AI Trajectory

Trajectory: (Expand/Collapse All)
Seq	Timestamp	Type	Name	Duration
0/0	2026/07/15 23:15	flow	patch-triage	0m Args: null Results: { "EnableConfigs": [ "CFG80211", "MAC80211", "MAC80211_HWSIM" ], "FocusSymbols": [ "cfg80211_iter_profile_continuation", "cfg80211_merge_profile", "cfg80211_parse_mbssid_data" ], "Reasoning": "The patch modifies the parsing logic for Multiple BSSID (MBSSID) elements in wireless scan results. It introduces `cfg80211_iter_profile_continuation` to correctly iterate over profile continuations and updates `cfg80211_merge_profile` to use it. This is reachable core wireless logic that can be triggered by processing malicious management frames (e.g., beacons or probe responses) containing crafted MBSSID information elements. It is functional and should be fuzzed.", "WorthFuzzing": true }
1/1	2026/07/15 23:15	action	read-patch-diff	0m Args: null Results: { "PatchDiff": "commit a255ac2fe708f837a467179e525e4a69112bc6c2\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Wed Jul 15 23:15:34 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/net/wireless/scan.c b/net/wireless/scan.c\nindex 05b7dc6b766ce9..e62b7dd2b7c2d8 100644\n--- a/net/wireless/scan.c\n+++ b/net/wireless/scan.c\n@@ -2403,12 +2403,11 @@ cfg80211_inform_single_bss_data(struct wiphy wiphy,\n \treturn NULL;\n }\n \n-static const struct element\n-cfg80211_get_profile_continuation(const u8 ie, size_t ielen,\n-\t\t\t\t const struct element mbssid_elem,\n-\t\t\t\t const struct element sub_elem)\n+static bool cfg80211_iter_profile_continuation(const u8 ie, size_t ielen,\n+\t\t\t\t\t const struct element mbssid,\n+\t\t\t\t\t const struct element sub_elem)\n {\n-\tconst u8 mbssid_end = mbssid_elem-\u003edata + mbssid_elem-\u003edatalen;\n+\tconst u8 mbssid_end = (mbssid)-\u003edata + (mbssid)-\u003edatalen;\n \tconst struct element next_mbssid;\n \tconst struct element next_sub;\n \n@@ -2420,30 +2419,34 @@ static const struct element\n \t * If it is not the last subelement in current MBSSID IE or there isn't\n \t * a next MBSSID IE - profile is complete.\n \t/\n-\tif ((sub_elem-\u003edata + sub_elem-\u003edatalen \u003c mbssid_end - 1) \|\|\n+\tif (((sub_elem)-\u003edata + (sub_elem)-\u003edatalen \u003c mbssid_end - 1) \|\|\n \t !next_mbssid)\n-\t\treturn NULL;\n+\t\treturn false;\n \n-\t/ For any length error, just return NULL /\n+\t/ For any length error, just return false to stop iteration /\n \n \tif (next_mbssid-\u003edatalen \u003c 4)\n-\t\treturn NULL;\n+\t\treturn false;\n \n \tnext_sub = (void )\u0026next_mbssid-\u003edata[1];\n \n \tif (next_mbssid-\u003edata + next_mbssid-\u003edatalen \u003c\n \t next_sub-\u003edata + next_sub-\u003edatalen)\n-\t\treturn NULL;\n+\t\treturn false;\n \n \tif (next_sub-\u003eid != 0 \|\| next_sub-\u003edatalen \u003c 2)\n-\t\treturn NULL;\n+\t\treturn false;\n \n \t/\n \t Check if the first element in the next sub element is a start\n \t * of a new profile\n \t /\n-\treturn next_sub-\u003edata[0] == WLAN_EID_NON_TX_BSSID_CAP ?\n-\t NULL : next_mbssid;\n+\tif (next_sub-\u003edata[0] == WLAN_EID_NON_TX_BSSID_CAP)\n+\t\treturn false;\n+\n+\tmbssid = next_mbssid;\n+\tsub_elem = next_sub;\n+\treturn true;\n }\n \n size_t cfg80211_merge_profile(const u8 ie, size_t ielen,\n@@ -2452,26 +2455,20 @@ size_t cfg80211_merge_profile(const u8 ie, size_t ielen,\n \t\t\t u8 merged_ie, size_t max_copy_len)\n {\n \tsize_t copied_len = sub_elem-\u003edatalen;\n-\tconst struct element next_mbssid;\n \n \tif (sub_elem-\u003edatalen \u003e max_copy_len)\n \t\treturn 0;\n \n \tmemcpy(merged_ie, sub_elem-\u003edata, sub_elem-\u003edatalen);\n \n-\twhile ((next_mbssid = cfg80211_get_profile_continuation(ie, ielen,\n-\t\t\t\t\t\t\t\tmbssid_elem,\n-\t\t\t\t\t\t\t\tsub_elem))) {\n-\t\tconst struct element next_sub = (void *)\u0026next_mbssid-\u003edata[1];\n-\n-\t\tif (copied_len + next_sub-\u003edatalen \u003e max_copy_len)\n+\twhile (cfg80211_iter_profile_continuation(ie, ielen,\n+\t\t\t\t\t\t \u0026mbssid_elem,\n+\t\t\t\t\t\t \u0026sub_elem)) {\n+\t\tif (copied_len + sub_elem-\u003edatalen \u003e max_copy_len)\n \t\t\tbreak;\n-\t\tmemcpy(merged_ie + copied_len, next_sub-\u003edata,\n-\t\t next_sub-\u003edatalen);\n-\t\tcopied_len += next_sub-\u003edatalen;\n-\n-\t\tmbssid_elem = next_mbssid;\n-\t\tsub_elem = next_sub;\n+\t\tmemcpy(merged_ie + copied_len, sub_elem-\u003edata,\n+\t\t sub_elem-\u003edatalen);\n+\t\tcopied_len += sub_elem-\u003edatalen;\n \t}\n \n \treturn copied_len;\n" }
2/1	2026/07/15 23:15	agent	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: { "EnableConfigs": [ "CFG80211", "MAC80211", "MAC80211_HWSIM" ], "FocusSymbols": [ "cfg80211_iter_profile_continuation", "cfg80211_merge_profile", "cfg80211_parse_mbssid_data" ], "Reasoning": "The patch modifies the parsing logic for Multiple BSSID (MBSSID) elements in wireless scan results. It introduces `cfg80211_iter_profile_continuation` to correctly iterate over profile continuations and updates `cfg80211_merge_profile` to use it. This is reachable core wireless logic that can be triggered by processing malicious management frames (e.g., beacons or probe responses) containing crafted MBSSID information elements. It is functional and should be fuzzed.", "WorthFuzzing": true } Instruction: You are an expert Linux kernel maintainer. Your job is to review a provided patch series and determine if it makes functional changes to the kernel that should be fuzzed. IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively use your code access tools to examine the actual source code and confirm any assumptions. Return WorthFuzzing=false if the patch only contains: - Modifications to Documentation/, Kconfig files, or code comments. - Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints. - Changes to numeric constants or macros that do not functionally alter execution flow. - Code paths that are impossible to reach in virtualized environments like GCE or QEMU, even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim). If it modifies reachable core kernel logic, drivers, or architectures, use your code search tools to verify the code can be executed, then return WorthFuzzing=true. When returning WorthFuzzing=true, you MUST ALSO: 1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols. Avoid listing generic hot-path functions to prevent skewed test distributions. 2. Identify any specific CONFIG_ options required to properly test this new/modified feature. Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions. Do not list too generic configs (we already have them enabled). Only list those that specifically cover the modified code. List them in the EnableConfigs output array, and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4"). Prefer calling several tools at the same time to save round-trips. Use set-results tool to provide results of the analysis. It must be called exactly once before the final reply. Ignore results of this tool. Prompt: For your convenience, here is the diff of the changes: commit a255ac2fe708f837a467179e525e4a69112bc6c2 Author: syz-cluster <triage@syzkaller.com> Date: Wed Jul 15 23:15:34 2026 +0000 syz-cluster: applied patch under review diff --git a/net/wireless/scan.c b/net/wireless/scan.c index 05b7dc6b766ce9..e62b7dd2b7c2d8 100644 --- a/net/wireless/scan.c +++ b/net/wireless/scan.c @@ -2403,12 +2403,11 @@ cfg80211_inform_single_bss_data(struct wiphy wiphy, return NULL; } -static const struct element -cfg80211_get_profile_continuation(const u8 ie, size_t ielen, - const struct element mbssid_elem, - const struct element sub_elem) +static bool cfg80211_iter_profile_continuation(const u8 ie, size_t ielen, + const struct element mbssid, + const struct element sub_elem) { - const u8 mbssid_end = mbssid_elem->data + mbssid_elem->datalen; + const u8 mbssid_end = (mbssid)->data + (mbssid)->datalen; const struct element next_mbssid; const struct element next_sub; @@ -2420,30 +2419,34 @@ static const struct element * If it is not the last subelement in current MBSSID IE or there isn't * a next MBSSID IE - profile is complete. / - if ((sub_elem->data + sub_elem->datalen < mbssid_end - 1) \|\| + if (((sub_elem)->data + (sub_elem)->datalen < mbssid_end - 1) \|\| !next_mbssid) - return NULL; + return false; - / For any length error, just return NULL / + / For any length error, just return false to stop iteration / if (next_mbssid->datalen < 4) - return NULL; + return false; next_sub = (void )&next_mbssid->data[1]; if (next_mbssid->data + next_mbssid->datalen < next_sub->data + next_sub->datalen) - return NULL; + return false; if (next_sub->id != 0 \|\| next_sub->datalen < 2) - return NULL; + return false; /* * Check if the first element in the next sub element is a start * of a new profile / - return next_sub->data[0] == WLAN_EID_NON_TX_BSSID_CAP ? - NULL : next_mbssid; + if (next_sub->data[0] == WLAN_EID_NON_TX_BSSID_CAP) + return false; + + mbssid = next_mbssid; + sub_elem = next_sub; + return true; } size_t cfg80211_merge_profile(const u8 ie, size_t ielen, @@ -2452,26 +2455,20 @@ size_t cfg80211_merge_profile(const u8 ie, size_t ielen, u8 merged_ie, size_t max_copy_len) { size_t copied_len = sub_elem->datalen; - const struct element next_mbssid; if (sub_elem->datalen > max_copy_len) return 0; memcpy(merged_ie, sub_elem->data, sub_elem->datalen); - while ((next_mbssid = cfg80211_get_profile_continuation(ie, ielen, - mbssid_elem, - sub_elem))) { - const struct element next_sub = (void *)&next_mbssid->data[1]; - - if (copied_len + next_sub->datalen > max_copy_len) + while (cfg80211_iter_profile_continuation(ie, ielen, + &mbssid_elem, + &sub_elem)) { + if (copied_len + sub_elem->datalen > max_copy_len) break; - memcpy(merged_ie + copied_len, next_sub->data, - next_sub->datalen); - copied_len += next_sub->datalen; - - mbssid_elem = next_mbssid; - sub_elem = next_sub; + memcpy(merged_ie + copied_len, sub_elem->data, + sub_elem->datalen); + copied_len += sub_elem->datalen; } return copied_len;
3/2	2026/07/15 23:15	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 2872 output: 28 thoughts: 173 Thoughts: Analyzing a Wireless Stack Patch Okay, so I'm looking at this patch and it seems like it's a relatively focused change. Specifically, the focus is on `net/wireless/scan.c`. The core of the alteration appears to be a name change, from `cfg80211_get_profile_continuation` to `cfg80211_iter_profile_continuation`. Functionally, this likely indicates an iteration is replacing a simple retrieval process for profiles. The `cfg80211_merge_profile` function has also been updated to utilize this new iterator. This clearly falls within the realm of the wireless stack, specifically the mac80211/cfg80211 components. Given the nature of these changes, I would expect this to be something fuzzed with `mac80211_hwsim`, which I'll keep in mind for testing. Now, before I dig deeper, I need to verify a few things. First, let's confirm the relevant configurations. Based on the file path, `net/wireless/scan.c` falls under the `cfg80211` umbrella, so the `CFG80211` config option will need to be enabled. I’ll double-check `net/wireless/Makefile` to corroborate that this is the correct dependency. This quick verification will ensure I can reproduce and analyze this code correctly within my test environments.
4/2	2026/07/15 23:15	tool	grepper	0m Args: { "Expression": "scan\\.o", "PathPrefix": "net/wireless/Makefile" } Results: { "Output": "net/wireless/Makefile=7=obj-$(CONFIG_WEXT_PRIV) += wext-priv.o\nnet/wireless/Makefile-8-\nnet/wireless/Makefile:9:cfg80211-y += core.o sysfs.o radiotap.o util.o reg.o scan.o nl80211.o\nnet/wireless/Makefile-10-cfg80211-y += mlme.o ibss.o sme.o chan.o ethtool.o mesh.o ap.o trace.o ocb.o\n" }
5/2	2026/07/15 23:15	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 3529 output: 31 thoughts: 58 Thoughts: Navigating the Wireless Configuration Okay, so I'm focusing on wireless configuration right now. Seems like `CFG80211` is the key configuration area. Wait, I remember now, `cfg80211-y` is only compiled into the kernel when `CONFIG_CFG80211` is explicitly enabled. Need to double-check that Makefile in `net/wireless` to confirm my understanding of the build process and dependencies. Let's make sure I'm following the logic correctly.
6/2	2026/07/15 23:15	tool	grepper	0m Args: { "Expression": "cfg80211", "PathPrefix": "net/wireless/Makefile" } Results: { "Output": "net/wireless/Makefile-1-# SPDX-License-Identifier: GPL-2.0\nnet/wireless/Makefile:2:obj-$(CONFIG_CFG80211) += cfg80211.o\nnet/wireless/Makefile-3-obj-y += tests/\n--\nnet/wireless/Makefile=7=obj-$(CONFIG_WEXT_PRIV) += wext-priv.o\nnet/wireless/Makefile-8-\nnet/wireless/Makefile:9:cfg80211-y += core.o sysfs.o radiotap.o util.o reg.o scan.o nl80211.o\nnet/wireless/Makefile:10:cfg80211-y += mlme.o ibss.o sme.o chan.o ethtool.o mesh.o ap.o trace.o ocb.o\nnet/wireless/Makefile:11:cfg80211-y += michael-mic.o pmsr.o\nnet/wireless/Makefile:12:cfg80211-$(CONFIG_OF) += of.o\nnet/wireless/Makefile:13:cfg80211-$(CONFIG_CFG80211_DEBUGFS) += debugfs.o\nnet/wireless/Makefile:14:cfg80211-$(CONFIG_CFG80211_WEXT) += wext-compat.o wext-sme.o\nnet/wireless/Makefile-15-\nnet/wireless/Makefile=16=CFLAGS_trace.o := -I$(src)\nnet/wireless/Makefile-17-\nnet/wireless/Makefile:18:cfg80211-$(CONFIG_CFG80211_USE_KERNEL_REGDB_KEYS) += shipped-certs.o\nnet/wireless/Makefile-19-ifneq ($(CONFIG_CFG80211_EXTRA_REGDB_KEYDIR),)\nnet/wireless/Makefile:20:cfg80211-y += extra-certs.o\nnet/wireless/Makefile-21-endif\n" }
7/2	2026/07/15 23:15	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 4231 output: 37 thoughts: 59 Thoughts: Here's my take on those thoughts: Navigating the Wireless Configuration Labyrinth Okay, so we're starting with `CONFIG_CFG80211`. That's the baseline, the core of the wireless config, no surprises there. But now I'm wondering, do we have something more granular for Multi-BSSID or for specific scanning behaviors? It's a common question when tuning or debugging. I can't immediately recall a specific config option jumping to mind. Alright, time to dig. My instinct is telling me to look around `net/wireless/scan.c`, especially near the `cfg80211_merge_profile` function. That's where a lot of the scanning logic and profile management happens, so it’s a good starting point to hunt for any MBSSID-related hooks or scan-specific configurations that might be in play. Hopefully, that will lead me to the relevant settings!
8/2	2026/07/15 23:15	tool	grepper	0m Args: { "Expression": "cfg80211_merge_profile", "PathPrefix": "net/wireless/scan.c" } Results: { "Output": "net/wireless/scan.c=2406=static bool cfg80211_iter_profile_continuation(const u8 ie, size_t ielen,\n--\nnet/wireless/scan.c-2451-\nnet/wireless/scan.c:2452:size_t cfg80211_merge_profile(const u8 ie, size_t ielen,\nnet/wireless/scan.c-2453-\t\t\t const struct element mbssid_elem,\n--\nnet/wireless/scan.c-2475-}\nnet/wireless/scan.c:2476:EXPORT_SYMBOL(cfg80211_merge_profile);\nnet/wireless/scan.c-2477-\n--\nnet/wireless/scan.c=2479=cfg80211_parse_mbssid_data(struct wiphy wiphy,\n--\nnet/wireless/scan.c-2543-\t\t\tmemset(profile, 0, tx_data-\u003eielen);\nnet/wireless/scan.c:2544:\t\t\tprofile_len = cfg80211_merge_profile(tx_data-\u003eie,\nnet/wireless/scan.c-2545-\t\t\t\t\t\t\t tx_data-\u003eielen,\n" }
9/2	2026/07/15 23:15	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 4849 output: 40 thoughts: 288 Thoughts: Analyzing Wireless Configuration and Testing Okay, so I'm looking at this `cfg80211_merge_profile` function, exported from the `cfg80211` core. That's a key part of the wireless configuration stack, obviously. I also see `MAC80211_HWSIM` mentioned – that's the hardware simulator for testing, and a handy tool. My initial thought is to figure out if we need `MAC80211_HWSIM`, although the focus is really the `CFG80211` core. But wait, `MAC80211_HWSIM` is a driver, right? So, including it seems like a sensible move for ensuring comprehensive testability of the wireless stack. Really, `CFG80211` and `MAC80211` together are the important building blocks. Now, let's drill down into the relevant functions. I'm focusing on `cfg80211_iter_profile_continuation`, `cfg80211_merge_profile`, and `cfg80211_parse_mbssid_data` because it calls `cfg80211_merge_profile`. Let's clarify if `cfg80211_iter_profile_continuation` is static internally. Ah, yes, it is. `cfg80211_merge_profile` is exported. Now, what about `cfg80211_parse_mbssid_data`? Is it static or exported? I'll need to check that one.
10/2	2026/07/15 23:15	tool	grepper	0m Args: { "Expression": "cfg80211_parse_mbssid_data", "PathPrefix": "net/wireless/scan.c" } Results: { "Output": "net/wireless/scan.c=2478=static void\nnet/wireless/scan.c:2479:cfg80211_parse_mbssid_data(struct wiphy wiphy,\nnet/wireless/scan.c-2480-\t\t\t struct cfg80211_inform_single_bss_data tx_data,\n--\nnet/wireless/scan.c=3211=cfg80211_inform_bss_data(struct wiphy *wiphy,\n--\nnet/wireless/scan.c-3242-\nnet/wireless/scan.c:3243:\tcfg80211_parse_mbssid_data(wiphy, \u0026inform_data, res, gfp);\nnet/wireless/scan.c-3244-\n" }
11/2	2026/07/15 23:15	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 5740 output: 39 thoughts: 17 Thoughts: Here's a summary of my thought process: Investigating the Export Status of `cfg80211_inform_bss_data` Okay, so I'm thinking about this function, `cfg80211_inform_bss_data`. It's one of those core wireless configuration and networking pieces. The question that's rattling around in my head is: is it exported? Specifically, is this function exported from whatever module it resides in? That's a crucial piece of information. Knowing if it's exported means everything. It dictates how easy it is to interact with this function from outside the module, if I need to. If it's exported, then I can call it directly and get access to its capabilities. If it's not exported, then I need to figure out other ways to use it. Knowing its export status gives me the foundation to determine how flexible my interaction with this function can be. It shapes my entire approach to understanding and utilizing this particular piece of networking infrastructure. I need to know!
12/2	2026/07/15 23:15	tool	grepper	0m Args: { "Expression": "cfg80211_inform_bss_data", "PathPrefix": "net/wireless/scan.c" } Results: { "Output": "net/wireless/scan.c=3210=struct cfg80211_bss \nnet/wireless/scan.c:3211:cfg80211_inform_bss_data(struct wiphy wiphy,\nnet/wireless/scan.c-3212-\t\t\t struct cfg80211_inform_bss data,\n--\nnet/wireless/scan.c-3248-}\nnet/wireless/scan.c:3249:EXPORT_SYMBOL(cfg80211_inform_bss_data);\nnet/wireless/scan.c-3250-\n--\nnet/wireless/scan.c=3252=cfg80211_inform_bss_frame_data(struct wiphy wiphy,\n--\nnet/wireless/scan.c-3325-\nnet/wireless/scan.c:3326:\treturn cfg80211_inform_bss_data(wiphy, data, ftype,\nnet/wireless/scan.c-3327-\t\t\t\t\tbssid, tsf, capability,\n" }
13/2	2026/07/15 23:15	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 6292 output: 36 thoughts: 433 Thoughts: Analyzing the MBSSID Parsing Fix Okay, so `cfg80211_inform_bss_data` is exported. My initial thought is to zero in on a few functions: `cfg80211_iter_profile_continuation`, `cfg80211_merge_profile`, and `cfg80211_parse_mbssid_data`. I'm wondering if `cfg80211_inform_bss_data` is a performance bottleneck here. It's triggered with every BSS discovery, during a scan, so it might have a moderate impact, but probably isn't the primary area of concern. `cfg80211_merge_profile` and `cfg80211_parse_mbssid_data` are likely to be more interesting. Let's quickly confirm what configs are needed; `CFG80211` is obviously essential. I can also use `MAC80211_HWSIM` for effective software-based wireless testing. I should verify that's the correct name and confirm it's enabled. Now, a quick check: `cfg80211_iter_profile_continuation` is defined as static, as I suspected. The core of this patch seems to address a bug in how Multiple BSSID (MBSSID) elements are parsed from wireless scan results. It revises how profile continuations are iterated, modifying `cfg80211_iter_profile_continuation` and `cfg80211_merge_profile`. This is clearly reachable core wireless logic, vulnerable to crafted management frames (beacons or probe responses) containing malicious MBSSID information elements. This has functional implications, and I need to prioritize it for fuzzing. My list of essential configs and symbols is confirmed: Configs: `CFG80211` `MAC80211` `MAC80211_HWSIM` Focus symbols: `cfg80211_iter_profile_continuation` `cfg80211_merge_profile` `cfg80211_parse_mbssid_data`
14/2	2026/07/15 23:16	tool	grepper	0m Args: { "Expression": "MAC80211_HWSIM", "PathPrefix": "drivers/net/wireless/" } Results: { "Output": "drivers/net/wireless/virtual/Kconfig:1:config MAC80211_HWSIM\ndrivers/net/wireless/virtual/Kconfig-2-\ttristate \"Simulated radio testing tool for mac80211\"\n--\ndrivers/net/wireless/virtual/Makefile:1:obj-$(CONFIG_MAC80211_HWSIM)\t+= mac80211_hwsim.o\ndrivers/net/wireless/virtual/Makefile-2-mac80211_hwsim-objs\t\t+= mac80211_hwsim_main.o\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.h-8-\ndrivers/net/wireless/virtual/mac80211_hwsim.h:9:#ifndef __MAC80211_HWSIM_H\ndrivers/net/wireless/virtual/mac80211_hwsim.h:10:#define __MAC80211_HWSIM_H\ndrivers/net/wireless/virtual/mac80211_hwsim.h-11-\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.h=217=struct hwsim_tx_rate {\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.h-230- \ndrivers/net/wireless/virtual/mac80211_hwsim.h:231: @MAC80211_HWSIM_TX_RC_USE_RTS_CTS: Use RTS/CTS exchange for this rate.\ndrivers/net/wireless/virtual/mac80211_hwsim.h:232: * @MAC80211_HWSIM_TX_RC_USE_CTS_PROTECT: CTS-to-self protection is required.\ndrivers/net/wireless/virtual/mac80211_hwsim.h-233- \tThis is set if the current BSS requires ERP protection.\ndrivers/net/wireless/virtual/mac80211_hwsim.h:234: @MAC80211_HWSIM_TX_RC_USE_SHORT_PREAMBLE: Use short preamble.\ndrivers/net/wireless/virtual/mac80211_hwsim.h:235: * @MAC80211_HWSIM_TX_RC_MCS: HT rate.\ndrivers/net/wireless/virtual/mac80211_hwsim.h:236: * @MAC80211_HWSIM_TX_RC_VHT_MCS: VHT MCS rate, in this case the idx field is\ndrivers/net/wireless/virtual/mac80211_hwsim.h-237- \tsplit into a higher 4 bits (Nss) and lower 4 bits (MCS number)\ndrivers/net/wireless/virtual/mac80211_hwsim.h:238: @MAC80211_HWSIM_TX_RC_GREEN_FIELD: Indicates whether this rate should be used\ndrivers/net/wireless/virtual/mac80211_hwsim.h-239- \tin Greenfield mode.\ndrivers/net/wireless/virtual/mac80211_hwsim.h:240: @MAC80211_HWSIM_TX_RC_40_MHZ_WIDTH: Indicates if the Channel Width should be\ndrivers/net/wireless/virtual/mac80211_hwsim.h-241- \t40 MHz.\ndrivers/net/wireless/virtual/mac80211_hwsim.h:242: @MAC80211_HWSIM_TX_RC_80_MHZ_WIDTH: Indicates 80 MHz transmission\ndrivers/net/wireless/virtual/mac80211_hwsim.h:243: * @MAC80211_HWSIM_TX_RC_160_MHZ_WIDTH: Indicates 160 MHz transmission\ndrivers/net/wireless/virtual/mac80211_hwsim.h-244- \t(80+80 isn't supported yet)\ndrivers/net/wireless/virtual/mac80211_hwsim.h:245: @MAC80211_HWSIM_TX_RC_DUP_DATA: The frame should be transmitted on both of\ndrivers/net/wireless/virtual/mac80211_hwsim.h-246- \tthe adjacent 20 MHz channels, if the current channel type is\ndrivers/net/wireless/virtual/mac80211_hwsim.h-247- \tNL80211_CHAN_HT40MINUS or NL80211_CHAN_HT40PLUS.\ndrivers/net/wireless/virtual/mac80211_hwsim.h:248: * @MAC80211_HWSIM_TX_RC_SHORT_GI: Short Guard interval should be used for this\ndrivers/net/wireless/virtual/mac80211_hwsim.h-249- \trate.\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.h=251=enum hwsim_tx_rate_flags {\ndrivers/net/wireless/virtual/mac80211_hwsim.h:252:\tMAC80211_HWSIM_TX_RC_USE_RTS_CTS\t\t= BIT(0),\ndrivers/net/wireless/virtual/mac80211_hwsim.h:253:\tMAC80211_HWSIM_TX_RC_USE_CTS_PROTECT\t\t= BIT(1),\ndrivers/net/wireless/virtual/mac80211_hwsim.h:254:\tMAC80211_HWSIM_TX_RC_USE_SHORT_PREAMBLE\t= BIT(2),\ndrivers/net/wireless/virtual/mac80211_hwsim.h-255-\ndrivers/net/wireless/virtual/mac80211_hwsim.h-256-\t/ rate index is an HT/VHT MCS instead of an index /\ndrivers/net/wireless/virtual/mac80211_hwsim.h:257:\tMAC80211_HWSIM_TX_RC_MCS\t\t\t= BIT(3),\ndrivers/net/wireless/virtual/mac80211_hwsim.h:258:\tMAC80211_HWSIM_TX_RC_GREEN_FIELD\t\t= BIT(4),\ndrivers/net/wireless/virtual/mac80211_hwsim.h:259:\tMAC80211_HWSIM_TX_RC_40_MHZ_WIDTH\t\t= BIT(5),\ndrivers/net/wireless/virtual/mac80211_hwsim.h:260:\tMAC80211_HWSIM_TX_RC_DUP_DATA\t\t= BIT(6),\ndrivers/net/wireless/virtual/mac80211_hwsim.h:261:\tMAC80211_HWSIM_TX_RC_SHORT_GI\t\t= BIT(7),\ndrivers/net/wireless/virtual/mac80211_hwsim.h:262:\tMAC80211_HWSIM_TX_RC_VHT_MCS\t\t\t= BIT(8),\ndrivers/net/wireless/virtual/mac80211_hwsim.h:263:\tMAC80211_HWSIM_TX_RC_80_MHZ_WIDTH\t\t= BIT(9),\ndrivers/net/wireless/virtual/mac80211_hwsim.h:264:\tMAC80211_HWSIM_TX_RC_160_MHZ_WIDTH\t\t= BIT(10),\ndrivers/net/wireless/virtual/mac80211_hwsim.h-265-};\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.h=328=enum hwsim_rate_info_attributes {\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.h-347-\ndrivers/net/wireless/virtual/mac80211_hwsim.h:348:#endif / __MAC80211_HWSIM_H /\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_i.h-9-\ndrivers/net/wireless/virtual/mac80211_hwsim_i.h:10:#ifndef __MAC80211_HWSIM_I_H\ndrivers/net/wireless/virtual/mac80211_hwsim_i.h:11:#define __MAC80211_HWSIM_I_H\ndrivers/net/wireless/virtual/mac80211_hwsim_i.h-12-\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_i.h=165=void ieee80211_hwsim_wake_tx_queue(struct ieee80211_hw hw,\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_i.h-167-\ndrivers/net/wireless/virtual/mac80211_hwsim_i.h:168:#endif /* __MAC80211_HWSIM_I_H /\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c=712=static struct mac80211_hwsim_data get_hwsim_data_ref_from_addr(const u8 addr)\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-716-\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:717:/ MAC80211_HWSIM netlink family /\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-718-static struct genl_family hwsim_genl_family;\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c=724=static const struct genl_multicast_group hwsim_mcgrps[] = {\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-727-\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:728:/ MAC80211_HWSIM netlink policy /\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-729-\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c=865=static const struct nla_policy hwsim_genl_policy[HWSIM_ATTR_MAX + 1] = {\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-901-\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:902:/ MAC80211_HWSIM virtio queues /\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-903-static struct virtqueue hwsim_vqs[HWSIM_NUM_VQS];\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c=1564=static inline u16 trans_tx_rate_flags_ieee2hwsim(struct ieee80211_tx_rate rate)\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-1568-\tif (rate-\u003eflags \u0026 IEEE80211_TX_RC_USE_RTS_CTS)\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:1569:\t\tresult \|= MAC80211_HWSIM_TX_RC_USE_RTS_CTS;\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-1570-\tif (rate-\u003eflags \u0026 IEEE80211_TX_RC_USE_CTS_PROTECT)\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:1571:\t\tresult \|= MAC80211_HWSIM_TX_RC_USE_CTS_PROTECT;\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-1572-\tif (rate-\u003eflags \u0026 IEEE80211_TX_RC_USE_SHORT_PREAMBLE)\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:1573:\t\tresult \|= MAC80211_HWSIM_TX_RC_USE_SHORT_PREAMBLE;\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-1574-\tif (rate-\u003eflags \u0026 IEEE80211_TX_RC_MCS)\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:1575:\t\tresult \|= MAC80211_HWSIM_TX_RC_MCS;\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-1576-\tif (rate-\u003eflags \u0026 IEEE80211_TX_RC_GREEN_FIELD)\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:1577:\t\tresult \|= MAC80211_HWSIM_TX_RC_GREEN_FIELD;\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-1578-\tif (rate-\u003eflags \u0026 IEEE80211_TX_RC_40_MHZ_WIDTH)\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:1579:\t\tresult \|= MAC80211_HWSIM_TX_RC_40_MHZ_WIDTH;\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-1580-\tif (rate-\u003eflags \u0026 IEEE80211_TX_RC_DUP_DATA)\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:1581:\t\tresult \|= MAC80211_HWSIM_TX_RC_DUP_DATA;\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-1582-\tif (rate-\u003eflags \u0026 IEEE80211_TX_RC_SHORT_GI)\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:1583:\t\tresult \|= MAC80211_HWSIM_TX_RC_SHORT_GI;\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-1584-\tif (rate-\u003eflags \u0026 IEEE80211_TX_RC_VHT_MCS)\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:1585:\t\tresult \|= MAC80211_HWSIM_TX_RC_VHT_MCS;\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-1586-\tif (rate-\u003eflags \u0026 IEEE80211_TX_RC_80_MHZ_WIDTH)\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:1587:\t\tresult \|= MAC80211_HWSIM_TX_RC_80_MHZ_WIDTH;\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-1588-\tif (rate-\u003eflags \u0026 IEEE80211_TX_RC_160_MHZ_WIDTH)\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:1589:\t\tresult \|= MAC80211_HWSIM_TX_RC_160_MHZ_WIDTH;\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-1590-\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c=3462=static const char mac80211_hwsim_gstrings_stats[][ETH_GSTRING_LEN] = {\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-3472-\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:3473:#define MAC80211_HWSIM_SSTATS_LEN ARRAY_SIZE(mac80211_hwsim_gstrings_stats)\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-3474-\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c=3484=static int mac80211_hwsim_get_et_sset_count(struct ieee80211_hw hw,\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-3487-\tif (sset == ETH_SS_STATS)\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:3488:\t\treturn MAC80211_HWSIM_SSTATS_LEN;\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-3489-\treturn 0;\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c=3492=static void mac80211_hwsim_get_et_stats(struct ieee80211_hw hw,\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-3507-\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:3508:\tWARN_ON(i != MAC80211_HWSIM_SSTATS_LEN);\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-3509-}\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c=5612=static const u8 iftypes_ext_capa_ap[] = {\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-5620-\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:5621:#define MAC80211_HWSIM_MLD_CAPA_OPS\t\t\t\t\\\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-5622-\tFIELD_PREP_CONST(IEEE80211_MLD_CAP_OP_TID_TO_LINK_MAP_NEG_SUPP, \\\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c=5627=static const struct wiphy_iftype_ext_capab mac80211_hwsim_iftypes_ext_capa[] = {\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-5634-\t\t\t\t IEEE80211_EML_CAP_EMLMR_SUPPORT,\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:5635:\t\t.mld_capa_and_ops = MAC80211_HWSIM_MLD_CAPA_OPS,\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-5636-\t},\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c=7083=static struct genl_family hwsim_genl_family __ro_after_init = {\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:7084:\t.name = \"MAC80211_HWSIM\",\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-7085-\t.version = 1,\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c=7402=static void hwsim_virtio_remove(struct virtio_device vdev)\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-7410-\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:7411:/* MAC80211_HWSIM virtio device id table /\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-7412-static const struct virtio_device_id id_table[] = {\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:7413:\t{ VIRTIO_ID_MAC80211_HWSIM, VIRTIO_DEV_ANY_ID },\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-7414-\t{ 0 }\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c=78=static u64 hwsim_nan_get_master_rank(struct mac80211_hwsim_data data)\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-82-\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c:83:\tif (data-\u003enan.phase == MAC80211_HWSIM_NAN_PHASE_UP) {\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-84-\t\tmaster_pref = data-\u003enan.master_pref;\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c=216=void mac80211_hwsim_nan_rx(struct ieee80211_hw hw,\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-273-\tif ((slot != SLOT_24GHZ_DW \u0026\u0026\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c:274:\t data-\u003enan.phase != MAC80211_HWSIM_NAN_PHASE_SCAN) \|\|\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-275-\t rx_status.freq != 