Skip to content

Conversation

@zbowling
Copy link

@zbowling zbowling commented Jan 1, 2026

During MLO roaming, mac80211 may request key removal after the link state
has already been torn down. The current code dereferences mlink->wcid
without checking if mlink is NULL, causing crashes or -EINVAL errors.

This is a race condition where:

  1. MLO link teardown begins, cleaning up driver state
  2. mac80211 requests group key removal for the old link
  3. mt792x_vif_to_bss_conf() or related functions return NULL
  4. Driver either crashes or returns -EINVAL, confusing upper layers

The fix adds NULL checks for link_conf, mconf, and mlink. When removing
a key (cmd != SET_KEY), if the link state is already gone, return success
(0) instead of error - the key is effectively removed when the link was
torn down.

This prevents the following errors during roaming:

wlp192s0: failed to remove key (1, ff:ff:ff:ff:ff:ff) from hardware (-22)
wlp192s0: failed to remove key (4, ff:ff:ff:ff:ff:ff) from hardware (-22)

And the associated wpa_supplicant warnings:

nl80211: kernel reports: link ID must for MLO group key

Related: #1036

Testing: Tested on Framework Desktop with MT7925 WiFi during overnight roaming stress test.

During MLO roaming, mac80211 may request key removal after the link state
has already been torn down. The current code dereferences mlink->wcid
without checking if mlink is NULL, causing crashes or -EINVAL errors.

This is a race condition where:
1. MLO link teardown begins, cleaning up driver state
2. mac80211 requests group key removal for the old link
3. mt792x_vif_to_bss_conf() or related functions return NULL
4. Driver either crashes or returns -EINVAL, confusing upper layers

The fix adds NULL checks for link_conf, mconf, and mlink. When removing
a key (cmd != SET_KEY), if the link state is already gone, return success
(0) instead of error - the key is effectively removed when the link was
torn down.

This prevents the following errors during roaming:
  wlp192s0: failed to remove key (1, ff:ff:ff:ff:ff:ff) from hardware (-22)
  wlp192s0: failed to remove key (4, ff:ff:ff:ff:ff:ff) from hardware (-22)

And the associated wpa_supplicant warnings:
  nl80211: kernel reports: link ID must for MLO group key

Link: openwrt#1036
Signed-off-by: Zac Bowling <zac@zacbowling.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant