AI Trajectory

null

{
  "EnableConfigs": [
    "ATH6KL",
    "ATH6KL_USB"
  ],
  "FocusSymbols": [
    "ath6kl_ibss_map_epid"
  ],
  "Reasoning": "The patch fixes an out-of-bounds array access in `ath6kl_ibss_map_epid` by correcting the bounds check on `ar-\u003enode_num` before incrementing it and using it as an index. The `ath6kl` driver can be fuzzed via its USB interface (`CONFIG_ATH6KL_USB`).",
  "WorthFuzzing": true
}

null

{
  "PatchDiff": "commit c51f610c98d91733655090507dfbb0e0b8ad701d\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Thu Jul 23 04:07:04 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/drivers/net/wireless/ath/ath6kl/txrx.c b/drivers/net/wireless/ath/ath6kl/txrx.c\nindex 97fdac7237e26e..3b0033431b2987 100644\n--- a/drivers/net/wireless/ath/ath6kl/txrx.c\n+++ b/drivers/net/wireless/ath/ath6kl/txrx.c\n@@ -67,10 +67,9 @@ static u8 ath6kl_ibss_map_epid(struct sk_buff *skb, struct net_device *dev,\n \t}\n \n \tif (ep_map == -1) {\n-\t\tep_map = ar-\u003enode_num;\n-\t\tar-\u003enode_num++;\n-\t\tif (ar-\u003enode_num \u003e MAX_NODE_NUM)\n+\t\tif (ar-\u003enode_num \u003e= MAX_NODE_NUM)\n \t\t\treturn ENDPOINT_UNUSED;\n+\t\tep_map = ar-\u003enode_num++;\n \t}\n \n \tmemcpy(ar-\u003enode_map[ep_map].mac_addr, eth_hdr-\u003eh_dest, ETH_ALEN);\n"
}

best-expensive

null

{
  "EnableConfigs": [
    "ATH6KL",
    "ATH6KL_USB"
  ],
  "FocusSymbols": [
    "ath6kl_ibss_map_epid"
  ],
  "Reasoning": "The patch fixes an out-of-bounds array access in `ath6kl_ibss_map_epid` by correcting the bounds check on `ar-\u003enode_num` before incrementing it and using it as an index. The `ath6kl` driver can be fuzzed via its USB interface (`CONFIG_ATH6KL_USB`).",
  "WorthFuzzing": true
}

You are an expert Linux kernel maintainer.
Your job is to review a provided patch series and determine
if it makes functional changes to the kernel that should be fuzzed.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on your internal knowledge of the kernel. You must actively
use your code access tools to examine the actual source code and confirm any assumptions.

Return WorthFuzzing=false if the patch only contains:
- Modifications to Documentation/, Kconfig files, or code comments.
- Purely decorative changes, such as logging (e.g., pr_err, printk) or tracepoints.
- Changes to numeric constants or macros that do not functionally alter execution flow.
- Code paths that are impossible to reach in virtualized environments like GCE or QEMU,
even when utilizing software-emulated hardware (e.g., usb gadget, mac80211_hwsim).

If it modifies reachable core kernel logic, drivers, or architectures, use your code search
tools to verify the code can be executed, then return WorthFuzzing=true.

When returning WorthFuzzing=true, you MUST ALSO:
1. Extract any specific kernel functions that should be heavily fuzzed into FocusSymbols.
   Avoid listing generic hot-path functions to prevent skewed test distributions.
2. Identify any specific CONFIG_ options required to properly test this new/modified feature.
   Go and look into the Kconfig files and check for ifdefs around the code, do not make assumptions.
   Do not list too generic configs (we already have them enabled). Only list those that
   specifically cover the modified code. List them in the EnableConfigs output array,
   and DO NOT add a 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

For your convenience, here is the diff of the changes:
commit c51f610c98d91733655090507dfbb0e0b8ad701d
Author: syz-cluster <triage@syzkaller.com>
Date:   Thu Jul 23 04:07:04 2026 +0000

    syz-cluster: applied patch under review

diff --git a/drivers/net/wireless/ath/ath6kl/txrx.c b/drivers/net/wireless/ath/ath6kl/txrx.c
index 97fdac7237e26e..3b0033431b2987 100644
--- a/drivers/net/wireless/ath/ath6kl/txrx.c
+++ b/drivers/net/wireless/ath/ath6kl/txrx.c
@@ -67,10 +67,9 @@ static u8 ath6kl_ibss_map_epid(struct sk_buff *skb, struct net_device *dev,
 	}
 
 	if (ep_map == -1) {
-		ep_map = ar->node_num;
-		ar->node_num++;
-		if (ar->node_num > MAX_NODE_NUM)
+		if (ar->node_num >= MAX_NODE_NUM)
 			return ENDPOINT_UNUSED;
+		ep_map = ar->node_num++;
 	}
 
 	memcpy(ar->node_map[ep_map].mac_addr, eth_hdr->h_dest, ETH_ALEN);

gemini-3.1-pro-preview

null

null

							input: 1982
							output: 37
							thoughts: 415
						

**Analyzing a Driver Patch: Potential Vulnerability and Fuzzing Feasibility**

Okay, so I'm looking at this patch for `ath6kl_ibss_map_epid` in `drivers/net/wireless/ath/ath6kl/txrx.c`. It seems like they're fixing a potential out-of-bounds array access, which is always something to pay attention to. The original code was a little clunky: it first assigned `ep_map` and *then* incremented `ar->node_num`. The danger was that if `ar->node_num` was already at `MAX_NODE_NUM`, `ep_map` would get assigned that value *before* the check. This meant accessing `ar->node_map[ep_map]` would go out of bounds. The new code smartly increments *after* the assignment. That's a good, clean fix.

But now, my expert instincts kick in. I start thinking, "Can we *exploit* this in any meaningful way? And can we even *reach* this code in a way that’s fuzzable?" `ath6kl`... that’s an Atheros AR6003/AR6004 driver, right? This is hardware-specific, so it’s likely running at a low level. The big question is whether it's accessible in a virtualized environment. That's my main concern. Without hardware emulation like `mac80211_hwsim`, it’s going to be tough unless there’s a direct interface.

My first thought is always, are there USB or SDIO interfaces? Could we fuzz this with a dummy HCD or something similar? Let’s find out. I navigate the directory structure. I see `usb.c` and `sdio.c` in the `ath6kl` directory. Alright, this is promising! The fact that it has these interfaces means there's a good chance we can reach it. Now, the real work begins. I'll need to dig into `usb.c` and see if we can craft some inputs to trigger this `ath6kl_ibss_map_epid` function and explore potential vulnerability paths. I'm now thinking about how to build a fuzzer for this...

{
  "Expression": "ath6kl_usb",
  "PathPrefix": "drivers/net/wireless/ath/ath6kl/"
}