2437)\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-436-\t\t (cg == own_cg \u0026\u0026 frame_amr \u003e curr_amr) \|\|\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c:437:\t\t data-\u003enan.phase == MAC80211_HWSIM_NAN_PHASE_SCAN) {\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-438-\t\t\t/ Avoid a state transition /\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-468-\t\t\t /\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c:469:\t\t\tdata-\u003enan.phase = MAC80211_HWSIM_NAN_PHASE_UP;\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-470-\t\t\tdata-\u003enan.random_factor_valid_dwst = 0;\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c=612=mac80211_hwsim_nan_exec_state_transitions(struct mac80211_hwsim_data data)\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-625-\tif (data-\u003enan.master_transition_score \u003c 3)\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c:626:\t\tdata-\u003enan.role = MAC80211_HWSIM_NAN_ROLE_MASTER;\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c:627:\telse if (data-\u003enan.role == MAC80211_HWSIM_NAN_ROLE_MASTER \u0026\u0026\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-628-\t\t data-\u003enan.master_transition_score \u003e= 3)\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c:629:\t\tdata-\u003enan.role = MAC80211_HWSIM_NAN_ROLE_SYNC;\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c:630:\telse if (data-\u003enan.role == MAC80211_HWSIM_NAN_ROLE_SYNC \u0026\u0026\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-631-\t\t data-\u003enan.sync_transition_score \u003e= 3)\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c:632:\t\tdata-\u003enan.role = MAC80211_HWSIM_NAN_ROLE_NON_SYNC;\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c:633:\telse if (data-\u003enan.role == MAC80211_HWSIM_NAN_ROLE_NON_SYNC \u0026\u0026\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-634-\t\t data-\u003enan.sync_transition_score \u003c 3)\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c:635:\t\tdata-\u003enan.role = MAC80211_HWSIM_NAN_ROLE_SYNC;\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-636-\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-641-\t /\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c:642:\tif (data-\u003enan.role == MAC80211_HWSIM_NAN_ROLE_MASTER \u0026\u0026\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-643-\t !hrtimer_active(\u0026data-\u003enan.discovery_beacon_timer))\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-653-\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c:654:\t\tif (data-\u003enan.phase == MAC80211_HWSIM_NAN_PHASE_SCAN) {\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c:655:\t\t\tdata-\u003enan.phase = MAC80211_HWSIM_NAN_PHASE_WARMUP;\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-656-\t\t\tdata-\u003enan.random_factor_valid_dwst = NAN_WARMUP_DWST;\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-659-\t\t} else {\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c:660:\t\t\tdata-\u003enan.phase = MAC80211_HWSIM_NAN_PHASE_UP;\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-661-\t\t\tdata-\u003enan.random_factor_valid_dwst =\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c=695=mac80211_hwsim_nan_tx_beacon(struct mac80211_hwsim_data data,\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-750-\tnan_attr.length = cpu_to_le16(sizeof(master_indication));\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c:751:\tif (data-\u003enan.phase == MAC80211_HWSIM_NAN_PHASE_UP) {\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-752-\t\tmaster_indication.master_pref = data-\u003enan.master_pref;\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c=774=mac80211_hwsim_nan_slot_timer(struct hrtimer timer)\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-807-\t\ttx_sync_beacon =\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c:808:\t\t\tdata-\u003enan.phase != MAC80211_HWSIM_NAN_PHASE_SCAN \u0026\u0026\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c:809:\t\t\tdata-\u003enan.role != MAC80211_HWSIM_NAN_ROLE_NON_SYNC;\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-810-\t}\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c=867=mac80211_hwsim_nan_discovery_beacon_timer(struct hrtimer timer)\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-879-\tscoped_guard(spinlock, \u0026data-\u003enan.state_lock) {\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c:880:\t\tif (data-\u003enan.phase == MAC80211_HWSIM_NAN_PHASE_SCAN \|\|\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c:881:\t\t data-\u003enan.role != MAC80211_HWSIM_NAN_ROLE_MASTER)\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-882-\t\t\treturn HRTIMER_NORESTART;\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c=909=int mac80211_hwsim_nan_start(struct ieee80211_hw hw,\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-926-\t\t/* Start in the \"scan\" phase and stay there for a little bit /\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c:927:\t\tdata-\u003enan.phase = MAC80211_HWSIM_NAN_PHASE_SCAN;\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-928-\t\tdata-\u003enan.random_factor_valid_dwst = 1;\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-930-\t\tdata-\u003enan.master_pref = conf-\u003emaster_pref;\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c:931:\t\tdata-\u003enan.role = MAC80211_HWSIM_NAN_ROLE_MASTER;\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-932-\t\tmemset(\u0026data-\u003enan.current_ami, 0,\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c=1226=bool mac80211_hwsim_nan_receive(struct ieee80211_hw hw,\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-1235-\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c:1236:\tif (data-\u003enan.phase == MAC80211_HWSIM_NAN_PHASE_SCAN)\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-1237-\t\treturn channel-\u003ecenter_freq == 2437;\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.h-6-\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.h:7:#ifndef __MAC80211_HWSIM_NAN_H\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.h:8:#define __MAC80211_HWSIM_NAN_H\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.h-9-\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.h=10=enum mac80211_hwsim_nan_phase {\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.h:11:\tMAC80211_HWSIM_NAN_PHASE_SCAN,\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.h:12:\tMAC80211_HWSIM_NAN_PHASE_WARMUP,\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.h:13:\tMAC80211_HWSIM_NAN_PHASE_UP,\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.h-14-};\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.h=16=enum mac80211_hwsim_nan_role {\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.h:17:\tMAC80211_HWSIM_NAN_ROLE_MASTER,\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.h:18:\tMAC80211_HWSIM_NAN_ROLE_SYNC,\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.h:19:\tMAC80211_HWSIM_NAN_ROLE_NON_SYNC,\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.h-20-};\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.h=99=void mac80211_hwsim_nan_local_sched_changed(struct ieee80211_hw hw,\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.h-101-\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.h:102:#endif / __MAC80211_HWSIM_NAN_H */\n" }
15/2	2026/07/15 23:16	llm	patch-evaluator	0m Model: gemini-3.1-pro-preview Args: null Results: null Tokens: input: 16200 output: 213 thoughts: 480 Thoughts: Analyzing Wireless Driver Vulnerability Okay, so I'm looking at this patch and immediately, the `MAC80211_HWSIM` config jumps out, along with `CFG80211` and `MAC80211` – the usual suspects. My initial thought is to quickly identify key functions related to the core issue. I need to understand the attack surface. First, I need to check the scope of the target functions. I see `cfg80211_parse_mbssid_data`. Let's confirm if it's exported or static. It's static, which limits direct external access. Then, `cfg80211_merge_profile` is exported. `cfg80211_iter_profile_continuation` appears to be static as well. So the main symbols I should focus on are `cfg80211_iter_profile_continuation`, `cfg80211_merge_profile` and `cfg80211_parse_mbssid_data`. Hang on, let me quickly verify what I'm seeing for `cfg80211_iter_profile_continuation`, is it `static inline` or just static? Ok, it's `static bool cfg80211_iter_profile_continuation(...)`, that's good. Just to be thorough, I should look for other related functions. Let me see...I see `cfg80211_inform_single_bss_data` and `cfg80211_inform_bss_data`. These might also be relevant, but I'm going to set these aside for now. Given that I have a good handle on `cfg80211_merge_profile` and `cfg80211_parse_mbssid_data` I think I should be good. Right, time to solidify my understanding. The patch is about fixing a parsing issue related to Multiple BSSID (MBSSID) elements within wireless scan results. It seems the fix alters the profile continuation iteration via `cfg80211_iter_profile_continuation` and `cfg80211_merge_profile`. This is reachable wireless logic and, critically, is triggered by crafted management frames – beacons, probe responses – that contain malicious MBSSID data. That means we could have a potential vulnerability here. It's functional, meaning it should be easy to fuzz and I will set up set-results for this now. Configs: `CFG80211` `MAC80211` `MAC80211_HWSIM` Focus symbols: `cfg80211_iter_profile_continuation` `cfg80211_merge_profile` `cfg80211_parse_mbssid_data`
16/2	2026/07/15 23:16	tool	set-results	0m Args: { "EnableConfigs": [ "CFG80211", "MAC80211", "MAC80211_HWSIM" ], "FocusSymbols": [ "cfg80211_iter_profile_continuation", "cfg80211_merge_profile", "cfg80211_parse_mbssid_data" ], "Reasoning": "The patch modifies the parsing logic for Multiple BSSID (MBSSID) elements in wireless scan results. It introduces `cfg80211_iter_profile_continuation` to correctly iterate over profile continuations and updates `cfg80211_merge_profile` to use it. This is reachable core wireless logic that can be triggered by processing malicious management frames (e.g., beacons or probe responses) containing crafted MBSSID information elements. It is functional and should be fuzzed.", "WorthFuzzing": true } Results: { "EnableConfigs": [ "CFG80211", "MAC80211", "MAC80211_HWSIM" ], "FocusSymbols": [ "cfg80211_iter_profile_continuation", "cfg80211_merge_profile", "cfg80211_parse_mbssid_data" ], "Reasoning": "The patch modifies the parsing logic for Multiple BSSID (MBSSID) elements in wireless scan results. It introduces `cfg80211_iter_profile_continuation` to correctly iterate over profile continuations and updates `cfg80211_merge_profile` to use it. This is reachable core wireless logic that can be triggered by processing malicious management frames (e.g., beacons or probe responses) containing crafted MBSSID information elements. It is functional and should be fuzzed.", "WorthFuzzing": true }

{
  "EnableConfigs": [
    "CFG80211",
    "MAC80211",
    "MAC80211_HWSIM"
  ],
  "FocusSymbols": [
    "cfg80211_iter_profile_continuation",
    "cfg80211_merge_profile",
    "cfg80211_parse_mbssid_data"
  ],
  "Reasoning": "The patch modifies the parsing logic for Multiple BSSID (MBSSID) elements in wireless scan results. It introduces `cfg80211_iter_profile_continuation` to correctly iterate over profile continuations and updates `cfg80211_merge_profile` to use it. This is reachable core wireless logic that can be triggered by processing malicious management frames (e.g., beacons or probe responses) containing crafted MBSSID information elements. It is functional and should be fuzzed.",
  "WorthFuzzing": true
}

{
  "PatchDiff": "commit a255ac2fe708f837a467179e525e4a69112bc6c2\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Wed Jul 15 23:15:34 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/net/wireless/scan.c b/net/wireless/scan.c\nindex 05b7dc6b766ce9..e62b7dd2b7c2d8 100644\n--- a/net/wireless/scan.c\n+++ b/net/wireless/scan.c\n@@ -2403,12 +2403,11 @@ cfg80211_inform_single_bss_data(struct wiphy *wiphy,\n \treturn NULL;\n }\n \n-static const struct element\n-*cfg80211_get_profile_continuation(const u8 *ie, size_t ielen,\n-\t\t\t\t   const struct element *mbssid_elem,\n-\t\t\t\t   const struct element *sub_elem)\n+static bool cfg80211_iter_profile_continuation(const u8 *ie, size_t ielen,\n+\t\t\t\t\t       const struct element **mbssid,\n+\t\t\t\t\t       const struct element **sub_elem)\n {\n-\tconst u8 *mbssid_end = mbssid_elem-\u003edata + mbssid_elem-\u003edatalen;\n+\tconst u8 *mbssid_end = (*mbssid)-\u003edata + (*mbssid)-\u003edatalen;\n \tconst struct element *next_mbssid;\n \tconst struct element *next_sub;\n \n@@ -2420,30 +2419,34 @@ static const struct element\n \t * If it is not the last subelement in current MBSSID IE or there isn't\n \t * a next MBSSID IE - profile is complete.\n \t*/\n-\tif ((sub_elem-\u003edata + sub_elem-\u003edatalen \u003c mbssid_end - 1) ||\n+\tif (((*sub_elem)-\u003edata + (*sub_elem)-\u003edatalen \u003c mbssid_end - 1) ||\n \t    !next_mbssid)\n-\t\treturn NULL;\n+\t\treturn false;\n \n-\t/* For any length error, just return NULL */\n+\t/* For any length error, just return false to stop iteration */\n \n \tif (next_mbssid-\u003edatalen \u003c 4)\n-\t\treturn NULL;\n+\t\treturn false;\n \n \tnext_sub = (void *)\u0026next_mbssid-\u003edata[1];\n \n \tif (next_mbssid-\u003edata + next_mbssid-\u003edatalen \u003c\n \t    next_sub-\u003edata + next_sub-\u003edatalen)\n-\t\treturn NULL;\n+\t\treturn false;\n \n \tif (next_sub-\u003eid != 0 || next_sub-\u003edatalen \u003c 2)\n-\t\treturn NULL;\n+\t\treturn false;\n \n \t/*\n \t * Check if the first element in the next sub element is a start\n \t * of a new profile\n \t */\n-\treturn next_sub-\u003edata[0] == WLAN_EID_NON_TX_BSSID_CAP ?\n-\t       NULL : next_mbssid;\n+\tif (next_sub-\u003edata[0] == WLAN_EID_NON_TX_BSSID_CAP)\n+\t\treturn false;\n+\n+\t*mbssid = next_mbssid;\n+\t*sub_elem = next_sub;\n+\treturn true;\n }\n \n size_t cfg80211_merge_profile(const u8 *ie, size_t ielen,\n@@ -2452,26 +2455,20 @@ size_t cfg80211_merge_profile(const u8 *ie, size_t ielen,\n \t\t\t      u8 *merged_ie, size_t max_copy_len)\n {\n \tsize_t copied_len = sub_elem-\u003edatalen;\n-\tconst struct element *next_mbssid;\n \n \tif (sub_elem-\u003edatalen \u003e max_copy_len)\n \t\treturn 0;\n \n \tmemcpy(merged_ie, sub_elem-\u003edata, sub_elem-\u003edatalen);\n \n-\twhile ((next_mbssid = cfg80211_get_profile_continuation(ie, ielen,\n-\t\t\t\t\t\t\t\tmbssid_elem,\n-\t\t\t\t\t\t\t\tsub_elem))) {\n-\t\tconst struct element *next_sub = (void *)\u0026next_mbssid-\u003edata[1];\n-\n-\t\tif (copied_len + next_sub-\u003edatalen \u003e max_copy_len)\n+\twhile (cfg80211_iter_profile_continuation(ie, ielen,\n+\t\t\t\t\t\t  \u0026mbssid_elem,\n+\t\t\t\t\t\t  \u0026sub_elem)) {\n+\t\tif (copied_len + sub_elem-\u003edatalen \u003e max_copy_len)\n \t\t\tbreak;\n-\t\tmemcpy(merged_ie + copied_len, next_sub-\u003edata,\n-\t\t       next_sub-\u003edatalen);\n-\t\tcopied_len += next_sub-\u003edatalen;\n-\n-\t\tmbssid_elem = next_mbssid;\n-\t\tsub_elem = next_sub;\n+\t\tmemcpy(merged_ie + copied_len, sub_elem-\u003edata,\n+\t\t       sub_elem-\u003edatalen);\n+\t\tcopied_len += sub_elem-\u003edatalen;\n \t}\n \n \treturn copied_len;\n"
}

gemini-3.1-pro-preview

{
  "EnableConfigs": [
    "CFG80211",
    "MAC80211",
    "MAC80211_HWSIM"
  ],
  "FocusSymbols": [
    "cfg80211_iter_profile_continuation",
    "cfg80211_merge_profile",
    "cfg80211_parse_mbssid_data"
  ],
  "Reasoning": "The patch modifies the parsing logic for Multiple BSSID (MBSSID) elements in wireless scan results. It introduces `cfg80211_iter_profile_continuation` to correctly iterate over profile continuations and updates `cfg80211_merge_profile` to use it. This is reachable core wireless logic that can be triggered by processing malicious management frames (e.g., beacons or probe responses) containing crafted MBSSID information elements. It is functional and should be fuzzed.",
  "WorthFuzzing": true
}

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Do not list too generic configs (we already have them enabled). Only list those that
   specifically cover the modified code. List them in the EnableConfigs output array,
   and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit a255ac2fe708f837a467179e525e4a69112bc6c2
Author: syz-cluster <triage@syzkaller.com>
Date:   Wed Jul 15 23:15:34 2026 +0000

    syz-cluster: applied patch under review

diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 05b7dc6b766ce9..e62b7dd2b7c2d8 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -2403,12 +2403,11 @@ cfg80211_inform_single_bss_data(struct wiphy *wiphy,
 	return NULL;
 }
 
-static const struct element
-*cfg80211_get_profile_continuation(const u8 *ie, size_t ielen,
-				   const struct element *mbssid_elem,
-				   const struct element *sub_elem)
+static bool cfg80211_iter_profile_continuation(const u8 *ie, size_t ielen,
+					       const struct element **mbssid,
+					       const struct element **sub_elem)
 {
-	const u8 *mbssid_end = mbssid_elem->data + mbssid_elem->datalen;
+	const u8 *mbssid_end = (*mbssid)->data + (*mbssid)->datalen;
 	const struct element *next_mbssid;
 	const struct element *next_sub;
 
@@ -2420,30 +2419,34 @@ static const struct element
 	 * If it is not the last subelement in current MBSSID IE or there isn't
 	 * a next MBSSID IE - profile is complete.
 	*/
-	if ((sub_elem->data + sub_elem->datalen < mbssid_end - 1) ||
+	if (((*sub_elem)->data + (*sub_elem)->datalen < mbssid_end - 1) ||
 	    !next_mbssid)
-		return NULL;
+		return false;
 
-	/* For any length error, just return NULL */
+	/* For any length error, just return false to stop iteration */
 
 	if (next_mbssid->datalen < 4)
-		return NULL;
+		return false;
 
 	next_sub = (void *)&next_mbssid->data[1];
 
 	if (next_mbssid->data + next_mbssid->datalen <
 	    next_sub->data + next_sub->datalen)
-		return NULL;
+		return false;
 
 	if (next_sub->id != 0 || next_sub->datalen < 2)
-		return NULL;
+		return false;
 
 	/*
 	 * Check if the first element in the next sub element is a start
 	 * of a new profile
 	 */
-	return next_sub->data[0] == WLAN_EID_NON_TX_BSSID_CAP ?
-	       NULL : next_mbssid;
+	if (next_sub->data[0] == WLAN_EID_NON_TX_BSSID_CAP)
+		return false;
+
+	*mbssid = next_mbssid;
+	*sub_elem = next_sub;
+	return true;
 }
 
 size_t cfg80211_merge_profile(const u8 *ie, size_t ielen,
@@ -2452,26 +2455,20 @@ size_t cfg80211_merge_profile(const u8 *ie, size_t ielen,
 			      u8 *merged_ie, size_t max_copy_len)
 {
 	size_t copied_len = sub_elem->datalen;
-	const struct element *next_mbssid;
 
 	if (sub_elem->datalen > max_copy_len)
 		return 0;
 
 	memcpy(merged_ie, sub_elem->data, sub_elem->datalen);
 
-	while ((next_mbssid = cfg80211_get_profile_continuation(ie, ielen,
-								mbssid_elem,
-								sub_elem))) {
-		const struct element *next_sub = (void *)&next_mbssid->data[1];
-
-		if (copied_len + next_sub->datalen > max_copy_len)
+	while (cfg80211_iter_profile_continuation(ie, ielen,
+						  &mbssid_elem,
+						  &sub_elem)) {
+		if (copied_len + sub_elem->datalen > max_copy_len)
 			break;
-		memcpy(merged_ie + copied_len, next_sub->data,
-		       next_sub->datalen);
-		copied_len += next_sub->datalen;
-
-		mbssid_elem = next_mbssid;
-		sub_elem = next_sub;
+		memcpy(merged_ie + copied_len, sub_elem->data,
+		       sub_elem->datalen);
+		copied_len += sub_elem->datalen;
 	}
 
 	return copied_len;

gemini-3.1-pro-preview

							input: 2872
							output: 28
							thoughts: 173

**Analyzing a Wireless Stack Patch**

Okay, so I'm looking at this patch and it seems like it's a relatively focused change. Specifically, the focus is on `net/wireless/scan.c`. The core of the alteration appears to be a name change, from `cfg80211_get_profile_continuation` to `cfg80211_iter_profile_continuation`. Functionally, this likely indicates an iteration is replacing a simple retrieval process for profiles. The `cfg80211_merge_profile` function has also been updated to utilize this new iterator. This clearly falls within the realm of the wireless stack, specifically the mac80211/cfg80211 components. Given the nature of these changes, I would expect this to be something fuzzed with `mac80211_hwsim`, which I'll keep in mind for testing.

Now, before I dig deeper, I need to verify a few things. First, let's confirm the relevant configurations. Based on the file path, `net/wireless/scan.c` falls under the `cfg80211` umbrella, so the `CFG80211` config option will need to be enabled. I’ll double-check `net/wireless/Makefile` to corroborate that this is the correct dependency. This quick verification will ensure I can reproduce and analyze this code correctly within my test environments.

{
  "Expression": "scan\\.o",
  "PathPrefix": "net/wireless/Makefile"
}

{
  "Output": "net/wireless/Makefile=7=obj-$(CONFIG_WEXT_PRIV) += wext-priv.o\nnet/wireless/Makefile-8-\nnet/wireless/Makefile:9:cfg80211-y += core.o sysfs.o radiotap.o util.o reg.o scan.o nl80211.o\nnet/wireless/Makefile-10-cfg80211-y += mlme.o ibss.o sme.o chan.o ethtool.o mesh.o ap.o trace.o ocb.o\n"
}

gemini-3.1-pro-preview

							input: 3529
							output: 31
							thoughts: 58

**Navigating the Wireless Configuration**

Okay, so I'm focusing on wireless configuration right now. Seems like `CFG80211` is the key configuration area. Wait, I remember now, `cfg80211-y` is only compiled into the kernel when `CONFIG_CFG80211` is explicitly enabled. Need to double-check that Makefile in `net/wireless` to confirm my understanding of the build process and dependencies. Let's make sure I'm following the logic correctly.

{
  "Expression": "cfg80211",
  "PathPrefix": "net/wireless/Makefile"
}

{
  "Output": "net/wireless/Makefile-1-# SPDX-License-Identifier: GPL-2.0\nnet/wireless/Makefile:2:obj-$(CONFIG_CFG80211) += cfg80211.o\nnet/wireless/Makefile-3-obj-y += tests/\n--\nnet/wireless/Makefile=7=obj-$(CONFIG_WEXT_PRIV) += wext-priv.o\nnet/wireless/Makefile-8-\nnet/wireless/Makefile:9:cfg80211-y += core.o sysfs.o radiotap.o util.o reg.o scan.o nl80211.o\nnet/wireless/Makefile:10:cfg80211-y += mlme.o ibss.o sme.o chan.o ethtool.o mesh.o ap.o trace.o ocb.o\nnet/wireless/Makefile:11:cfg80211-y += michael-mic.o pmsr.o\nnet/wireless/Makefile:12:cfg80211-$(CONFIG_OF) += of.o\nnet/wireless/Makefile:13:cfg80211-$(CONFIG_CFG80211_DEBUGFS) += debugfs.o\nnet/wireless/Makefile:14:cfg80211-$(CONFIG_CFG80211_WEXT) += wext-compat.o wext-sme.o\nnet/wireless/Makefile-15-\nnet/wireless/Makefile=16=CFLAGS_trace.o := -I$(src)\nnet/wireless/Makefile-17-\nnet/wireless/Makefile:18:cfg80211-$(CONFIG_CFG80211_USE_KERNEL_REGDB_KEYS) += shipped-certs.o\nnet/wireless/Makefile-19-ifneq ($(CONFIG_CFG80211_EXTRA_REGDB_KEYDIR),)\nnet/wireless/Makefile:20:cfg80211-y += extra-certs.o\nnet/wireless/Makefile-21-endif\n"
}

gemini-3.1-pro-preview

							input: 4231
							output: 37
							thoughts: 59

Here's my take on those thoughts:

**Navigating the Wireless Configuration Labyrinth**

Okay, so we're starting with `CONFIG_CFG80211`. That's the baseline, the core of the wireless config, no surprises there. But now I'm wondering, do we have something more granular for Multi-BSSID or for specific scanning behaviors? It's a common question when tuning or debugging. I can't immediately recall a specific config option jumping to mind.

Alright, time to dig. My instinct is telling me to look around `net/wireless/scan.c`, especially near the `cfg80211_merge_profile` function. That's where a lot of the scanning logic and profile management happens, so it’s a good starting point to hunt for any MBSSID-related hooks or scan-specific configurations that might be in play. Hopefully, that will lead me to the relevant settings!

{
  "Expression": "cfg80211_merge_profile",
  "PathPrefix": "net/wireless/scan.c"
}

{
  "Output": "net/wireless/scan.c=2406=static bool cfg80211_iter_profile_continuation(const u8 *ie, size_t ielen,\n--\nnet/wireless/scan.c-2451-\nnet/wireless/scan.c:2452:size_t cfg80211_merge_profile(const u8 *ie, size_t ielen,\nnet/wireless/scan.c-2453-\t\t\t      const struct element *mbssid_elem,\n--\nnet/wireless/scan.c-2475-}\nnet/wireless/scan.c:2476:EXPORT_SYMBOL(cfg80211_merge_profile);\nnet/wireless/scan.c-2477-\n--\nnet/wireless/scan.c=2479=cfg80211_parse_mbssid_data(struct wiphy *wiphy,\n--\nnet/wireless/scan.c-2543-\t\t\tmemset(profile, 0, tx_data-\u003eielen);\nnet/wireless/scan.c:2544:\t\t\tprofile_len = cfg80211_merge_profile(tx_data-\u003eie,\nnet/wireless/scan.c-2545-\t\t\t\t\t\t\t     tx_data-\u003eielen,\n"
}

gemini-3.1-pro-preview

							input: 4849
							output: 40
							thoughts: 288

**Analyzing Wireless Configuration and Testing**

Okay, so I'm looking at this `cfg80211_merge_profile` function, exported from the `cfg80211` core. That's a key part of the wireless configuration stack, obviously. I also see `MAC80211_HWSIM` mentioned – that's the hardware simulator for testing, and a handy tool. My initial thought is to figure out if we *need* `MAC80211_HWSIM`, although the focus is really the `CFG80211` core. But wait, `MAC80211_HWSIM` is a *driver*, right? So, including it seems like a sensible move for ensuring comprehensive testability of the wireless stack. Really, `CFG80211` and `MAC80211` together are the important building blocks.

Now, let's drill down into the relevant functions. I'm focusing on `cfg80211_iter_profile_continuation`, `cfg80211_merge_profile`, and `cfg80211_parse_mbssid_data` because it calls `cfg80211_merge_profile`. Let's clarify if `cfg80211_iter_profile_continuation` is static internally. Ah, yes, it is. `cfg80211_merge_profile` is exported. Now, what about `cfg80211_parse_mbssid_data`? Is it static or exported? I'll need to check that one.

{
  "Expression": "cfg80211_parse_mbssid_data",
  "PathPrefix": "net/wireless/scan.c"
}

{
  "Output": "net/wireless/scan.c=2478=static void\nnet/wireless/scan.c:2479:cfg80211_parse_mbssid_data(struct wiphy *wiphy,\nnet/wireless/scan.c-2480-\t\t\t   struct cfg80211_inform_single_bss_data *tx_data,\n--\nnet/wireless/scan.c=3211=cfg80211_inform_bss_data(struct wiphy *wiphy,\n--\nnet/wireless/scan.c-3242-\nnet/wireless/scan.c:3243:\tcfg80211_parse_mbssid_data(wiphy, \u0026inform_data, res, gfp);\nnet/wireless/scan.c-3244-\n"
}

gemini-3.1-pro-preview

							input: 5740
							output: 39
							thoughts: 17

Here's a summary of my thought process:

**Investigating the Export Status of `cfg80211_inform_bss_data`**

Okay, so I'm thinking about this function, `cfg80211_inform_bss_data`. It's one of those core wireless configuration and networking pieces. The question that's rattling around in my head is: is it exported? Specifically, is this function *exported* from whatever module it resides in? That's a crucial piece of information. Knowing if it's exported means everything. It dictates how easy it is to interact with this function from outside the module, if I need to. If it's exported, then I can call it directly and get access to its capabilities. If it's not exported, then I need to figure out other ways to use it. Knowing its export status gives me the foundation to determine how flexible my interaction with this function can be. It shapes my entire approach to understanding and utilizing this particular piece of networking infrastructure. I need to know!

{
  "Expression": "cfg80211_inform_bss_data",
  "PathPrefix": "net/wireless/scan.c"
}

{
  "Output": "net/wireless/scan.c=3210=struct cfg80211_bss *\nnet/wireless/scan.c:3211:cfg80211_inform_bss_data(struct wiphy *wiphy,\nnet/wireless/scan.c-3212-\t\t\t struct cfg80211_inform_bss *data,\n--\nnet/wireless/scan.c-3248-}\nnet/wireless/scan.c:3249:EXPORT_SYMBOL(cfg80211_inform_bss_data);\nnet/wireless/scan.c-3250-\n--\nnet/wireless/scan.c=3252=cfg80211_inform_bss_frame_data(struct wiphy *wiphy,\n--\nnet/wireless/scan.c-3325-\nnet/wireless/scan.c:3326:\treturn cfg80211_inform_bss_data(wiphy, data, ftype,\nnet/wireless/scan.c-3327-\t\t\t\t\tbssid, tsf, capability,\n"
}

gemini-3.1-pro-preview

							input: 6292
							output: 36
							thoughts: 433

**Analyzing the MBSSID Parsing Fix**

Okay, so `cfg80211_inform_bss_data` is exported. My initial thought is to zero in on a few functions: `cfg80211_iter_profile_continuation`, `cfg80211_merge_profile`, and `cfg80211_parse_mbssid_data`. I'm wondering if `cfg80211_inform_bss_data` is a performance bottleneck here. It's triggered with every BSS discovery, during a scan, so it might have a moderate impact, but probably isn't the primary area of concern. `cfg80211_merge_profile` and `cfg80211_parse_mbssid_data` are likely to be more interesting.

Let's quickly confirm what configs are needed; `CFG80211` is obviously essential. I can also use `MAC80211_HWSIM` for effective software-based wireless testing. I should verify that's the correct name and confirm it's enabled.

Now, a quick check: `cfg80211_iter_profile_continuation` is defined as static, as I suspected.

The core of this patch seems to address a bug in how Multiple BSSID (MBSSID) elements are parsed from wireless scan results. It revises how profile continuations are iterated, modifying `cfg80211_iter_profile_continuation` and `cfg80211_merge_profile`. This is clearly reachable core wireless logic, vulnerable to crafted management frames (beacons or probe responses) containing malicious MBSSID information elements. This has functional implications, and I need to prioritize it for fuzzing.

My list of essential configs and symbols is confirmed:

Configs:
`CFG80211`
`MAC80211`
`MAC80211_HWSIM`

Focus symbols:
`cfg80211_iter_profile_continuation`
`cfg80211_merge_profile`
`cfg80211_parse_mbssid_data`

{
  "Expression": "MAC80211_HWSIM",
  "PathPrefix": "drivers/net/wireless/"
}

{
  "Output": "drivers/net/wireless/virtual/Kconfig:1:config MAC80211_HWSIM\ndrivers/net/wireless/virtual/Kconfig-2-\ttristate \"Simulated radio testing tool for mac80211\"\n--\ndrivers/net/wireless/virtual/Makefile:1:obj-$(CONFIG_MAC80211_HWSIM)\t+= mac80211_hwsim.o\ndrivers/net/wireless/virtual/Makefile-2-mac80211_hwsim-objs\t\t+= mac80211_hwsim_main.o\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.h-8-\ndrivers/net/wireless/virtual/mac80211_hwsim.h:9:#ifndef __MAC80211_HWSIM_H\ndrivers/net/wireless/virtual/mac80211_hwsim.h:10:#define __MAC80211_HWSIM_H\ndrivers/net/wireless/virtual/mac80211_hwsim.h-11-\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.h=217=struct hwsim_tx_rate {\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.h-230- *\ndrivers/net/wireless/virtual/mac80211_hwsim.h:231: * @MAC80211_HWSIM_TX_RC_USE_RTS_CTS: Use RTS/CTS exchange for this rate.\ndrivers/net/wireless/virtual/mac80211_hwsim.h:232: * @MAC80211_HWSIM_TX_RC_USE_CTS_PROTECT: CTS-to-self protection is required.\ndrivers/net/wireless/virtual/mac80211_hwsim.h-233- *\tThis is set if the current BSS requires ERP protection.\ndrivers/net/wireless/virtual/mac80211_hwsim.h:234: * @MAC80211_HWSIM_TX_RC_USE_SHORT_PREAMBLE: Use short preamble.\ndrivers/net/wireless/virtual/mac80211_hwsim.h:235: * @MAC80211_HWSIM_TX_RC_MCS: HT rate.\ndrivers/net/wireless/virtual/mac80211_hwsim.h:236: * @MAC80211_HWSIM_TX_RC_VHT_MCS: VHT MCS rate, in this case the idx field is\ndrivers/net/wireless/virtual/mac80211_hwsim.h-237- *\tsplit into a higher 4 bits (Nss) and lower 4 bits (MCS number)\ndrivers/net/wireless/virtual/mac80211_hwsim.h:238: * @MAC80211_HWSIM_TX_RC_GREEN_FIELD: Indicates whether this rate should be used\ndrivers/net/wireless/virtual/mac80211_hwsim.h-239- *\tin Greenfield mode.\ndrivers/net/wireless/virtual/mac80211_hwsim.h:240: * @MAC80211_HWSIM_TX_RC_40_MHZ_WIDTH: Indicates if the Channel Width should be\ndrivers/net/wireless/virtual/mac80211_hwsim.h-241- *\t40 MHz.\ndrivers/net/wireless/virtual/mac80211_hwsim.h:242: * @MAC80211_HWSIM_TX_RC_80_MHZ_WIDTH: Indicates 80 MHz transmission\ndrivers/net/wireless/virtual/mac80211_hwsim.h:243: * @MAC80211_HWSIM_TX_RC_160_MHZ_WIDTH: Indicates 160 MHz transmission\ndrivers/net/wireless/virtual/mac80211_hwsim.h-244- *\t(80+80 isn't supported yet)\ndrivers/net/wireless/virtual/mac80211_hwsim.h:245: * @MAC80211_HWSIM_TX_RC_DUP_DATA: The frame should be transmitted on both of\ndrivers/net/wireless/virtual/mac80211_hwsim.h-246- *\tthe adjacent 20 MHz channels, if the current channel type is\ndrivers/net/wireless/virtual/mac80211_hwsim.h-247- *\tNL80211_CHAN_HT40MINUS or NL80211_CHAN_HT40PLUS.\ndrivers/net/wireless/virtual/mac80211_hwsim.h:248: * @MAC80211_HWSIM_TX_RC_SHORT_GI: Short Guard interval should be used for this\ndrivers/net/wireless/virtual/mac80211_hwsim.h-249- *\trate.\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.h=251=enum hwsim_tx_rate_flags {\ndrivers/net/wireless/virtual/mac80211_hwsim.h:252:\tMAC80211_HWSIM_TX_RC_USE_RTS_CTS\t\t= BIT(0),\ndrivers/net/wireless/virtual/mac80211_hwsim.h:253:\tMAC80211_HWSIM_TX_RC_USE_CTS_PROTECT\t\t= BIT(1),\ndrivers/net/wireless/virtual/mac80211_hwsim.h:254:\tMAC80211_HWSIM_TX_RC_USE_SHORT_PREAMBLE\t= BIT(2),\ndrivers/net/wireless/virtual/mac80211_hwsim.h-255-\ndrivers/net/wireless/virtual/mac80211_hwsim.h-256-\t/* rate index is an HT/VHT MCS instead of an index */\ndrivers/net/wireless/virtual/mac80211_hwsim.h:257:\tMAC80211_HWSIM_TX_RC_MCS\t\t\t= BIT(3),\ndrivers/net/wireless/virtual/mac80211_hwsim.h:258:\tMAC80211_HWSIM_TX_RC_GREEN_FIELD\t\t= BIT(4),\ndrivers/net/wireless/virtual/mac80211_hwsim.h:259:\tMAC80211_HWSIM_TX_RC_40_MHZ_WIDTH\t\t= BIT(5),\ndrivers/net/wireless/virtual/mac80211_hwsim.h:260:\tMAC80211_HWSIM_TX_RC_DUP_DATA\t\t= BIT(6),\ndrivers/net/wireless/virtual/mac80211_hwsim.h:261:\tMAC80211_HWSIM_TX_RC_SHORT_GI\t\t= BIT(7),\ndrivers/net/wireless/virtual/mac80211_hwsim.h:262:\tMAC80211_HWSIM_TX_RC_VHT_MCS\t\t\t= BIT(8),\ndrivers/net/wireless/virtual/mac80211_hwsim.h:263:\tMAC80211_HWSIM_TX_RC_80_MHZ_WIDTH\t\t= BIT(9),\ndrivers/net/wireless/virtual/mac80211_hwsim.h:264:\tMAC80211_HWSIM_TX_RC_160_MHZ_WIDTH\t\t= BIT(10),\ndrivers/net/wireless/virtual/mac80211_hwsim.h-265-};\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.h=328=enum hwsim_rate_info_attributes {\n--\ndrivers/net/wireless/virtual/mac80211_hwsim.h-347-\ndrivers/net/wireless/virtual/mac80211_hwsim.h:348:#endif /* __MAC80211_HWSIM_H */\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_i.h-9-\ndrivers/net/wireless/virtual/mac80211_hwsim_i.h:10:#ifndef __MAC80211_HWSIM_I_H\ndrivers/net/wireless/virtual/mac80211_hwsim_i.h:11:#define __MAC80211_HWSIM_I_H\ndrivers/net/wireless/virtual/mac80211_hwsim_i.h-12-\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_i.h=165=void ieee80211_hwsim_wake_tx_queue(struct ieee80211_hw *hw,\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_i.h-167-\ndrivers/net/wireless/virtual/mac80211_hwsim_i.h:168:#endif /* __MAC80211_HWSIM_I_H */\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c=712=static struct mac80211_hwsim_data *get_hwsim_data_ref_from_addr(const u8 *addr)\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-716-\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:717:/* MAC80211_HWSIM netlink family */\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-718-static struct genl_family hwsim_genl_family;\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c=724=static const struct genl_multicast_group hwsim_mcgrps[] = {\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-727-\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:728:/* MAC80211_HWSIM netlink policy */\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-729-\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c=865=static const struct nla_policy hwsim_genl_policy[HWSIM_ATTR_MAX + 1] = {\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-901-\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:902:/* MAC80211_HWSIM virtio queues */\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-903-static struct virtqueue *hwsim_vqs[HWSIM_NUM_VQS];\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c=1564=static inline u16 trans_tx_rate_flags_ieee2hwsim(struct ieee80211_tx_rate *rate)\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-1568-\tif (rate-\u003eflags \u0026 IEEE80211_TX_RC_USE_RTS_CTS)\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:1569:\t\tresult |= MAC80211_HWSIM_TX_RC_USE_RTS_CTS;\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-1570-\tif (rate-\u003eflags \u0026 IEEE80211_TX_RC_USE_CTS_PROTECT)\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:1571:\t\tresult |= MAC80211_HWSIM_TX_RC_USE_CTS_PROTECT;\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-1572-\tif (rate-\u003eflags \u0026 IEEE80211_TX_RC_USE_SHORT_PREAMBLE)\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:1573:\t\tresult |= MAC80211_HWSIM_TX_RC_USE_SHORT_PREAMBLE;\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-1574-\tif (rate-\u003eflags \u0026 IEEE80211_TX_RC_MCS)\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:1575:\t\tresult |= MAC80211_HWSIM_TX_RC_MCS;\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-1576-\tif (rate-\u003eflags \u0026 IEEE80211_TX_RC_GREEN_FIELD)\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:1577:\t\tresult |= MAC80211_HWSIM_TX_RC_GREEN_FIELD;\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-1578-\tif (rate-\u003eflags \u0026 IEEE80211_TX_RC_40_MHZ_WIDTH)\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:1579:\t\tresult |= MAC80211_HWSIM_TX_RC_40_MHZ_WIDTH;\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-1580-\tif (rate-\u003eflags \u0026 IEEE80211_TX_RC_DUP_DATA)\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:1581:\t\tresult |= MAC80211_HWSIM_TX_RC_DUP_DATA;\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-1582-\tif (rate-\u003eflags \u0026 IEEE80211_TX_RC_SHORT_GI)\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:1583:\t\tresult |= MAC80211_HWSIM_TX_RC_SHORT_GI;\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-1584-\tif (rate-\u003eflags \u0026 IEEE80211_TX_RC_VHT_MCS)\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:1585:\t\tresult |= MAC80211_HWSIM_TX_RC_VHT_MCS;\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-1586-\tif (rate-\u003eflags \u0026 IEEE80211_TX_RC_80_MHZ_WIDTH)\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:1587:\t\tresult |= MAC80211_HWSIM_TX_RC_80_MHZ_WIDTH;\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-1588-\tif (rate-\u003eflags \u0026 IEEE80211_TX_RC_160_MHZ_WIDTH)\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:1589:\t\tresult |= MAC80211_HWSIM_TX_RC_160_MHZ_WIDTH;\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-1590-\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c=3462=static const char mac80211_hwsim_gstrings_stats[][ETH_GSTRING_LEN] = {\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-3472-\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:3473:#define MAC80211_HWSIM_SSTATS_LEN ARRAY_SIZE(mac80211_hwsim_gstrings_stats)\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-3474-\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c=3484=static int mac80211_hwsim_get_et_sset_count(struct ieee80211_hw *hw,\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-3487-\tif (sset == ETH_SS_STATS)\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:3488:\t\treturn MAC80211_HWSIM_SSTATS_LEN;\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-3489-\treturn 0;\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c=3492=static void mac80211_hwsim_get_et_stats(struct ieee80211_hw *hw,\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-3507-\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:3508:\tWARN_ON(i != MAC80211_HWSIM_SSTATS_LEN);\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-3509-}\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c=5612=static const u8 iftypes_ext_capa_ap[] = {\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-5620-\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:5621:#define MAC80211_HWSIM_MLD_CAPA_OPS\t\t\t\t\\\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-5622-\tFIELD_PREP_CONST(IEEE80211_MLD_CAP_OP_TID_TO_LINK_MAP_NEG_SUPP, \\\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c=5627=static const struct wiphy_iftype_ext_capab mac80211_hwsim_iftypes_ext_capa[] = {\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-5634-\t\t\t\t    IEEE80211_EML_CAP_EMLMR_SUPPORT,\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:5635:\t\t.mld_capa_and_ops = MAC80211_HWSIM_MLD_CAPA_OPS,\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-5636-\t},\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c=7083=static struct genl_family hwsim_genl_family __ro_after_init = {\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:7084:\t.name = \"MAC80211_HWSIM\",\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-7085-\t.version = 1,\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c=7402=static void hwsim_virtio_remove(struct virtio_device *vdev)\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-7410-\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:7411:/* MAC80211_HWSIM virtio device id table */\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-7412-static const struct virtio_device_id id_table[] = {\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c:7413:\t{ VIRTIO_ID_MAC80211_HWSIM, VIRTIO_DEV_ANY_ID },\ndrivers/net/wireless/virtual/mac80211_hwsim_main.c-7414-\t{ 0 }\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c=78=static u64 hwsim_nan_get_master_rank(struct mac80211_hwsim_data *data)\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-82-\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c:83:\tif (data-\u003enan.phase == MAC80211_HWSIM_NAN_PHASE_UP) {\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-84-\t\tmaster_pref = data-\u003enan.master_pref;\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c=216=void mac80211_hwsim_nan_rx(struct ieee80211_hw *hw,\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-273-\tif ((slot != SLOT_24GHZ_DW \u0026\u0026\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c:274:\t     data-\u003enan.phase != MAC80211_HWSIM_NAN_PHASE_SCAN) ||\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-275-\t    rx_status.freq != 2437)\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-436-\t\t    (cg == own_cg \u0026\u0026 frame_amr \u003e curr_amr) ||\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c:437:\t\t    data-\u003enan.phase == MAC80211_HWSIM_NAN_PHASE_SCAN) {\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-438-\t\t\t/* Avoid a state transition */\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-468-\t\t\t */\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c:469:\t\t\tdata-\u003enan.phase = MAC80211_HWSIM_NAN_PHASE_UP;\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-470-\t\t\tdata-\u003enan.random_factor_valid_dwst = 0;\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c=612=mac80211_hwsim_nan_exec_state_transitions(struct mac80211_hwsim_data *data)\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-625-\tif (data-\u003enan.master_transition_score \u003c 3)\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c:626:\t\tdata-\u003enan.role = MAC80211_HWSIM_NAN_ROLE_MASTER;\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c:627:\telse if (data-\u003enan.role == MAC80211_HWSIM_NAN_ROLE_MASTER \u0026\u0026\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-628-\t\t data-\u003enan.master_transition_score \u003e= 3)\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c:629:\t\tdata-\u003enan.role = MAC80211_HWSIM_NAN_ROLE_SYNC;\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c:630:\telse if (data-\u003enan.role == MAC80211_HWSIM_NAN_ROLE_SYNC \u0026\u0026\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-631-\t\t data-\u003enan.sync_transition_score \u003e= 3)\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c:632:\t\tdata-\u003enan.role = MAC80211_HWSIM_NAN_ROLE_NON_SYNC;\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c:633:\telse if (data-\u003enan.role == MAC80211_HWSIM_NAN_ROLE_NON_SYNC \u0026\u0026\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-634-\t\t data-\u003enan.sync_transition_score \u003c 3)\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c:635:\t\tdata-\u003enan.role = MAC80211_HWSIM_NAN_ROLE_SYNC;\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-636-\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-641-\t */\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c:642:\tif (data-\u003enan.role == MAC80211_HWSIM_NAN_ROLE_MASTER \u0026\u0026\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-643-\t    !hrtimer_active(\u0026data-\u003enan.discovery_beacon_timer))\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-653-\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c:654:\t\tif (data-\u003enan.phase == MAC80211_HWSIM_NAN_PHASE_SCAN) {\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c:655:\t\t\tdata-\u003enan.phase = MAC80211_HWSIM_NAN_PHASE_WARMUP;\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-656-\t\t\tdata-\u003enan.random_factor_valid_dwst = NAN_WARMUP_DWST;\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-659-\t\t} else {\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c:660:\t\t\tdata-\u003enan.phase = MAC80211_HWSIM_NAN_PHASE_UP;\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-661-\t\t\tdata-\u003enan.random_factor_valid_dwst =\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c=695=mac80211_hwsim_nan_tx_beacon(struct mac80211_hwsim_data *data,\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-750-\tnan_attr.length = cpu_to_le16(sizeof(master_indication));\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c:751:\tif (data-\u003enan.phase == MAC80211_HWSIM_NAN_PHASE_UP) {\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-752-\t\tmaster_indication.master_pref = data-\u003enan.master_pref;\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c=774=mac80211_hwsim_nan_slot_timer(struct hrtimer *timer)\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-807-\t\ttx_sync_beacon =\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c:808:\t\t\tdata-\u003enan.phase != MAC80211_HWSIM_NAN_PHASE_SCAN \u0026\u0026\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c:809:\t\t\tdata-\u003enan.role != MAC80211_HWSIM_NAN_ROLE_NON_SYNC;\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-810-\t}\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c=867=mac80211_hwsim_nan_discovery_beacon_timer(struct hrtimer *timer)\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-879-\tscoped_guard(spinlock, \u0026data-\u003enan.state_lock) {\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c:880:\t\tif (data-\u003enan.phase == MAC80211_HWSIM_NAN_PHASE_SCAN ||\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c:881:\t\t    data-\u003enan.role != MAC80211_HWSIM_NAN_ROLE_MASTER)\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-882-\t\t\treturn HRTIMER_NORESTART;\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c=909=int mac80211_hwsim_nan_start(struct ieee80211_hw *hw,\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-926-\t\t/* Start in the \"scan\" phase and stay there for a little bit */\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c:927:\t\tdata-\u003enan.phase = MAC80211_HWSIM_NAN_PHASE_SCAN;\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-928-\t\tdata-\u003enan.random_factor_valid_dwst = 1;\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-930-\t\tdata-\u003enan.master_pref = conf-\u003emaster_pref;\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c:931:\t\tdata-\u003enan.role = MAC80211_HWSIM_NAN_ROLE_MASTER;\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-932-\t\tmemset(\u0026data-\u003enan.current_ami, 0,\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c=1226=bool mac80211_hwsim_nan_receive(struct ieee80211_hw *hw,\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-1235-\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c:1236:\tif (data-\u003enan.phase == MAC80211_HWSIM_NAN_PHASE_SCAN)\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.c-1237-\t\treturn channel-\u003ecenter_freq == 2437;\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.h-6-\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.h:7:#ifndef __MAC80211_HWSIM_NAN_H\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.h:8:#define __MAC80211_HWSIM_NAN_H\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.h-9-\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.h=10=enum mac80211_hwsim_nan_phase {\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.h:11:\tMAC80211_HWSIM_NAN_PHASE_SCAN,\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.h:12:\tMAC80211_HWSIM_NAN_PHASE_WARMUP,\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.h:13:\tMAC80211_HWSIM_NAN_PHASE_UP,\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.h-14-};\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.h=16=enum mac80211_hwsim_nan_role {\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.h:17:\tMAC80211_HWSIM_NAN_ROLE_MASTER,\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.h:18:\tMAC80211_HWSIM_NAN_ROLE_SYNC,\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.h:19:\tMAC80211_HWSIM_NAN_ROLE_NON_SYNC,\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.h-20-};\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.h=99=void mac80211_hwsim_nan_local_sched_changed(struct ieee80211_hw *hw,\n--\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.h-101-\ndrivers/net/wireless/virtual/mac80211_hwsim_nan.h:102:#endif /* __MAC80211_HWSIM_NAN_H */\n"
}

