta, set_links);\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1863-\t\tif (ret)\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1864:\t\t\t__rtw89_ops_clr_sta_links(rtwdev, rtwsta, set_links);\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1865-\t}\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1870-#ifdef CONFIG_PM\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1871:static int rtw89_ops_suspend(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1872-\t\t\t struct cfg80211_wowlan *wowlan)\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1892-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1893:static int rtw89_ops_resume(struct ieee80211_hw *hw)\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1894-{\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1912-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1913:static void rtw89_ops_set_wakeup(struct ieee80211_hw *hw, bool enabled)\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1914-{\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c=1920=static void rtw89_set_rekey_data(struct ieee80211_hw *hw,\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1940-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1941:static int rtw89_ops_get_survey(struct ieee80211_hw *hw, int idx,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1942-\t\t\t\tstruct survey_info *survey)\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1974-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1975:static void rtw89_ops_rfkill_poll(struct ieee80211_hw *hw)\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1976-{\n--\ndrivers/net/wireless/realtek/rtw89/mac80211.c-1987-\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1988:const struct ieee80211_ops rtw89_ops = {\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1989:\t.tx\t\t\t= rtw89_ops_tx,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1990:\t.wake_tx_queue\t\t= rtw89_ops_wake_tx_queue,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1991:\t.start\t\t\t= rtw89_ops_start,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1992:\t.stop\t\t\t= rtw89_ops_stop,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1993:\t.config\t\t\t= rtw89_ops_config,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1994:\t.add_interface\t\t= rtw89_ops_add_interface,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1995:\t.change_interface = rtw89_ops_change_interface,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1996:\t.remove_interface\t= rtw89_ops_remove_interface,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1997:\t.configure_filter\t= rtw89_ops_configure_filter,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1998:\t.vif_cfg_changed\t= rtw89_ops_vif_cfg_changed,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:1999:\t.link_info_changed\t= rtw89_ops_link_info_changed,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2000:\t.start_ap\t\t= rtw89_ops_start_ap,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2001:\t.stop_ap\t\t= rtw89_ops_stop_ap,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2002:\t.set_tim\t\t= rtw89_ops_set_tim,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2003:\t.conf_tx\t\t= rtw89_ops_conf_tx,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2004:\t.sta_state\t\t= rtw89_ops_sta_state,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2005:\t.set_key\t\t= rtw89_ops_set_key,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2006:\t.ampdu_action\t\t= rtw89_ops_ampdu_action,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2007:\t.get_survey\t\t= rtw89_ops_get_survey,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2008:\t.set_rts_threshold\t= rtw89_ops_set_rts_threshold,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2009:\t.sta_statistics\t\t= rtw89_ops_sta_statistics,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2010:\t.flush\t\t\t= rtw89_ops_flush,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2011:\t.set_bitrate_mask\t= rtw89_ops_set_bitrate_mask,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2012:\t.set_antenna\t\t= rtw89_ops_set_antenna,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2013:\t.get_antenna\t\t= rtw89_ops_get_antenna,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2014:\t.sw_scan_start\t\t= rtw89_ops_sw_scan_start,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2015:\t.sw_scan_complete\t= rtw89_ops_sw_scan_complete,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2016:\t.reconfig_complete\t= rtw89_ops_reconfig_complete,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2017:\t.hw_scan\t\t= rtw89_ops_hw_scan,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2018:\t.cancel_hw_scan\t\t= rtw89_ops_cancel_hw_scan,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2019:\t.add_chanctx\t\t= rtw89_ops_add_chanctx,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2020:\t.remove_chanctx\t\t= rtw89_ops_remove_chanctx,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2021:\t.change_chanctx\t\t= rtw89_ops_change_chanctx,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2022:\t.assign_vif_chanctx\t= rtw89_ops_assign_vif_chanctx,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2023:\t.unassign_vif_chanctx\t= rtw89_ops_unassign_vif_chanctx,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2024:\t.switch_vif_chanctx\t= rtw89_ops_switch_vif_chanctx,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2025:\t.channel_switch_beacon\t= rtw89_ops_channel_switch_beacon,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2026:\t.remain_on_channel\t\t= rtw89_ops_remain_on_channel,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2027:\t.cancel_remain_on_channel\t= rtw89_ops_cancel_remain_on_channel,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2028:\t.set_sar_specs\t\t= rtw89_ops_set_sar_specs,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2029:\t.link_sta_rc_update\t= rtw89_ops_sta_rc_update,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2030:\t.set_tid_config\t\t= rtw89_ops_set_tid_config,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2031:\t.can_activate_links\t= rtw89_ops_can_activate_links,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2032:\t.change_vif_links\t= rtw89_ops_change_vif_links,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2033:\t.change_sta_links\t= rtw89_ops_change_sta_links,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-2034-#ifdef CONFIG_PM\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2035:\t.suspend\t\t= rtw89_ops_suspend,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2036:\t.resume\t\t\t= rtw89_ops_resume,\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2037:\t.set_wakeup\t\t= rtw89_ops_set_wakeup,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-2038-\t.set_rekey_data\t\t= rtw89_set_rekey_data,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-2039-#endif\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2040:\t.rfkill_poll\t\t= rtw89_ops_rfkill_poll,\ndrivers/net/wireless/realtek/rtw89/mac80211.c-2041-};\ndrivers/net/wireless/realtek/rtw89/mac80211.c:2042:EXPORT_SYMBOL(rtw89_ops);\n--\ndrivers/net/wireless/realtek/rtw89/sar.c=412=const struct cfg80211_sar_capa rtw89_sar_capa = {\n--\ndrivers/net/wireless/realtek/rtw89/sar.c-417-\ndrivers/net/wireless/realtek/rtw89/sar.c:418:int rtw89_ops_set_sar_specs(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/sar.c-419-\t\t\t const struct cfg80211_sar_specs *sar)\n--\ndrivers/net/wireless/realtek/rtw89/sar.h=33=int rtw89_print_tas(struct rtw89_dev *rtwdev, char *buf, size_t bufsz);\ndrivers/net/wireless/realtek/rtw89/sar.h:34:int rtw89_ops_set_sar_specs(struct ieee80211_hw *hw,\ndrivers/net/wireless/realtek/rtw89/sar.h-35-\t\t\t const struct cfg80211_sar_specs *sar);\n"
} |
| 31/2 | 2026/08/30 15:42 | llm | patch-evaluator |
1mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 39845 output: 277 thoughts: 1272 Thoughts: **Analysis of Realtek rtw89 Wireless Driver Vulnerability** Okay, let's break this down systematically. First, I need to identify the key functions involved. Looks like `__rtw89_wow_parse_akm` is a non-static, exported function, which is promising for potential fuzzing, alongside the RX entrypoint `rtw89_core_rx` and `rtw89_core_tx_write` (or `rtw89_core_tx_write_link`) for TX frames. There's also `rtw89_ops_tx` in `mac80211.c`, and while `rtw89_core_cancel_6ghz_probe_tx` is static, it's still relevant due to its involvement in the vulnerability. Double checking: `__rtw89_wow_parse_akm` is defined as expected. Now, the important question: is this fuzzable? The patch focuses on length bound checks within `rtw89_core_cancel_6ghz_probe_tx` and `__rtw89_wow_parse_akm` when calling `cfg80211_find_ie`. Without the fix, the `cfg80211_find_ie` function receives an incorrect length for the IE buffer, starting at offset `hdr_len`, leading to out-of-bounds reads or even underflows. This vulnerability is reachable via RX (`rtw89_core_rx` chain) and TX (`rtw89_core_tx_write_link` chain) paths, which, in