Since commit eddc7286f6bb ("wifi: mt76: mt7996: fix key add/remove imbalance"), mt7996_vif_link_destroy() walks the vif keys with SET_KEY. Before that commit the walk used DISABLE_KEY. The commit message says a key for a link is added and removed only once, but a SET_KEY walk on destroy uploads the keys again, and for a BIGTK with beaconing enabled it also removes and adds the beacon of the link being destroyed. Remove the walk. mac80211 removes the keys itself with set_key() calls, which is the one removal that commit describes. The walk currently finds no keys: mt7996_vif_link_destroy() runs for a non-offchannel link only from mt7996_remove_interface(), and ieee80211_do_stop() frees the keys of the interface before drv_remove_interface(). An interface type change goes through the same path, since mt7996 has no .change_interface. Found by inspection. Signed-off-by: Felix Fietkau --- drivers/net/wireless/mediatek/mt76/mt7996/main.c | 7 ------- 1 file changed, 7 deletions(-) diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/main.c b/drivers/net/wireless/mediatek/mt76/mt7996/main.c index e74254928578..f94b5fdfca24 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7996/main.c +++ b/drivers/net/wireless/mediatek/mt76/mt7996/main.c @@ -425,19 +425,12 @@ static void mt7996_vif_link_destroy(struct mt7996_phy *phy, struct mt7996_sta_link *msta_link = &link->msta_link; unsigned int link_id = msta_link->wcid.link_id; struct mt76_vif_link *mlink = &link->mt76; - struct mt7996_key_iter_data it = { - .cmd = SET_KEY, - .link_id = link_id, - }; struct mt7996_dev *dev = phy->dev; int idx = msta_link->wcid.idx; if (!link_conf) link_conf = &vif->bss_conf; - if (!mlink->wcid->offchannel) - ieee80211_iter_keys(phy->mt76->hw, vif, mt7996_key_iter, &it); - mt7996_mcu_add_sta(dev, link_conf, NULL, link, NULL, CONN_STATE_DISCONNECT, false); mt7996_mcu_add_bss_info(phy, vif, link_conf, mlink, msta_link, false); -- 2.47.3