{
  "Output": "drivers/net/wireless/ath/ath6kl/Kconfig=25=config ATH6KL_USB\n--\ndrivers/net/wireless/ath/ath6kl/Kconfig-32-\t  USB. If you choose to build it as a module, it will be\ndrivers/net/wireless/ath/ath6kl/Kconfig:33:\t  called ath6kl_usb.\ndrivers/net/wireless/ath/ath6kl/Kconfig-34-\n--\ndrivers/net/wireless/ath/ath6kl/Makefile=43=ath6kl_sdio-y += sdio.o\ndrivers/net/wireless/ath/ath6kl/Makefile-44-\ndrivers/net/wireless/ath/ath6kl/Makefile:45:obj-$(CONFIG_ATH6KL_USB) += ath6kl_usb.o\ndrivers/net/wireless/ath/ath6kl/Makefile:46:ath6kl_usb-y += usb.o\ndrivers/net/wireless/ath/ath6kl/Makefile-47-\n--\ndrivers/net/wireless/ath/ath6kl/htc_pipe.c=941=static int ath6kl_htc_pipe_rx_complete(struct ath6kl *ar, struct sk_buff *skb,\n--\ndrivers/net/wireless/ath/ath6kl/htc_pipe.c-959-\t * Thus the possibility of ar-\u003ehtc_target being NULL\ndrivers/net/wireless/ath/ath6kl/htc_pipe.c:960:\t * via ath6kl_recv_complete -\u003e ath6kl_usb_io_comp_work.\ndrivers/net/wireless/ath/ath6kl/htc_pipe.c-961-\t */\n--\ndrivers/net/wireless/ath/ath6kl/usb.c=30=enum ATH6KL_USB_PIPE_ID {\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-43-\ndrivers/net/wireless/ath/ath6kl/usb.c:44:struct ath6kl_usb_pipe {\ndrivers/net/wireless/ath/ath6kl/usb.c-45-\tstruct list_head urb_list_head;\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-53-\tu8 logical_pipe_num;\ndrivers/net/wireless/ath/ath6kl/usb.c:54:\tstruct ath6kl_usb *ar_usb;\ndrivers/net/wireless/ath/ath6kl/usb.c-55-\tu16 max_packet_size;\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-63-/* usb device object */\ndrivers/net/wireless/ath/ath6kl/usb.c:64:struct ath6kl_usb {\ndrivers/net/wireless/ath/ath6kl/usb.c-65-\t/* protects pipe-\u003eurb_list_head and  pipe-\u003eurb_cnt */\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-69-\tstruct usb_interface *interface;\ndrivers/net/wireless/ath/ath6kl/usb.c:70:\tstruct ath6kl_usb_pipe pipes[ATH6KL_USB_PIPE_MAX];\ndrivers/net/wireless/ath/ath6kl/usb.c-71-\tu8 *diag_cmd_buffer;\n--\ndrivers/net/wireless/ath/ath6kl/usb.c=78=struct ath6kl_urb_context {\ndrivers/net/wireless/ath/ath6kl/usb.c-79-\tstruct list_head link;\ndrivers/net/wireless/ath/ath6kl/usb.c:80:\tstruct ath6kl_usb_pipe *pipe;\ndrivers/net/wireless/ath/ath6kl/usb.c-81-\tstruct sk_buff *skb;\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-104-\ndrivers/net/wireless/ath/ath6kl/usb.c:105:struct ath6kl_usb_ctrl_diag_cmd_write {\ndrivers/net/wireless/ath/ath6kl/usb.c-106-\t__le32 cmd;\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-111-\ndrivers/net/wireless/ath/ath6kl/usb.c:112:struct ath6kl_usb_ctrl_diag_cmd_read {\ndrivers/net/wireless/ath/ath6kl/usb.c-113-\t__le32 cmd;\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-116-\ndrivers/net/wireless/ath/ath6kl/usb.c:117:struct ath6kl_usb_ctrl_diag_resp_read {\ndrivers/net/wireless/ath/ath6kl/usb.c-118-\t__le32 value;\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-121-/* function declarations */\ndrivers/net/wireless/ath/ath6kl/usb.c:122:static void ath6kl_usb_recv_complete(struct urb *urb);\ndrivers/net/wireless/ath/ath6kl/usb.c-123-\n--\ndrivers/net/wireless/ath/ath6kl/usb.c=130=static struct ath6kl_urb_context *\ndrivers/net/wireless/ath/ath6kl/usb.c:131:ath6kl_usb_alloc_urb_from_pipe(struct ath6kl_usb_pipe *pipe)\ndrivers/net/wireless/ath/ath6kl/usb.c-132-{\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-152-\ndrivers/net/wireless/ath/ath6kl/usb.c:153:static void ath6kl_usb_free_urb_to_pipe(struct ath6kl_usb_pipe *pipe,\ndrivers/net/wireless/ath/ath6kl/usb.c-154-\t\t\t\t\tstruct ath6kl_urb_context *urb_context)\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-168-\ndrivers/net/wireless/ath/ath6kl/usb.c:169:static void ath6kl_usb_cleanup_recv_urb(struct ath6kl_urb_context *urb_context)\ndrivers/net/wireless/ath/ath6kl/usb.c-170-{\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-173-\ndrivers/net/wireless/ath/ath6kl/usb.c:174:\tath6kl_usb_free_urb_to_pipe(urb_context-\u003epipe, urb_context);\ndrivers/net/wireless/ath/ath6kl/usb.c-175-}\ndrivers/net/wireless/ath/ath6kl/usb.c-176-\ndrivers/net/wireless/ath/ath6kl/usb.c:177:static inline struct ath6kl_usb *ath6kl_usb_priv(struct ath6kl *ar)\ndrivers/net/wireless/ath/ath6kl/usb.c-178-{\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-182-/* pipe resource allocation/cleanup */\ndrivers/net/wireless/ath/ath6kl/usb.c:183:static int ath6kl_usb_alloc_pipe_resources(struct ath6kl_usb_pipe *pipe,\ndrivers/net/wireless/ath/ath6kl/usb.c-184-\t\t\t\t\t   int urb_cnt)\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-205-\t\tpipe-\u003eurb_alloc++;\ndrivers/net/wireless/ath/ath6kl/usb.c:206:\t\tath6kl_usb_free_urb_to_pipe(pipe, urb_context);\ndrivers/net/wireless/ath/ath6kl/usb.c-207-\t}\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-217-\ndrivers/net/wireless/ath/ath6kl/usb.c:218:static void ath6kl_usb_free_pipe_resources(struct ath6kl_usb_pipe *pipe)\ndrivers/net/wireless/ath/ath6kl/usb.c-219-{\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-241-\twhile (true) {\ndrivers/net/wireless/ath/ath6kl/usb.c:242:\t\turb_context = ath6kl_usb_alloc_urb_from_pipe(pipe);\ndrivers/net/wireless/ath/ath6kl/usb.c-243-\t\tif (urb_context == NULL)\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-248-\ndrivers/net/wireless/ath/ath6kl/usb.c:249:static void ath6kl_usb_cleanup_pipe_resources(struct ath6kl_usb *ar_usb)\ndrivers/net/wireless/ath/ath6kl/usb.c-250-{\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-253-\tfor (i = 0; i \u003c ATH6KL_USB_PIPE_MAX; i++)\ndrivers/net/wireless/ath/ath6kl/usb.c:254:\t\tath6kl_usb_free_pipe_resources(\u0026ar_usb-\u003epipes[i]);\ndrivers/net/wireless/ath/ath6kl/usb.c-255-}\ndrivers/net/wireless/ath/ath6kl/usb.c-256-\ndrivers/net/wireless/ath/ath6kl/usb.c:257:static u8 ath6kl_usb_get_logical_pipe_num(struct ath6kl_usb *ar_usb,\ndrivers/net/wireless/ath/ath6kl/usb.c-258-\t\t\t\t\t  u8 ep_address, int *urb_count)\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-302-\ndrivers/net/wireless/ath/ath6kl/usb.c:303:static int ath6kl_usb_setup_pipe_resources(struct