the rtw89 driver, can be emulated in a virtualized environment. Therefore, *WorthFuzzing* must be set to `true`. Next, I need to ensure the proper configurations. `RTW89` is a tristate, depending on `MAC80211`, which itself depends on `NET`, `WIRELESS`, and `CFG80211`. I also need `RTW89_CORE`, and either a USB driver like `RTW89_8852AU` or a PCIe driver, like `RTW89_PCI`, depending on the target hardware. The `PM` configuration is also essential for building `wow.c` which includes `rtw89_core-$(CONFIG_PM) += wow.o`. Looking at `RTW89_8852AU`, it depends on `USB` and selects `RTW89_CORE` and `RTW89_USB`. So, the *EnableConfigs* should be: `MAC80211`, `CFG80211`, `RTW89`, `RTW89_CORE`, `RTW89_USB`, `RTW89_8852AU` (or one of the others), `RTW89_PCI` (or another PCIe config), and `PM`. Now, for *FocusSymbols*, I'll include the identified vulnerable functions: `__rtw89_wow_parse_akm`, `rtw89_core_rx`, and `rtw89_core_tx_write` (or similar). Let's do a final verification via patch diff review. In `core.c` for `rtw89_core_cancel_6ghz_probe_tx`, the patch adds `if (skb->len < hdr_len) return;` and corrects the length passed to `cfg80211_find_ie`. In `wow.c`, `__rtw89_wow_parse_akm` receives the same fix. Both patches prevent out-of-bounds memory accesses. Alright, I'm confident in the analysis. Time to call `set-results` with these findings. |
| 32/2 | 2026/08/30 15:43 | tool | set-results |
0mArgs:{
"EnableConfigs": [
"MAC80211",
"CFG80211",
"RTW89",
"RTW89_CORE",
"RTW89_USB",
"RTW89_8852AU",
"RTW89_PCI",
"RTW89_8852AE",
"PM"
],
"FocusSymbols": [
"__rtw89_wow_parse_akm",
"rtw89_core_rx",
"rtw89_core_tx_write"
],
"Reasoning": "The patch fixes out-of-bounds read vulnerabilities in rtw89_core_cancel_6ghz_probe_tx() and __rtw89_wow_parse_akm() by validating that skb-\u003elen is at least the header length and passing the adjusted information element length (skb-\u003elen - hdr_len) to cfg80211_find_ie() instead of the unadjusted skb-\u003elen. This code is reachable during RX and TX packet processing on rtw89 devices (which include USB-supported devices testable via USB emulation in virtual environments).",
"WorthFuzzing": true
}Results: {
"EnableConfigs": [
"MAC80211",
"CFG80211",
"RTW89",
"RTW89_CORE",
"RTW89_USB",
"RTW89_8852AU",
"RTW89_PCI",
"RTW89_8852AE",
"PM"
],
"FocusSymbols": [
"__rtw89_wow_parse_akm",
"rtw89_core_rx",
"rtw89_core_tx_write"
],
"Reasoning": "The patch fixes out-of-bounds read vulnerabilities in rtw89_core_cancel_6ghz_probe_tx() and __rtw89_wow_parse_akm() by validating that skb-\u003elen is at least the header length and passing the adjusted information element length (skb-\u003elen - hdr_len) to cfg80211_find_ie() instead of the unadjusted skb-\u003elen. This code is reachable during RX and TX packet processing on rtw89 devices (which include USB-supported devices testable via USB emulation in virtual environments).",
"WorthFuzzing": true
} |
| 33/1 | 2026/08/30 15:43 | action | If |
4mArgs:{
"WorthFuzzing": true
}Results: null |
| 34/2 | 2026/08/30 15:43 | agent | kmsan-evaluator |
4mModel:core Args: null Results: {
"KMSANReasoning": "The patch fixes an out-of-bounds (OOB) read vulnerability in the rtw89 driver (both in rtw89_core_cancel_6ghz_probe_tx and __rtw89_wow_parse_akm). Previously, the full packet length (skb-\u003elen) was passed to cfg80211_find_ie instead of the length of the information elements (skb-\u003elen - hdr_len), and there was no check verifying that skb-\u003elen \u003e= hdr_len. This could lead to reading up to hdr_len bytes past the end of the skb data buffer.\n\nOut-of-bounds buffer reads are standard memory safety bugs detected by KASAN. The patch does not introduce or read uninitialized memory (stack, heap, or page allocations) or leak kernel memory to userspace. Therefore, a dedicated KMSAN fuzzing session is not required.",
"NeedsKMSAN": false
}Instruction: You are an expert Linux kernel security engineer specializing in kernel memory
error detectors (KASAN and KMSAN). Your job is to review the provided patch series and
determine if the code changes justify spawning a dedicated KMSAN (KernelMemorySanitizer)
fuzzing session in addition to standard KASAN fuzzing.
CRITICAL DISTINCTION BETWEEN KASAN AND KMSAN:
- Standard KASAN kernel builds (upstream-apparmor-kasan.config) already enable
a comprehensive suite of debugging tools and sanitizers, including KASAN
(out-of-bounds accesses, use-after-free, double free, invalid free), LOCKDEP
(locking bugs and deadlocks), UB-sanitizers, and memory corruption checks.
- KMSAN (KernelMemorySanitizer) detects reads of UNINITIALIZED memory (stack, heap,
or page allocations) and kernel-to-user memory info-leaks.
Rule: THERE IS NO SENSE IN RUNNING A KMSAN SESSION IF A BUG CAN BE CAUGHT BY KASAN,
LOCKDEP, OR OTHER STANDARD BUG DETECTORS.
A dedicated KMSAN fuzzing session incurs significant resource costs. You must ONLY
set NeedsKMSAN=true if the code changes introduce or expose UNINITIALIZED MEMORY risks
that are detected ONLY by KMSAN.
Look holistically at the patch series and surrounding code. Even if no direct
uninitialized field accesses or new buffer allocations are added in the diff itself,
a patch may alter control flow, bounds checking, or data length calculations in ways
that change how the rest of the code operates on existing buffers (e.g. allowing
uninitialized stack/heap memory to be read, copied to user space, or used in control
flow). Do not hesitate to use your code access tools to inspect the surrounding code,
called functions, and callers.
Set NeedsKMSAN=true ONLY IF the patch introduces or modifies:
1. Kernel structures sent to user space (via copy_to_user, put_user, netlink skb
attributes, ioctl output arguments, socket options, or BPF buffers) where fields
or structure padding might not be fully initialized/zeroed.
2. Conditional logic or branching that depends on potentially uninitialized variables
or struct fields.
3. Allocation or initialization of complex data structures where uninitialized fields
could be read later in reachable code paths.
4. Bounds checks, lengths, or logic in a way that allows surrounding code to access
uninitialized bytes of existing buffers.
Set NeedsKMSAN=false IF:
- The code changes primarily risk out-of-bounds access, array overflows, NULL pointer
dereferences, locking deadlocks, or use-after-free bugs (these are already caught
by KASAN, LOCKDEP, or standard bug detectors).
- All stack/heap structures touched or introduced by the patch are fully zeroed
or initialized (e.g. using = {0}, memset, kzalloc) before being read or copied.
- The patch does not introduce any risk of uninitialized memory usage or info-leaks.
Use your code access tools to inspect the surrounding code if necessary, then provide
detailed KMSANReasoning contrasting KASAN vs KMSAN applicability for this patch.
Prefer calling several tools at the same time to save round-trips.
Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.
Prompt: For your convenience, here is the diff of the changes:
commit c9abd84409ab2d242998ea9c44ad09459e9edd5f
Author: syz-cluster <triage@syzkaller.com>
Date: Sun Aug 30 15:05:33 2026 +0000
syz-cluster: applied patch under review
diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c
index 68dad6090f87e..7b46715ea12db 100644
--- a/drivers/net/wireless/realtek/rtw89/core.c
+++ b/drivers/net/wireless/realtek/rtw89/core.c
@@ -2532,9 +2532,11 @@ static void rtw89_core_cancel_6ghz_probe_tx(struct rtw89_dev *rtwdev,
{
struct ieee80211_rx_status *rx_status = IEEE80211_SKB_RXCB(skb);
struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)skb->data;
+ size_t hdr_len = offsetof(struct ieee80211_mgmt, u.beacon.variable);
struct list_head *pkt_list = rtwdev->scan_info.pkt_list;
struct rtw89_pktofld_info *info;
const u8 *ies = mgmt->u.beacon.variable, *ssid_ie;
+ size_t ie_len;
bool queue_work = false;
if (rx_status->band != NL80211_BAND_6GHZ)
@@ -2545,7 +2547,12 @@ static void rtw89_core_cancel_6ghz_probe_tx(struct rtw89_dev *rtwdev,
return;
}
- ssid_ie = cfg80211_find_ie(WLAN_EID_SSID, ies, skb->len);
+ if (skb->len < hdr_len)
+ return;
+
+ ie_len = skb->len - hdr_len;
+
+ ssid_ie = cfg80211_find_ie(WLAN_EID_SSID, ies, ie_len);
list_for_each_entry(info, &pkt_list[NL80211_BAND_6GHZ], list) {
if (ether_addr_equal(info->bssid, mgmt->bssid)) {
diff --git a/drivers/net/wireless/realtek/rtw89/wow.c b/drivers/net/wireless/realtek/rtw89/wow.c
index 8dadd8df4fc65..82b74ded68631 100644
--- a/drivers/net/wireless/realtek/rtw89/wow.c
+++ b/drivers/net/wireless/realtek/rtw89/wow.c
@@ -16,10 +16,16 @@ void __rtw89_wow_parse_akm(struct rtw89_dev *rtwdev, struct sk_buff *skb)
{
struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)skb->data;
struct rtw89_wow_param *rtw_wow = &rtwdev->wow;
+ size_t hdr_len = offsetof(struct ieee80211_mgmt, u.assoc_req.variable);
const u8 *rsn, *ies = mgmt->u.assoc_req.variable;
struct rtw89_rsn_ie *rsn_ie;
- rsn = cfg80211_find_ie(WLAN_EID_RSN, ies, skb->len);
+ if (skb->len < hdr_len)
+ return;
+
+ rsn = cfg80211_find_ie(WLAN_EID_RSN, ies,
+ skb->len - hdr_len);
+
if (!rsn)
return;
|
| 35/3 | 2026/08/30 15:43 | llm | kmsan-evaluator |
1mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 2878 output: 50 thoughts: 365 Thoughts: **Analyzing a Kernel Patch for Potential Memory Safety Issues** Okay, let's dive into this patch and figure out its potential for introducing uninitialized memory risks. Since we're looking at this for KMSAN, I need to determine if it's actually touching uninitialized memory (NeedsKMSAN=true) or if it's just dealing with out-of-bounds access or bounds checking, things like that (NeedsKMSAN=false). Let's see... Alright, the patch itself modifies two functions within the Realtek wireless drivers: `rtw89_core_cancel_6ghz_probe_tx` in `core.c` and `__rtw89_wow_parse_akm` in `wow.c`. From the diff, it looks like they're both getting a similar fix. Before, they were searching for Information Elements (IEs) using `cfg80211_find_ie` with `skb->len` as the boundary. The updated code now includes a check to ensure `skb->len` is not smaller than `hdr_len`, and if so, it exits. Otherwise, it calculates `ie_len` (essentially the valid payload length) and passes that to `cfg80211_find_ie`. So it looks like it's adding a length check before searching for the IEs. I need to understand what `hdr_len` is used for in the context of these functions and what `ies` points to. I need to understand the source and destination of `skb`. Is `skb` allocated by the kernel and, if so, is it initialized appropriately? Given that the code's changing from potentially using the full `skb->len` to calculating a new length, this is a prime candidate for an uninitialized memory risk if `hdr_len` is not properly accounted for. I'm going to need to dig deeper into the code to understand the surrounding context and ensure we're not reading past the intended boundaries. Time to use read-file or grepper to get a better picture of the whole situation. |
| 36/3 | 2026/08/30 15:44 | tool | grepper |
0mArgs:{
"Expression": "rtw89_core_cancel_6ghz_probe_tx",
"PathPrefix": "drivers/net/wireless/realtek/rtw89/"
}Results: {
"Output": "drivers/net/wireless/realtek/rtw89/core.c=2505=static void rtw89_cancel_6ghz_probe_work(struct wiphy *wiphy, struct wiphy_work *work)\n--\ndrivers/net/wireless/realtek/rtw89/core.c-2529-\ndrivers/net/wireless/realtek/rtw89/core.c:2530:static void rtw89_core_cancel_6ghz_probe_tx(struct rtw89_dev *rtwdev,\ndrivers/net/wireless/realtek/rtw89/core.c-2531-\t\t\t\t\t struct sk_buff *skb)\n--\ndrivers/net/wireless/realtek/rtw89/core.c=3038=static void rtw89_vif_rx_stats_iter(void *data, u8 *mac,\n--\ndrivers/net/wireless/realtek/rtw89/core.c-3059-\t ieee80211_is_probe_resp(hdr-\u003eframe_control)))\ndrivers/net/wireless/realtek/rtw89/core.c:3060:\t\trtw89_core_cancel_6ghz_probe_tx(rtwdev, skb);\ndrivers/net/wireless/realtek/rtw89/core.c-3061-\n"