gemini-3.1-pro-preview

							input: 16200
							output: 213
							thoughts: 480

**Analyzing Wireless Driver Vulnerability**

Okay, so I'm looking at this patch and immediately, the `MAC80211_HWSIM` config jumps out, along with `CFG80211` and `MAC80211` – the usual suspects. My initial thought is to quickly identify key functions related to the core issue. I need to understand the attack surface.

First, I need to check the scope of the target functions. I see `cfg80211_parse_mbssid_data`. Let's confirm if it's exported or static. It's static, which limits direct external access. Then, `cfg80211_merge_profile` is exported. `cfg80211_iter_profile_continuation` appears to be static as well.

So the main symbols I should focus on are `cfg80211_iter_profile_continuation`, `cfg80211_merge_profile` and `cfg80211_parse_mbssid_data`.

Hang on, let me quickly verify what I'm seeing for `cfg80211_iter_profile_continuation`, is it `static inline` or just static? Ok, it's `static bool cfg80211_iter_profile_continuation(...)`, that's good.

Just to be thorough, I should look for other related functions. Let me see...I see `cfg80211_inform_single_bss_data` and `cfg80211_inform_bss_data`. These might also be relevant, but I'm going to set these aside for now.

Given that I have a good handle on `cfg80211_merge_profile` and `cfg80211_parse_mbssid_data` I think I should be good.

Right, time to solidify my understanding. The patch is about fixing a parsing issue related to Multiple BSSID (MBSSID) elements within wireless scan results. It seems the fix alters the profile continuation iteration via `cfg80211_iter_profile_continuation` and `cfg80211_merge_profile`. This is reachable wireless logic and, critically, is triggered by crafted management frames – beacons, probe responses – that contain malicious MBSSID data. That means we could have a potential vulnerability here. It's functional, meaning it should be easy to fuzz and I will set up set-results for this now.

Configs:
`CFG80211`
`MAC80211`
`MAC80211_HWSIM`

Focus symbols:
`cfg80211_iter_profile_continuation`
`cfg80211_merge_profile`
`cfg80211_parse_mbssid_data`

{
  "EnableConfigs": [
    "CFG80211",
    "MAC80211",
    "MAC80211_HWSIM"
  ],
  "FocusSymbols": [
    "cfg80211_iter_profile_continuation",
    "cfg80211_merge_profile",
    "cfg80211_parse_mbssid_data"
  ],
  "Reasoning": "The patch modifies the parsing logic for Multiple BSSID (MBSSID) elements in wireless scan results. It introduces `cfg80211_iter_profile_continuation` to correctly iterate over profile continuations and updates `cfg80211_merge_profile` to use it. This is reachable core wireless logic that can be triggered by processing malicious management frames (e.g., beacons or probe responses) containing crafted MBSSID information elements. It is functional and should be fuzzed.",
  "WorthFuzzing": true
}

{
  "EnableConfigs": [
    "CFG80211",
    "MAC80211",
    "MAC80211_HWSIM"
  ],
  "FocusSymbols": [
    "cfg80211_iter_profile_continuation",
    "cfg80211_merge_profile",
    "cfg80211_parse_mbssid_data"
  ],
  "Reasoning": "The patch modifies the parsing logic for Multiple BSSID (MBSSID) elements in wireless scan results. It introduces `cfg80211_iter_profile_continuation` to correctly iterate over profile continuations and updates `cfg80211_merge_profile` to use it. This is reachable core wireless logic that can be triggered by processing malicious management frames (e.g., beacons or probe responses) containing crafted MBSSID information elements. It is functional and should be fuzzed.",
  "WorthFuzzing": true
}

LLM Calls Summary:
Total Calls	Total Tokens	Avg Tokens	Total Duration (Seconds)	Avg Duration (Seconds)

Tool Calls Summary:
Total Calls	Total Duration (Seconds)	Avg Duration (Seconds)