ath6kl_usb *ar_usb)\ndrivers/net/wireless/ath/ath6kl/usb.c-304-{\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-307-\tstruct usb_endpoint_descriptor *endpoint;\ndrivers/net/wireless/ath/ath6kl/usb.c:308:\tstruct ath6kl_usb_pipe *pipe;\ndrivers/net/wireless/ath/ath6kl/usb.c-309-\tint i, urbcount, status = 0;\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-350-\t\tpipe_num =\ndrivers/net/wireless/ath/ath6kl/usb.c:351:\t\t    ath6kl_usb_get_logical_pipe_num(ar_usb,\ndrivers/net/wireless/ath/ath6kl/usb.c-352-\t\t\t\t\t\t    endpoint-\u003ebEndpointAddress,\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-405-\ndrivers/net/wireless/ath/ath6kl/usb.c:406:\t\tstatus = ath6kl_usb_alloc_pipe_resources(pipe, urbcount);\ndrivers/net/wireless/ath/ath6kl/usb.c-407-\t\tif (status != 0)\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-414-/* pipe operations */\ndrivers/net/wireless/ath/ath6kl/usb.c:415:static void ath6kl_usb_post_recv_transfers(struct ath6kl_usb_pipe *recv_pipe,\ndrivers/net/wireless/ath/ath6kl/usb.c-416-\t\t\t\t\t   int buffer_length)\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-422-\twhile (true) {\ndrivers/net/wireless/ath/ath6kl/usb.c:423:\t\turb_context = ath6kl_usb_alloc_urb_from_pipe(recv_pipe);\ndrivers/net/wireless/ath/ath6kl/usb.c-424-\t\tif (urb_context == NULL)\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-439-\t\t\t\t  buffer_length,\ndrivers/net/wireless/ath/ath6kl/usb.c:440:\t\t\t\t  ath6kl_usb_recv_complete, urb_context);\ndrivers/net/wireless/ath/ath6kl/usb.c-441-\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-463-err_cleanup_urb:\ndrivers/net/wireless/ath/ath6kl/usb.c:464:\tath6kl_usb_cleanup_recv_urb(urb_context);\ndrivers/net/wireless/ath/ath6kl/usb.c-465-\treturn;\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-467-\ndrivers/net/wireless/ath/ath6kl/usb.c:468:static void ath6kl_usb_flush_all(struct ath6kl_usb *ar_usb)\ndrivers/net/wireless/ath/ath6kl/usb.c-469-{\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-483-\ndrivers/net/wireless/ath/ath6kl/usb.c:484:static void ath6kl_usb_start_recv_pipes(struct ath6kl_usb *ar_usb)\ndrivers/net/wireless/ath/ath6kl/usb.c-485-{\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-489-\t *      ar_usb-\u003epipes[ATH6KL_USB_PIPE_RX_CTRL].urb_alloc/2;\ndrivers/net/wireless/ath/ath6kl/usb.c:490:\t * ath6kl_usb_post_recv_transfers(\u0026ar_usb-\u003e\ndrivers/net/wireless/ath/ath6kl/usb.c-491-\t *\t\tpipes[ATH6KL_USB_PIPE_RX_CTRL],\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-496-\ndrivers/net/wireless/ath/ath6kl/usb.c:497:\tath6kl_usb_post_recv_transfers(\u0026ar_usb-\u003epipes[ATH6KL_USB_PIPE_RX_DATA],\ndrivers/net/wireless/ath/ath6kl/usb.c-498-\t\t\t\t       ATH6KL_USB_RX_BUFFER_SIZE);\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-501-/* hif usb rx/tx completion functions */\ndrivers/net/wireless/ath/ath6kl/usb.c:502:static void ath6kl_usb_recv_complete(struct urb *urb)\ndrivers/net/wireless/ath/ath6kl/usb.c-503-{\ndrivers/net/wireless/ath/ath6kl/usb.c-504-\tstruct ath6kl_urb_context *urb_context = urb-\u003econtext;\ndrivers/net/wireless/ath/ath6kl/usb.c:505:\tstruct ath6kl_usb_pipe *pipe = urb_context-\u003epipe;\ndrivers/net/wireless/ath/ath6kl/usb.c-506-\tstruct sk_buff *skb = NULL;\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-549-cleanup_recv_urb:\ndrivers/net/wireless/ath/ath6kl/usb.c:550:\tath6kl_usb_cleanup_recv_urb(urb_context);\ndrivers/net/wireless/ath/ath6kl/usb.c-551-\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-554-\t\t/* our free urbs are piling up, post more transfers */\ndrivers/net/wireless/ath/ath6kl/usb.c:555:\t\tath6kl_usb_post_recv_transfers(pipe, ATH6KL_USB_RX_BUFFER_SIZE);\ndrivers/net/wireless/ath/ath6kl/usb.c-556-\t}\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-558-\ndrivers/net/wireless/ath/ath6kl/usb.c:559:static void ath6kl_usb_usb_transmit_complete(struct urb *urb)\ndrivers/net/wireless/ath/ath6kl/usb.c-560-{\ndrivers/net/wireless/ath/ath6kl/usb.c-561-\tstruct ath6kl_urb_context *urb_context = urb-\u003econtext;\ndrivers/net/wireless/ath/ath6kl/usb.c:562:\tstruct ath6kl_usb_pipe *pipe = urb_context-\u003epipe;\ndrivers/net/wireless/ath/ath6kl/usb.c-563-\tstruct sk_buff *skb;\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-577-\turb_context-\u003eskb = NULL;\ndrivers/net/wireless/ath/ath6kl/usb.c:578:\tath6kl_usb_free_urb_to_pipe(urb_context-\u003epipe, urb_context);\ndrivers/net/wireless/ath/ath6kl/usb.c-579-\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-584-\ndrivers/net/wireless/ath/ath6kl/usb.c:585:static void ath6kl_usb_io_comp_work(struct work_struct *work)\ndrivers/net/wireless/ath/ath6kl/usb.c-586-{\ndrivers/net/wireless/ath/ath6kl/usb.c:587:\tstruct ath6kl_usb_pipe *pipe = container_of(work,\ndrivers/net/wireless/ath/ath6kl/usb.c:588:\t\t\t\t\t\t    struct ath6kl_usb_pipe,\ndrivers/net/wireless/ath/ath6kl/usb.c-589-\t\t\t\t\t\t    io_complete_work);\ndrivers/net/wireless/ath/ath6kl/usb.c:590:\tstruct ath6kl_usb *ar_usb;\ndrivers/net/wireless/ath/ath6kl/usb.c-591-\tstruct sk_buff *skb;\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-608-\ndrivers/net/wireless/ath/ath6kl/usb.c:609:#define ATH6KL_USB_MAX_DIAG_CMD (sizeof(struct ath6kl_usb_ctrl_diag_cmd_write))\ndrivers/net/wireless/ath/ath6kl/usb.c:610:#define ATH6KL_USB_MAX_DIAG_RESP (sizeof(struct ath6kl_usb_ctrl_diag_resp_read))\ndrivers/net/wireless/ath/ath6kl/usb.c-611-\ndrivers/net/wireless/ath/ath6kl/usb.c:612:static void ath6kl_usb_destroy(struct ath6kl_usb *ar_usb)\ndrivers/net/wireless/ath/ath6kl/usb.c-613-{\ndrivers/net/wireless/ath/ath6kl/usb.c:614:\tath6kl_usb_flush_all(ar_usb);\ndrivers/net/wireless/ath/ath6kl/usb.c-615-\ndrivers/net/wireless/ath/ath6kl/usb.c:616:\tath6kl_usb_cleanup_pipe_resources(ar_usb);\ndrivers/net/wireless/ath/ath6kl/usb.c-617-\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-626-\ndrivers/net/wireless/ath/ath6kl/usb.c:627:static struct ath6kl_usb *ath6kl_usb_create(struct usb_interface *interface)\ndrivers/net/wireless/ath/ath6kl/usb.c-628-{\ndrivers/net/wireless/ath/ath6kl/usb.c-629-\tstruct