} |
| 37/3 | 2026/08/30 15:44 | llm | kmsan-evaluator |
1mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 4097 output: 46 thoughts: 56 Thoughts: Here's my summary, as if I were the one thinking it: **Diving into the Realtek Wireless Driver** Okay, time to get my hands dirty. I need to take a look at the Realtek wireless driver, specifically the `rtw89` series. My initial focus is on `drivers/net/wireless/realtek/rtw89/core.c`, around line 2530. I'm guessing there's some core functionality or initialization happening there that's relevant to the issue I'm chasing. Simultaneously, I should probably glance at `drivers/net/wireless/realtek/rtw89/wow.c` around line 16. The "wow" directory likely handles Wake-on-Wireless, which is often a point of contention and can be intertwined with core power management and event handling. I'll need to correlate the two, see how they fit together. |
| 38/3 | 2026/08/30 15:46 | tool | read-file |
0mArgs:{
"File": "drivers/net/wireless/realtek/rtw89/core.c",
"FirstLine": 2525,
"LineCount": 50
}Results: {
"Contents": "2525:\t\t\t * since if during scanning, pkt_list is accessed in bottom half.\n2526:\t\t\t */\n2527:\t\t}\n2528:\t}\n2529:\t\n2530:\tstatic void rtw89_core_cancel_6ghz_probe_tx(struct rtw89_dev *rtwdev,\n2531:\t\t\t\t\t\t struct sk_buff *skb)\n2532:\t{\n2533:\t\tstruct ieee80211_rx_status *rx_status = IEEE80211_SKB_RXCB(skb);\n2534:\t\tstruct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)skb-\u003edata;\n2535:\t\tsize_t hdr_len = offsetof(struct ieee80211_mgmt, u.beacon.variable);\n2536:\t\tstruct list_head *pkt_list = rtwdev-\u003escan_info.pkt_list;\n2537:\t\tstruct rtw89_pktofld_info *info;\n2538:\t\tconst u8 *ies = mgmt-\u003eu.beacon.variable, *ssid_ie;\n2539:\t\tsize_t ie_len;\n2540:\t\tbool queue_work = false;\n2541:\t\n2542:\t\tif (rx_status-\u003eband != NL80211_BAND_6GHZ)\n2543:\t\t\treturn;\n2544:\t\n2545:\t\tif (unlikely(!(rtwdev-\u003echip-\u003esupport_bands \u0026 BIT(NL80211_BAND_6GHZ)))) {\n2546:\t\t\trtw89_debug(rtwdev, RTW89_DBG_UNEXP, \"invalid rx on unsupported 6 GHz\\n\");\n2547:\t\t\treturn;\n2548:\t\t}\n2549:\t\n2550:\t\tif (skb-\u003elen \u003c hdr_len)\n2551:\t\t\treturn;\n2552:\t\n2553:\t\tie_len = skb-\u003elen - hdr_len;\n2554:\t\n2555:\t\tssid_ie = cfg80211_find_ie(WLAN_EID_SSID, ies, ie_len);\n2556:\t\n2557:\t\tlist_for_each_entry(info, \u0026pkt_list[NL80211_BAND_6GHZ], list) {\n2558:\t\t\tif (ether_addr_equal(info-\u003ebssid, mgmt-\u003ebssid)) {\n2559:\t\t\t\tinfo-\u003ecancel = true;\n2560:\t\t\t\tqueue_work = true;\n2561:\t\t\t\tcontinue;\n2562:\t\t\t}\n2563:\t\n2564:\t\t\tif (!ssid_ie || ssid_ie[1] != info-\u003essid_len || info-\u003essid_len == 0)\n2565:\t\t\t\tcontinue;\n2566:\t\n2567:\t\t\tif (memcmp(\u0026ssid_ie[2], info-\u003essid, info-\u003essid_len) == 0) {\n2568:\t\t\t\tinfo-\u003ecancel = true;\n2569:\t\t\t\tqueue_work = true;\n2570:\t\t\t}\n2571:\t\t}\n2572:\t\n2573:\t\tif (queue_work)\n2574:\t\t\twiphy_work_queue(rtwdev-\u003ehw-\u003ewiphy, \u0026rtwdev-\u003ecancel_6ghz_probe_work);\n"
} |
| 39/3 | 2026/08/30 15:46 | llm | kmsan-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 5295 output: 43 thoughts: 24 Thoughts: Here's my take on those thoughts, tailored for an expert audience: **Diving into the Realtek Wake-on-WLAN Code** Alright, let's pull up the source code for `drivers/net/wireless/realtek/rtw89/wow.c`. I need to understand how the Realtek 802.11 chipset handles Wake-on-WLAN functionality. Specifically, I'm interested in how they've implemented the driver hooks, the filtering mechanisms for specific frame types (magic packets, multicast, etc.), and the power management sequences involved to transition the NIC from a low-power state back to active. I want to see how this interacts with the firmware, and if they're relying heavily on hardware offload or if there's a significant amount of software intervention in handling the wake-up triggers. I also need to verify that this implementation aligns with the ACPI specifications. I need to make sure this doesn't introduce power leaks when the device is supposed to be sleeping. This is important as this area often has subtle bugs and quirks. Let’s dive in. |
| 40/3 | 2026/08/30 15:46 | tool | read-file |
0mArgs:{
"File": "drivers/net/wireless/realtek/rtw89/wow.c",
"FirstLine": 1,
"LineCount": 60
}Results: {
"Contents": " 1:\t// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause\n 2:\t/* Copyright(c) 2019-2022 Realtek Corporation\n 3:\t */\n 4:\t#include \"cam.h\"\n 5:\t#include \"core.h\"\n 6:\t#include \"debug.h\"\n 7:\t#include \"fw.h\"\n 8:\t#include \"mac.h\"\n 9:\t#include \"phy.h\"\n 10:\t#include \"ps.h\"\n 11:\t#include \"reg.h\"\n 12:\t#include \"util.h\"\n 13:\t#include \"wow.h\"\n 14:\t\n 15:\tvoid __rtw89_wow_parse_akm(struct rtw89_dev *rtwdev, struct sk_buff *skb)\n 16:\t{\n 17:\t\tstruct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)skb-\u003edata;\n 18:\t\tstruct rtw89_wow_param *rtw_wow = \u0026rtwdev-\u003ewow;\n 19:\t\tsize_t hdr_len = offsetof(struct ieee80211_mgmt, u.assoc_req.variable);\n 20:\t\tconst u8 *rsn, *ies = mgmt-\u003eu.assoc_req.variable;\n 21:\t\tstruct rtw89_rsn_ie *rsn_ie;\n 22:\t\n 23:\t\tif (skb-\u003elen \u003c hdr_len)\n 24:\t\t\treturn;\n 25:\t\n 26:\t\trsn = cfg80211_find_ie(WLAN_EID_RSN, ies,\n 27:\t\t\t\t skb-\u003elen - hdr_len);\n 28:\t\n 29:\t\tif (!rsn)\n 30:\t\t\treturn;\n 31:\t\n 32:\t\trsn_ie = (struct rtw89_rsn_ie *)rsn;\n 33:\t\trtw_wow-\u003eakm = rsn_ie-\u003eakm_cipher_suite.type;\n 34:\t}\n 35:\t\n 36:\t#define RTW89_CIPHER_INFO_DEF(cipher) \\\n 37:\t\t{WLAN_CIPHER_SUITE_ ## cipher, .fw_alg = RTW89_WOW_FW_ALG_ ## cipher, \\\n 38:\t\t .len = WLAN_KEY_LEN_ ## cipher}\n 39:\t\n 40:\tstatic const struct rtw89_cipher_info rtw89_cipher_info_defs[] = {\n 41:\t\tRTW89_CIPHER_INFO_DEF(WEP40),\n 42:\t\tRTW89_CIPHER_INFO_DEF(WEP104),\n 43:\t\tRTW89_CIPHER_INFO_DEF(TKIP),\n 44:\t\tRTW89_CIPHER_INFO_DEF(CCMP),\n 45:\t\tRTW89_CIPHER_INFO_DEF(GCMP),\n 46:\t\tRTW89_CIPHER_INFO_DEF(CCMP_256),\n 47:\t\tRTW89_CIPHER_INFO_DEF(GCMP_256),\n 48:\t\tRTW89_CIPHER_INFO_DEF(AES_CMAC),\n 49:\t};\n 50:\t\n 51:\t#undef RTW89_CIPHER_INFO_DEF\n 52:\t\n 53:\tstatic const\n 54:\tstruct rtw89_cipher_info *rtw89_cipher_alg_recognize(u32 cipher)\n 55:\t{\n 56:\t\tconst struct rtw89_cipher_info *cipher_info_defs;\n 57:\t\tint i;\n 58:\t\n 59:\t\tfor (i = 0; i \u003c ARRAY_SIZE(rtw89_cipher_info_defs); i++) {\n 60:\t\t\tcipher_info_defs = \u0026rtw89_cipher_info_defs[i];\n"
} |
| 41/3 | 2026/08/30 15:46 | llm | kmsan-evaluator |