usb_device *dev = interface_to_usbdev(interface);\ndrivers/net/wireless/ath/ath6kl/usb.c:630:\tstruct ath6kl_usb *ar_usb;\ndrivers/net/wireless/ath/ath6kl/usb.c:631:\tstruct ath6kl_usb_pipe *pipe;\ndrivers/net/wireless/ath/ath6kl/usb.c-632-\tint status = 0;\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-634-\ndrivers/net/wireless/ath/ath6kl/usb.c:635:\t/* ath6kl_usb_destroy() needs ar_usb != NULL \u0026\u0026 ar_usb-\u003ewq != NULL. */\ndrivers/net/wireless/ath/ath6kl/usb.c:636:\tar_usb = kzalloc_obj(struct ath6kl_usb);\ndrivers/net/wireless/ath/ath6kl/usb.c-637-\tif (ar_usb == NULL)\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-652-\t\tINIT_WORK(\u0026pipe-\u003eio_complete_work,\ndrivers/net/wireless/ath/ath6kl/usb.c:653:\t\t\t  ath6kl_usb_io_comp_work);\ndrivers/net/wireless/ath/ath6kl/usb.c-654-\t\tskb_queue_head_init(\u0026pipe-\u003eio_comp_queue);\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-659-\t\tstatus = -ENOMEM;\ndrivers/net/wireless/ath/ath6kl/usb.c:660:\t\tgoto fail_ath6kl_usb_create;\ndrivers/net/wireless/ath/ath6kl/usb.c-661-\t}\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-666-\t\tstatus = -ENOMEM;\ndrivers/net/wireless/ath/ath6kl/usb.c:667:\t\tgoto fail_ath6kl_usb_create;\ndrivers/net/wireless/ath/ath6kl/usb.c-668-\t}\ndrivers/net/wireless/ath/ath6kl/usb.c-669-\ndrivers/net/wireless/ath/ath6kl/usb.c:670:\tstatus = ath6kl_usb_setup_pipe_resources(ar_usb);\ndrivers/net/wireless/ath/ath6kl/usb.c-671-\ndrivers/net/wireless/ath/ath6kl/usb.c:672:fail_ath6kl_usb_create:\ndrivers/net/wireless/ath/ath6kl/usb.c-673-\tif (status != 0) {\ndrivers/net/wireless/ath/ath6kl/usb.c:674:\t\tath6kl_usb_destroy(ar_usb);\ndrivers/net/wireless/ath/ath6kl/usb.c-675-\t\tar_usb = NULL;\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-679-\ndrivers/net/wireless/ath/ath6kl/usb.c:680:static void ath6kl_usb_device_detached(struct usb_interface *interface)\ndrivers/net/wireless/ath/ath6kl/usb.c-681-{\ndrivers/net/wireless/ath/ath6kl/usb.c:682:\tstruct ath6kl_usb *ar_usb;\ndrivers/net/wireless/ath/ath6kl/usb.c-683-\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-692-\tath6kl_core_cleanup(ar_usb-\u003ear);\ndrivers/net/wireless/ath/ath6kl/usb.c:693:\tath6kl_usb_destroy(ar_usb);\ndrivers/net/wireless/ath/ath6kl/usb.c-694-}\n--\ndrivers/net/wireless/ath/ath6kl/usb.c=697=static void hif_start(struct ath6kl *ar)\ndrivers/net/wireless/ath/ath6kl/usb.c-698-{\ndrivers/net/wireless/ath/ath6kl/usb.c:699:\tstruct ath6kl_usb *device = ath6kl_usb_priv(ar);\ndrivers/net/wireless/ath/ath6kl/usb.c-700-\tint i;\ndrivers/net/wireless/ath/ath6kl/usb.c-701-\ndrivers/net/wireless/ath/ath6kl/usb.c:702:\tath6kl_usb_start_recv_pipes(device);\ndrivers/net/wireless/ath/ath6kl/usb.c-703-\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-711-\ndrivers/net/wireless/ath/ath6kl/usb.c:712:static int ath6kl_usb_send(struct ath6kl *ar, u8 PipeID,\ndrivers/net/wireless/ath/ath6kl/usb.c-713-\t\t\t   struct sk_buff *hdr_skb, struct sk_buff *skb)\ndrivers/net/wireless/ath/ath6kl/usb.c-714-{\ndrivers/net/wireless/ath/ath6kl/usb.c:715:\tstruct ath6kl_usb *device = ath6kl_usb_priv(ar);\ndrivers/net/wireless/ath/ath6kl/usb.c:716:\tstruct ath6kl_usb_pipe *pipe = \u0026device-\u003epipes[PipeID];\ndrivers/net/wireless/ath/ath6kl/usb.c-717-\tstruct ath6kl_urb_context *urb_context;\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-725-\ndrivers/net/wireless/ath/ath6kl/usb.c:726:\turb_context = ath6kl_usb_alloc_urb_from_pipe(pipe);\ndrivers/net/wireless/ath/ath6kl/usb.c-727-\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-747-\t\tstatus = -ENOMEM;\ndrivers/net/wireless/ath/ath6kl/usb.c:748:\t\tath6kl_usb_free_urb_to_pipe(urb_context-\u003epipe,\ndrivers/net/wireless/ath/ath6kl/usb.c-749-\t\t\t\t\t    urb_context);\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-757-\t\t\t  len,\ndrivers/net/wireless/ath/ath6kl/usb.c:758:\t\t\t  ath6kl_usb_usb_transmit_complete, urb_context);\ndrivers/net/wireless/ath/ath6kl/usb.c-759-\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-777-\t\tusb_unanchor_urb(urb);\ndrivers/net/wireless/ath/ath6kl/usb.c:778:\t\tath6kl_usb_free_urb_to_pipe(urb_context-\u003epipe,\ndrivers/net/wireless/ath/ath6kl/usb.c-779-\t\t\t\t\t    urb_context);\n--\ndrivers/net/wireless/ath/ath6kl/usb.c=788=static void hif_stop(struct ath6kl *ar)\ndrivers/net/wireless/ath/ath6kl/usb.c-789-{\ndrivers/net/wireless/ath/ath6kl/usb.c:790:\tstruct ath6kl_usb *device = ath6kl_usb_priv(ar);\ndrivers/net/wireless/ath/ath6kl/usb.c-791-\ndrivers/net/wireless/ath/ath6kl/usb.c:792:\tath6kl_usb_flush_all(device);\ndrivers/net/wireless/ath/ath6kl/usb.c-793-}\ndrivers/net/wireless/ath/ath6kl/usb.c-794-\ndrivers/net/wireless/ath/ath6kl/usb.c:795:static void ath6kl_usb_get_default_pipe(struct ath6kl *ar,\ndrivers/net/wireless/ath/ath6kl/usb.c-796-\t\t\t\t\tu8 *ul_pipe, u8 *dl_pipe)\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-801-\ndrivers/net/wireless/ath/ath6kl/usb.c:802:static int ath6kl_usb_map_service_pipe(struct ath6kl *ar, u16 svc_id,\ndrivers/net/wireless/ath/ath6kl/usb.c-803-\t\t\t\t       u8 *ul_pipe, u8 *dl_pipe)\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-856-\ndrivers/net/wireless/ath/ath6kl/usb.c:857:static u16 ath6kl_usb_get_free_queue_number(struct ath6kl *ar, u8 pipe_id)\ndrivers/net/wireless/ath/ath6kl/usb.c-858-{\ndrivers/net/wireless/ath/ath6kl/usb.c:859:\tstruct ath6kl_usb *device = ath6kl_usb_priv(ar);\ndrivers/net/wireless/ath/ath6kl/usb.c-860-\n--\ndrivers/net/wireless/ath/ath6kl/usb.c=864=static void hif_detach_htc(struct ath6kl *ar)\ndrivers/net/wireless/ath/ath6kl/usb.c-865-{\ndrivers/net/wireless/ath/ath6kl/usb.c:866:\tstruct ath6kl_usb *device = ath6kl_usb_priv(ar);\ndrivers/net/wireless/ath/ath6kl/usb.c-867-\ndrivers/net/wireless/ath/ath6kl/usb.c:868:\tath6kl_usb_flush_all(device);\ndrivers/net/wireless/ath/ath6kl/usb.c-869-}\ndrivers/net/wireless/ath/ath6kl/usb.c-870-\ndrivers/net/wireless/ath/ath6kl/usb.c:871:static int ath6kl_usb_submit_ctrl_out(struct ath6kl_usb *ar_usb,\ndrivers/net/wireless/ath/ath6kl/usb.c-872-\t\t\t\t   u8 req, u16 value, u16 index, void *data,\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-902-\ndrivers/net/wireless/ath/ath6kl/usb.c:903:static int ath6kl_usb_submit_ctrl_in(struct ath6kl_usb *ar_usb,\ndrivers/net/wireless/ath/ath6kl/usb.c-904-\t\t\t\t  u8 req, u16 value, u16 index, void *data,\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-936-\ndrivers/net/wireless/ath/ath6kl/usb.c:937:static int ath6kl_usb_ctrl_msg_exchange(struct ath6kl_usb *ar_usb,\ndrivers/net/wireless/ath/ath6kl/usb.c-938-\t\t\t\t     u8 req_val, u8 *req_buf, u32 req_len,\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-943-\t/* send command */\ndrivers/net/wireless/ath/ath6kl/usb.c:944:\tret = ath6kl_usb_submit_ctrl_out(ar_usb, req_val, 0, 0,\ndrivers/net/wireless/ath/ath6kl/usb.c-945-\t\t\t\t\t req_buf, req_len);\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-955-\t/* get response */\ndrivers/net/wireless/ath/ath6kl/usb.c:956:\tret = ath6kl_usb_submit_ctrl_in(ar_usb, resp_val, 0, 0,\ndrivers/net/wireless/ath/ath6kl/usb.c-957-\t\t\t\t\tresp_buf, *resp_len);\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-961-\ndrivers/net/wireless/ath/ath6kl/usb.c:962:static int ath6kl_usb_diag_read32(struct ath6kl *ar, u32 address, u32 *data)\ndrivers/net/wireless/ath/ath6kl/usb.c-963-{\ndrivers/net/wireless/ath/ath6kl/usb.c:964:\tstruct ath6kl_usb *ar_usb = ar-\u003ehif_priv;\ndrivers/net/wireless/ath/ath6kl/usb.c:965:\tstruct ath6kl_usb_ctrl_diag_resp_read *resp;\ndrivers/net/wireless/ath/ath6kl/usb.c:966:\tstruct ath6kl_usb_ctrl_diag_cmd_read *cmd;\ndrivers/net/wireless/ath/ath6kl/usb.c-967-\tu32 resp_len;\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-969-\ndrivers/net/wireless/ath/ath6kl/usb.c:970:\tcmd = (struct ath6kl_usb_ctrl_diag_cmd_read *) ar_usb-\u003ediag_cmd_buffer;\ndrivers/net/wireless/ath/ath6kl/usb.c-971-\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-976-\ndrivers/net/wireless/ath/ath6kl/usb.c:977:\tret = ath6kl_usb_ctrl_msg_exchange(ar_usb,\ndrivers/net/wireless/ath/ath6kl/usb.c-978-\t\t\t\tATH6KL_USB_CONTROL_REQ_DIAG_CMD,\ndrivers/net/wireless/ath/ath6kl/usb.c-979-\t\t\t\t(u8 *) cmd,\ndrivers/net/wireless/ath/ath6kl/usb.c:980:\t\t\t\tsizeof(struct ath6kl_usb_ctrl_diag_cmd_write),\ndrivers/net/wireless/ath/ath6kl/usb.c-981-\t\t\t\tATH6KL_USB_CONTROL_REQ_DIAG_RESP,\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-988-\ndrivers/net/wireless/ath/ath6kl/usb.c:989:\tresp = (struct ath6kl_usb_ctrl_diag_resp_read *)\ndrivers/net/wireless/ath/ath6kl/usb.c-990-\t\tar_usb-\u003ediag_resp_buffer;\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-996-\ndrivers/net/wireless/ath/ath6kl/usb.c:997:static int ath6kl_usb_diag_write32(struct ath6kl *ar, u32 address, __le32 data)\ndrivers/net/wireless/ath/ath6kl/usb.c-998-{\ndrivers/net/wireless/ath/ath6kl/usb.c:999:\tstruct ath6kl_usb *ar_usb = ar-\u003ehif_priv;\ndrivers/net/wireless/ath/ath6kl/usb.c:1000:\tstruct ath6kl_usb_ctrl_diag_cmd_write *cmd;\ndrivers/net/wireless/ath/ath6kl/usb.c-1001-\tint ret;\ndrivers/net/wireless/ath/ath6kl/usb.c-1002-\ndrivers/net/wireless/ath/ath6kl/usb.c:1003:\tcmd = (struct ath6kl_usb_ctrl_diag_cmd_write *) ar_usb-\u003ediag_cmd_buffer;\ndrivers/net/wireless/ath/ath6kl/usb.c-1004-\ndrivers/net/wireless/ath/ath6kl/usb.c:1005:\tmemset(cmd, 0, sizeof(struct ath6kl_usb_ctrl_diag_cmd_write));\ndrivers/net/wireless/ath/ath6kl/usb.c-1006-\tcmd-\u003ecmd = cpu_to_le32(ATH6KL_USB_CTRL_DIAG_CC_WRITE);\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-1009-\ndrivers/net/wireless/ath/ath6kl/usb.c:1010:\tret = ath6kl_usb_ctrl_msg_exchange(ar_usb,\ndrivers/net/wireless/ath/ath6kl/usb.c-1011-\t\t\t\t\t   ATH6KL_USB_CONTROL_REQ_DIAG_CMD,\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-1022-\ndrivers/net/wireless/ath/ath6kl/usb.c:1023:static int ath6kl_usb_bmi_read(struct ath6kl *ar, u8 *buf, u32 len)\ndrivers/net/wireless/ath/ath6kl/usb.c-1024-{\ndrivers/net/wireless/ath/ath6kl/usb.c:1025:\tstruct ath6kl_usb *ar_usb = ar-\u003ehif_priv;\ndrivers/net/wireless/ath/ath6kl/usb.c-1026-\tint ret;\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-1028-\t/* get response */\ndrivers/net/wireless/ath/ath6kl/usb.c:1029:\tret = ath6kl_usb_submit_ctrl_in(ar_usb,\ndrivers/net/wireless/ath/ath6kl/usb.c-1030-\t\t\t\t\tATH6KL_USB_CONTROL_REQ_RECV_BMI_RESP,\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-1040-\ndrivers/net/wireless/ath/ath6kl/usb.c:1041:static int ath6kl_usb_bmi_write(struct ath6kl *ar, u8 *buf, u32 len)\ndrivers/net/wireless/ath/ath6kl/usb.c-1042-{\ndrivers/net/wireless/ath/ath6kl/usb.c:1043:\tstruct ath6kl_usb *ar_usb = ar-\u003ehif_priv;\ndrivers/net/wireless/ath/ath6kl/usb.c-1044-\tint ret;\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-1046-\t/* send command */\ndrivers/net/wireless/ath/ath6kl/usb.c:1047:\tret = ath6kl_usb_submit_ctrl_out(ar_usb,\ndrivers/net/wireless/ath/ath6kl/usb.c-1048-\t\t\t\t\t ATH6KL_USB_CONTROL_REQ_SEND_BMI_CMD,\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-1058-\ndrivers/net/wireless/ath/ath6kl/usb.c:1059:static int ath6kl_usb_power_on(struct ath6kl *ar)\ndrivers/net/wireless/ath/ath6kl/usb.c-1060-{\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-1064-\ndrivers/net/wireless/ath/ath6kl/usb.c:1065:static int ath6kl_usb_power_off(struct ath6kl *ar)\ndrivers/net/wireless/ath/ath6kl/usb.c-1066-{\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-1070-\ndrivers/net/wireless/ath/ath6kl/usb.c:1071:static void ath6kl_usb_stop(struct ath6kl *ar)\ndrivers/net/wireless/ath/ath6kl/usb.c-1072-{\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-1075-\ndrivers/net/wireless/ath/ath6kl/usb.c:1076:static void ath6kl_usb_cleanup_scatter(struct ath6kl *ar)\ndrivers/net/wireless/ath/ath6kl/usb.c-1077-{\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-1083-\ndrivers/net/wireless/ath/ath6kl/usb.c:1084:static int ath6kl_usb_suspend(struct ath6kl *ar, struct cfg80211_wowlan *wow)\ndrivers/net/wireless/ath/ath6kl/usb.c-1085-{\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-1091-\ndrivers/net/wireless/ath/ath6kl/usb.c:1092:static int ath6kl_usb_resume(struct ath6kl *ar)\ndrivers/net/wireless/ath/ath6kl/usb.c-1093-{\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-1099-\ndrivers/net/wireless/ath/ath6kl/usb.c:1100:static const struct ath6kl_hif_ops ath6kl_usb_ops = {\ndrivers/net/wireless/ath/ath6kl/usb.c:1101:\t.diag_read32 = ath6kl_usb_diag_read32,\ndrivers/net/wireless/ath/ath6kl/usb.c:1102:\t.diag_write32 = ath6kl_usb_diag_write32,\ndrivers/net/wireless/ath/ath6kl/usb.c:1103:\t.bmi_read = ath6kl_usb_bmi_read,\ndrivers/net/wireless/ath/ath6kl/usb.c:1104:\t.bmi_write = ath6kl_usb_bmi_write,\ndrivers/net/wireless/ath/ath6kl/usb.c:1105:\t.power_on = ath6kl_usb_power_on,\ndrivers/net/wireless/ath/ath6kl/usb.c:1106:\t.power_off = ath6kl_usb_power_off,\ndrivers/net/wireless/ath/ath6kl/usb.c:1107:\t.stop = ath6kl_usb_stop,\ndrivers/net/wireless/ath/ath6kl/usb.c:1108:\t.pipe_send = ath6kl_usb_send,\ndrivers/net/wireless/ath/ath6kl/usb.c:1109:\t.pipe_get_default = ath6kl_usb_get_default_pipe,\ndrivers/net/wireless/ath/ath6kl/usb.c:1110:\t.pipe_map_service = ath6kl_usb_map_service_pipe,\ndrivers/net/wireless/ath/ath6kl/usb.c:1111:\t.pipe_get_free_queue_number = ath6kl_usb_get_free_queue_number,\ndrivers/net/wireless/ath/ath6kl/usb.c:1112:\t.cleanup_scatter = ath6kl_usb_cleanup_scatter,\ndrivers/net/wireless/ath/ath6kl/usb.c:1113:\t.suspend = ath6kl_usb_suspend,\ndrivers/net/wireless/ath/ath6kl/usb.c:1114:\t.resume = ath6kl_usb_resume,\ndrivers/net/wireless/ath/ath6kl/usb.c-1115-};\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-1117-/* ath6kl usb driver registered functions */\ndrivers/net/wireless/ath/ath6kl/usb.c:1118:static int ath6kl_usb_probe(struct usb_interface *interface,\ndrivers/net/wireless/ath/ath6kl/usb.c-1119-\t\t\t    const struct usb_device_id *id)\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-1122-\tstruct ath6kl *ar;\ndrivers/net/wireless/ath/ath6kl/usb.c:1123:\tstruct ath6kl_usb *ar_usb = NULL;\ndrivers/net/wireless/ath/ath6kl/usb.c-1124-\tint vendor_id, product_id;\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-1142-\ndrivers/net/wireless/ath/ath6kl/usb.c:1143:\tar_usb = ath6kl_usb_create(interface);\ndrivers/net/wireless/ath/ath6kl/usb.c-1144-\tif (ar_usb == NULL)\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-1155-\tar-\u003ehif_type = ATH6KL_HIF_TYPE_USB;\ndrivers/net/wireless/ath/ath6kl/usb.c:1156:\tar-\u003ehif_ops = \u0026ath6kl_usb_ops;\ndrivers/net/wireless/ath/ath6kl/usb.c-1157-\tar-\u003embox_info.block_size = 16;\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-1172-err_usb_destroy:\ndrivers/net/wireless/ath/ath6kl/usb.c:1173:\tath6kl_usb_destroy(ar_usb);\ndrivers/net/wireless/ath/ath6kl/usb.c-1174-\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-1177-\ndrivers/net/wireless/ath/ath6kl/usb.c:1178:static void ath6kl_usb_disconnect(struct usb_interface *interface)\ndrivers/net/wireless/ath/ath6kl/usb.c-1179-{\ndrivers/net/wireless/ath/ath6kl/usb.c:1180:\tath6kl_usb_device_detached(interface);\ndrivers/net/wireless/ath/ath6kl/usb.c-1181-}\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-1184-\ndrivers/net/wireless/ath/ath6kl/usb.c:1185:static int ath6kl_usb_pm_suspend(struct usb_interface *interface,\ndrivers/net/wireless/ath/ath6kl/usb.c-1186-\t\t\t      pm_message_t message)\ndrivers/net/wireless/ath/ath6kl/usb.c-1187-{\ndrivers/net/wireless/ath/ath6kl/usb.c:1188:\tstruct ath6kl_usb *device;\ndrivers/net/wireless/ath/ath6kl/usb.c-1189-\tdevice = usb_get_intfdata(interface);\ndrivers/net/wireless/ath/ath6kl/usb.c-1190-\ndrivers/net/wireless/ath/ath6kl/usb.c:1191:\tath6kl_usb_flush_all(device);\ndrivers/net/wireless/ath/ath6kl/usb.c-1192-\treturn 0;\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-1194-\ndrivers/net/wireless/ath/ath6kl/usb.c:1195:static int ath6kl_usb_pm_resume(struct usb_interface *interface)\ndrivers/net/wireless/ath/ath6kl/usb.c-1196-{\ndrivers/net/wireless/ath/ath6kl/usb.c:1197:\tstruct ath6kl_usb *device;\ndrivers/net/wireless/ath/ath6kl/usb.c-1198-\tdevice = usb_get_intfdata(interface);\ndrivers/net/wireless/ath/ath6kl/usb.c-1199-\ndrivers/net/wireless/ath/ath6kl/usb.c:1200:\tath6kl_usb_post_recv_transfers(\u0026device-\u003epipes[ATH6KL_USB_PIPE_RX_DATA],\ndrivers/net/wireless/ath/ath6kl/usb.c-1201-\t\t\t\t       ATH6KL_USB_RX_BUFFER_SIZE);\ndrivers/net/wireless/ath/ath6kl/usb.c:1202:\tath6kl_usb_post_recv_transfers(\u0026device-\u003epipes[ATH6KL_USB_PIPE_RX_DATA2],\ndrivers/net/wireless/ath/ath6kl/usb.c-1203-\t\t\t\t       ATH6KL_USB_RX_BUFFER_SIZE);\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-1209-\ndrivers/net/wireless/ath/ath6kl/usb.c:1210:#define ath6kl_usb_pm_suspend NULL\ndrivers/net/wireless/ath/ath6kl/usb.c:1211:#define ath6kl_usb_pm_resume NULL\ndrivers/net/wireless/ath/ath6kl/usb.c-1212-\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-1215-/* table of devices that work with this driver */\ndrivers/net/wireless/ath/ath6kl/usb.c:1216:static const struct usb_device_id ath6kl_usb_ids[] = {\ndrivers/net/wireless/ath/ath6kl/usb.c-1217-\t{USB_DEVICE(0x0cf3, 0x9375)},\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-1222-\ndrivers/net/wireless/ath/ath6kl/usb.c:1223:MODULE_DEVICE_TABLE(usb, ath6kl_usb_ids);\ndrivers/net/wireless/ath/ath6kl/usb.c-1224-\ndrivers/net/wireless/ath/ath6kl/usb.c:1225:static struct usb_driver ath6kl_usb_driver = {\ndrivers/net/wireless/ath/ath6kl/usb.c:1226:\t.name = \"ath6kl_usb\",\ndrivers/net/wireless/ath/ath6kl/usb.c:1227:\t.probe = ath6kl_usb_probe,\ndrivers/net/wireless/ath/ath6kl/usb.c:1228:\t.suspend = ath6kl_usb_pm_suspend,\ndrivers/net/wireless/ath/ath6kl/usb.c:1229:\t.resume = ath6kl_usb_pm_resume,\ndrivers/net/wireless/ath/ath6kl/usb.c:1230:\t.disconnect = ath6kl_usb_disconnect,\ndrivers/net/wireless/ath/ath6kl/usb.c:1231:\t.id_table = ath6kl_usb_ids,\ndrivers/net/wireless/ath/ath6kl/usb.c-1232-\t.supports_autosuspend = true,\n--\ndrivers/net/wireless/ath/ath6kl/usb.c-1235-\ndrivers/net/wireless/ath/ath6kl/usb.c:1236:module_usb_driver(ath6kl_usb_driver);\ndrivers/net/wireless/ath/ath6kl/usb.c-1237-\n"
}