0mModel:gemini-3.7-flash Args: null Results: null Tokens: input: 6652 output: 220 thoughts: 498 Thoughts: **Bug Analysis and KMSAN Evaluation** Okay, let's break this down. My initial thought is to identify the root cause of this bug. It appears we had a classic out-of-bounds read vulnerability. The previous code, specifically this line: `ssid_ie = cfg80211_find_ie(WLAN_EID_SSID, ies, skb->len);`, was the culprit. It seems the `ies` pointer was referencing `mgmt->u.beacon.variable`, an offset from `skb->data`, and the length passed to the function, `skb->len`, allowed `cfg80211_find_ie` to potentially read past the actual buffer boundaries of `skb->data`, by an amount equal to `hdr_len`. That's a direct buffer over-read situation! The added check for `skb->len < hdr_len` is key, as is the patch to reduce the read length by that value. KASAN would definitely catch something like this. Next, I need to evaluate the KMSAN implications. The functions involve parsing 802.11 IEs from packet data within an `skb`. So the important part is making sure no uninitialized memory gets allocated or leaked to user space, right? The fix adjusts the length to be passed to `cfg80211_find_ie` to `skb->len - hdr_len` but only if `skb->len >= hdr_len`. This prevents those OOB reads past the end of the `skb` buffer. Since we're just preventing access and not introducing anything new, there aren't any potential leaks. Now, checking the KMSAN rules: Does the fix introduce or modify kernel structures sent to user space where fields/padding might be uninitialized? No. Does it introduce conditional logic depending on uninitialized variables? Nope. Does it allocate/initialize complex data structures with uninitialized fields? Negative. Does it introduce bounds checks/lengths allowing access to uninitialized bytes? No, if anything, it prevents that. Thus, no KMSAN concerns here. Therefore, `NeedsKMSAN` is definitely `false`. I'll call `set-results` with that flag and clear the `KMSANReasoning`. |
| 42/3 | 2026/08/30 15:47 | tool | set-results |
0mArgs:{
"KMSANReasoning": "The patch fixes an out-of-bounds (OOB) read vulnerability in the rtw89 driver (both in rtw89_core_cancel_6ghz_probe_tx and __rtw89_wow_parse_akm). Previously, the full packet length (skb-\u003elen) was passed to cfg80211_find_ie instead of the length of the information elements (skb-\u003elen - hdr_len), and there was no check verifying that skb-\u003elen \u003e= hdr_len. This could lead to reading up to hdr_len bytes past the end of the skb data buffer.\n\nOut-of-bounds buffer reads are standard memory safety bugs detected by KASAN. The patch does not introduce or read uninitialized memory (stack, heap, or page allocations) or leak kernel memory to userspace. Therefore, a dedicated KMSAN fuzzing session is not required.",
"NeedsKMSAN": false
}Results: {
"KMSANReasoning": "The patch fixes an out-of-bounds (OOB) read vulnerability in the rtw89 driver (both in rtw89_core_cancel_6ghz_probe_tx and __rtw89_wow_parse_akm). Previously, the full packet length (skb-\u003elen) was passed to cfg80211_find_ie instead of the length of the information elements (skb-\u003elen - hdr_len), and there was no check verifying that skb-\u003elen \u003e= hdr_len. This could lead to reading up to hdr_len bytes past the end of the skb data buffer.\n\nOut-of-bounds buffer reads are standard memory safety bugs detected by KASAN. The patch does not introduce or read uninitialized memory (stack, heap, or page allocations) or leak kernel memory to userspace. Therefore, a dedicated KMSAN fuzzing session is not required.",
"NeedsKMSAN": false
} |
| Total Calls | Total Tokens | Avg Tokens | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|
| Total Calls | Total Duration (Seconds) | Avg Duration (Seconds) |
|---|