gemini-3.1-pro-preview

null

null

							input: 15787
							output: 42
							thoughts: 96
						

**Initial Assessment & Strategy**

Okay, so the `ath6kl` driver has a USB component – that's potentially very interesting from a fuzzing perspective! The fact that it's USB-enabled means we might be able to leverage the USB dummy HCD, like the one used by syzkaller, for some effective fuzzing. It feels like this could be a great vector for finding some interesting bugs. Now, the patch focuses on modifying `ath6kl_ibss_map_epid` within `drivers/net/wireless/ath/ath6kl/txrx.c`. My first move here is going to be to understand the calling contexts of that specific function. Knowing its usage will allow me to assess the potential impact of the patch and how effectively we can fuzz it.

{
  "Expression": "ath6kl_ibss_map_epid",
  "PathPrefix": "drivers/net/wireless/ath/ath6kl/"
}

{
  "Output": "drivers/net/wireless/ath/ath6kl/txrx.c=37=static inline u8 ath6kl_get_aid(u8 tid_mux)\n--\ndrivers/net/wireless/ath/ath6kl/txrx.c-41-\ndrivers/net/wireless/ath/ath6kl/txrx.c:42:static u8 ath6kl_ibss_map_epid(struct sk_buff *skb, struct net_device *dev,\ndrivers/net/wireless/ath/ath6kl/txrx.c-43-\t\t\t       u32 *map_no)\n--\ndrivers/net/wireless/ath/ath6kl/txrx.c=355=netdev_tx_t ath6kl_data_tx(struct sk_buff *skb, struct net_device *dev)\n--\ndrivers/net/wireless/ath/ath6kl/txrx.c-454-\tif (chk_adhoc_ps_mapping)\ndrivers/net/wireless/ath/ath6kl/txrx.c:455:\t\teid = ath6kl_ibss_map_epid(skb, dev, \u0026map_no);\ndrivers/net/wireless/ath/ath6kl/txrx.c-456-\telse\n"
}

gemini-3.1-pro-preview

null

null

							input: 16404
							output: 39
							thoughts: 56
						

Okay, here's my take on those thoughts, framed as my own:

**Analyzing the Network Transmission Path**

Right, so I'm diving into this `ath6kl_data_tx` function. The key here is that it's being called from `ndo_start_xmit`, which, if I recall correctly, is the kernel's network device's transmit function. I need to be absolutely certain that my understanding is correct; I need to verify that `ath6kl_data_tx` *is* actually what we've hooked up to `ndo_start_xmit`. That's the crucial first step. We need to validate that assumption before proceeding with any in-depth analysis of the data path. This is a foundational piece of the puzzle, and a misunderstanding here would throw everything else off. Let me double-check that quick.

{
  "Expression": "ath6kl_data_tx",
  "PathPrefix": "drivers/net/wireless/ath/ath6kl/"
}

{
  "Output": "drivers/net/wireless/ath/ath6kl/core.h=916=void ath6kl_free_cookie(struct ath6kl *ar, struct ath6kl_cookie *cookie);\ndrivers/net/wireless/ath/ath6kl/core.h:917:netdev_tx_t ath6kl_data_tx(struct sk_buff *skb, struct net_device *dev);\ndrivers/net/wireless/ath/ath6kl/core.h-918-\n--\ndrivers/net/wireless/ath/ath6kl/main.c=868=void ath6kl_pspoll_event(struct ath6kl_vif *vif, u8 aid)\n--\ndrivers/net/wireless/ath/ath6kl/main.c-911-\t\tconn-\u003esta_flags |= STA_PS_POLLED;\ndrivers/net/wireless/ath/ath6kl/main.c:912:\t\tath6kl_data_tx(skb, vif-\u003endev);\ndrivers/net/wireless/ath/ath6kl/main.c-913-\t\tconn-\u003esta_flags \u0026= ~STA_PS_POLLED;\n--\ndrivers/net/wireless/ath/ath6kl/main.c=924=void ath6kl_dtimexpiry_event(struct ath6kl_vif *vif)\n--\ndrivers/net/wireless/ath/ath6kl/main.c-955-\ndrivers/net/wireless/ath/ath6kl/main.c:956:\t\tath6kl_data_tx(skb, vif-\u003endev);\ndrivers/net/wireless/ath/ath6kl/main.c-957-\n--\ndrivers/net/wireless/ath/ath6kl/main.c=1283=static const struct net_device_ops ath6kl_netdev_ops = {\n--\ndrivers/net/wireless/ath/ath6kl/main.c-1285-\t.ndo_stop               = ath6kl_close,\ndrivers/net/wireless/ath/ath6kl/main.c:1286:\t.ndo_start_xmit         = ath6kl_data_tx,\ndrivers/net/wireless/ath/ath6kl/main.c-1287-\t.ndo_set_features       = ath6kl_set_features,\n--\ndrivers/net/wireless/ath/ath6kl/txrx.c=285=int ath6kl_control_tx(void *devt, struct sk_buff *skb,\n--\ndrivers/net/wireless/ath/ath6kl/txrx.c-354-\ndrivers/net/wireless/ath/ath6kl/txrx.c:355:netdev_tx_t ath6kl_data_tx(struct sk_buff *skb, struct net_device *dev)\ndrivers/net/wireless/ath/ath6kl/txrx.c-356-{\n--\ndrivers/net/wireless/ath/ath6kl/txrx.c=1231=static void ath6kl_uapsd_trigger_frame_rx(struct ath6kl_vif *vif,\n--\ndrivers/net/wireless/ath/ath6kl/txrx.c-1280-\ndrivers/net/wireless/ath/ath6kl/txrx.c:1281:\t\tath6kl_data_tx(skb, vif-\u003endev);\ndrivers/net/wireless/ath/ath6kl/txrx.c-1282-\t\tconn-\u003esta_flags \u0026= ~(STA_PS_APSD_TRIGGER);\n--\ndrivers/net/wireless/ath/ath6kl/txrx.c=1300=void ath6kl_rx(struct htc_target *target, struct htc_packet *packet)\n--\ndrivers/net/wireless/ath/ath6kl/txrx.c-1485-\t\t\t\t\tspin_unlock_bh(\u0026conn-\u003epsq_lock);\ndrivers/net/wireless/ath/ath6kl/txrx.c:1486:\t\t\t\t\tath6kl_data_tx(skbuff, vif-\u003endev);\ndrivers/net/wireless/ath/ath6kl/txrx.c-1487-\t\t\t\t\tspin_lock_bh(\u0026conn-\u003epsq_lock);\n--\ndrivers/net/wireless/ath/ath6kl/txrx.c-1492-\t\t\t\t\tspin_unlock_bh(\u0026conn-\u003epsq_lock);\ndrivers/net/wireless/ath/ath6kl/txrx.c:1493:\t\t\t\t\tath6kl_data_tx(skbuff, vif-\u003endev);\ndrivers/net/wireless/ath/ath6kl/txrx.c-1494-\t\t\t\t\tspin_lock_bh(\u0026conn-\u003epsq_lock);\n--\ndrivers/net/wireless/ath/ath6kl/txrx.c-1589-\t\tif (skb1)\ndrivers/net/wireless/ath/ath6kl/txrx.c:1590:\t\t\tath6kl_data_tx(skb1, vif-\u003endev);\ndrivers/net/wireless/ath/ath6kl/txrx.c-1591-\n"
}

gemini-3.1-pro-preview

null

null

							input: 17932
							output: 40
							thoughts: 126
						

**Analyzing a Wireless Driver Vulnerability**

Okay, so `ath6kl_data_tx` is definitively the `ndo_start_xmit` function - got it. That means it's the entry point for network packet transmission, which, as everyone knows, makes it a prime target for fuzzing. The patch I'm looking at addresses an out-of-bounds access within `ath6kl_ibss_map_epid`. The question is, can we actually *reach* that function?

Let's see... `ath6kl_ibss_map_epid` is called within `ath6kl_data_tx`, but only under the condition that `chk_adhoc_ps_mapping` is true. Right. So, that's the key. We need to understand the conditions under which `chk_adhoc_ps_mapping` evaluates to true to figure out if we can even trigger this vulnerability. Time to dig deeper into the code and see what makes that variable tick.

{
  "Expression": "chk_adhoc_ps_mapping",
  "PathPrefix": "drivers/net/wireless/ath/ath6kl/"
}

{
  "Output": "drivers/net/wireless/ath/ath6kl/txrx.c=355=netdev_tx_t ath6kl_data_tx(struct sk_buff *skb, struct net_device *dev)\n--\ndrivers/net/wireless/ath/ath6kl/txrx.c-363-\tu8 ac = 99; /* initialize to unmapped ac */\ndrivers/net/wireless/ath/ath6kl/txrx.c:364:\tbool chk_adhoc_ps_mapping = false;\ndrivers/net/wireless/ath/ath6kl/txrx.c-365-\tint ret;\n--\ndrivers/net/wireless/ath/ath6kl/txrx.c-438-\t\t    ar-\u003eibss_ps_enable \u0026\u0026 test_bit(CONNECTED, \u0026vif-\u003eflags))\ndrivers/net/wireless/ath/ath6kl/txrx.c:439:\t\t\tchk_adhoc_ps_mapping = true;\ndrivers/net/wireless/ath/ath6kl/txrx.c-440-\t\telse {\n--\ndrivers/net/wireless/ath/ath6kl/txrx.c-453-\ndrivers/net/wireless/ath/ath6kl/txrx.c:454:\tif (chk_adhoc_ps_mapping)\ndrivers/net/wireless/ath/ath6kl/txrx.c-455-\t\teid = ath6kl_ibss_map_epid(skb, dev, \u0026map_no);\n"
}

gemini-3.1-pro-preview

null

null

							input: 18686
							output: 36
							thoughts: 145
						

**My Assessment of the Bug Fix and Fuzzing Strategy**

Okay, so I've pinpointed the condition: this variable is set to true when the Wi-Fi interface type is ad-hoc, IBSS power-save is enabled, and the interface is connected. Seems pretty straightforward – definitely a reachable code path. The patch claims to fix an out-of-bounds access. Given the potential severity of OOB issues, and the relatively clear trigger condition, this is *absolutely* worth fuzzing.

Now, let's nail down the configuration requirements for successful fuzzing. I'm thinking we'll need `CONFIG_ATH6KL` and either `CONFIG_ATH6KL_USB` or `CONFIG_ATH6KL_SDIO`. USB will probably be easier to work with from a fuzzing perspective, but let's quickly double-check the `drivers/net/wireless/ath/ath6kl/Kconfig` file to confirm those config names are exactly correct and there aren't any subtle dependencies I'm missing. Getting the configuration right upfront saves time and frustration later.

{
  "Expression": "config ATH6KL",
  "PathPrefix": "drivers/net/wireless/ath/ath6kl/"
}

{
  "Output": "drivers/net/wireless/ath/ath6kl/Kconfig-1-# SPDX-License-Identifier: ISC\ndrivers/net/wireless/ath/ath6kl/Kconfig:2:config ATH6KL\ndrivers/net/wireless/ath/ath6kl/Kconfig-3-\ttristate \"Atheros mobile chipsets support\"\n--\ndrivers/net/wireless/ath/ath6kl/Kconfig-13-\ndrivers/net/wireless/ath/ath6kl/Kconfig:14:config ATH6KL_SDIO\ndrivers/net/wireless/ath/ath6kl/Kconfig-15-\ttristate \"Atheros ath6kl SDIO support\"\n--\ndrivers/net/wireless/ath/ath6kl/Kconfig-24-\ndrivers/net/wireless/ath/ath6kl/Kconfig:25:config ATH6KL_USB\ndrivers/net/wireless/ath/ath6kl/Kconfig-26-\ttristate \"Atheros ath6kl USB support\"\n--\ndrivers/net/wireless/ath/ath6kl/Kconfig-34-\ndrivers/net/wireless/ath/ath6kl/Kconfig:35:config ATH6KL_DEBUG\ndrivers/net/wireless/ath/ath6kl/Kconfig-36-\tbool \"Atheros ath6kl debugging\"\n--\ndrivers/net/wireless/ath/ath6kl/Kconfig-44-\ndrivers/net/wireless/ath/ath6kl/Kconfig:45:config ATH6KL_TRACING\ndrivers/net/wireless/ath/ath6kl/Kconfig-46-\tbool \"Atheros ath6kl tracing support\"\n--\ndrivers/net/wireless/ath/ath6kl/Kconfig-56-\ndrivers/net/wireless/ath/ath6kl/Kconfig:57:config ATH6KL_REGDOMAIN\ndrivers/net/wireless/ath/ath6kl/Kconfig-58-\tbool \"Atheros ath6kl regdomain support\"\n"
}

gemini-3.1-pro-preview

null

null

							input: 19581
							output: 42
							thoughts: 273
						

**Focusing on Specific Functions for Analysis**

Okay, so I'm looking at the `ATH6KL` and `ATH6KL_USB` configurations. My initial thought is to figure out the key functions to examine. Right now, I'm keyed in on `ath6kl_ibss_map_epid` because it's the modified one. It appears that `ath6kl_data_tx` is the caller. I should probably check for any other related functions.

Right, `ath6kl_ibss_map_epid` is a static function located within `drivers/net/wireless/ath/ath6kl/txrx.c`. I was going to add both `ath6kl_ibss_map_epid` and `ath6kl_data_tx` to my `FocusSymbols` list. However, I need to pause for a second. `ath6kl_data_tx` is a hot-path function, specifically the `ndo_start_xmit` entry point. The instructions advise avoiding hot-path functions to avoid skewed test distributions.

Even though `ath6kl_data_tx` is specific to the `ath6kl` driver, it's also the primary TX path for it. That makes it more generic than it should be. Thus, I'll stick to `ath6kl_ibss_map_epid` – it's more specific to the modification and should provide a clearer signal. I'll continue searching for any other potentially relevant functions.

{
  "Expression": "ath6kl_ibss_map_epid",
  "PathPrefix": "drivers/net/wireless/ath/ath6kl/"
}

{
  "Output": "drivers/net/wireless/ath/ath6kl/txrx.c=37=static inline u8 ath6kl_get_aid(u8 tid_mux)\n--\ndrivers/net/wireless/ath/ath6kl/txrx.c-41-\ndrivers/net/wireless/ath/ath6kl/txrx.c:42:static u8 ath6kl_ibss_map_epid(struct sk_buff *skb, struct net_device *dev,\ndrivers/net/wireless/ath/ath6kl/txrx.c-43-\t\t\t       u32 *map_no)\n--\ndrivers/net/wireless/ath/ath6kl/txrx.c=355=netdev_tx_t ath6kl_data_tx(struct sk_buff *skb, struct net_device *dev)\n--\ndrivers/net/wireless/ath/ath6kl/txrx.c-454-\tif (chk_adhoc_ps_mapping)\ndrivers/net/wireless/ath/ath6kl/txrx.c:455:\t\teid = ath6kl_ibss_map_epid(skb, dev, \u0026map_no);\ndrivers/net/wireless/ath/ath6kl/txrx.c-456-\telse\n"
}

gemini-3.1-pro-preview

null

null

							input: 20532
							output: 129
							thoughts: 380
						

**Analyzing a Potential Out-of-Bounds Issue in `ath6kl_ibss_map_epid`**

Okay, so I see that the diff *only* touches `ath6kl_ibss_map_epid`. Let's confirm that's the sole function modified – yup, just that one. This immediately focuses my attention. The change seems to be correcting an out-of-bounds array access within this function. It looks like the prior logic had a flaw in how it handled `ar->node_num` before using it as an index.

Specifically, it seems the bounds check wasn't quite right. It checked if `ar->node_num` *exceeded* `MAX_NODE_NUM` but then incremented it before using it as an index. Now it checks if `ar->node_num` is *greater than or equal to* `MAX_NODE_NUM` before incrementing. This is a classic off-by-one error fix. The updated code, in essence, ensures that `ar->node_num` is within bounds before it's used to index into `ar->node_map`.

Given that this is an `ath6kl` driver and the context mentions the USB interface, I should double-check the relevant configuration options. Looks like `ATH6KL` and `ATH6KL_USB` are the ones to be aware of. The fact that the driver has a USB interface suggests it could be fuzzable, which is good to keep in mind. Based on this analysis, I'd say that `ath6kl_ibss_map_epid` is definitely a function I want to target for fuzzing.

{
  "EnableConfigs": [
    "ATH6KL",
    "ATH6KL_USB"
  ],
  "FocusSymbols": [
    "ath6kl_ibss_map_epid"
  ],
  "Reasoning": "The patch fixes an out-of-bounds array access in `ath6kl_ibss_map_epid` by correcting the bounds check on `ar-\u003enode_num` before incrementing it and using it as an index. The `ath6kl` driver can be fuzzed via its USB interface (`CONFIG_ATH6KL_USB`).",
  "WorthFuzzing": true
}

{
  "EnableConfigs": [
    "ATH6KL",
    "ATH6KL_USB"
  ],
  "FocusSymbols": [
    "ath6kl_ibss_map_epid"
  ],
  "Reasoning": "The patch fixes an out-of-bounds array access in `ath6kl_ibss_map_epid` by correcting the bounds check on `ar-\u003enode_num` before incrementing it and using it as an index. The `ath6kl` driver can be fuzzed via its USB interface (`CONFIG_ATH6KL_USB`).",
  "WorthFuzzing": true
}