Same issue as mt7915: link->mt76.cipher is set on key installation but never cleared on removal. The WA firmware retains the stale cipher in BSS_INFO, sets the protection bit on WED-offloaded frames, and drops all plaintext traffic when encryption is switched to open/none. Reset link->mt76.cipher to zero and call mt7996_mcu_add_bss_info() when the last group key is removed. The clearing is guarded by checking that both hw_key_idx and hw_key_idx2 are unset (-1) so that GTK rotation and BIGTK removal while another group key is active do not trigger a premature zero-cipher BSS update. Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") Cc: stable@vger.kernel.org Signed-off-by: Joshua Klinesmith --- .../net/wireless/mediatek/mt76/mt7996/main.c | 23 ++++++++++++++++--- 1 file changed, 20 insertions(+), 3 deletions(-) diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/main.c b/drivers/net/wireless/mediatek/mt76/mt7996/main.c index f16135f0b7f9..8b1bc3237527 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7996/main.c +++ b/drivers/net/wireless/mediatek/mt76/mt7996/main.c @@ -244,10 +244,27 @@ mt7996_set_hw_key(struct ieee80211_hw *hw, enum set_key_cmd cmd, &link->mt76, msta_link, true); } - if (cmd == SET_KEY) + if (cmd == SET_KEY) { *wcid_keyidx = idx; - else if (idx == *wcid_keyidx) - *wcid_keyidx = -1; + } else { + if (idx == *wcid_keyidx) + *wcid_keyidx = -1; + + /* Clear BSS cipher only when the last group key is removed; + * during GTK rotation the new key is installed before the old + * one is removed, so hw_key_idx still points at the new key + * and this condition stays false. + */ + if (!sta && link->mt76.cipher && + msta_link->wcid.hw_key_idx == (u8)-1 && + msta_link->wcid.hw_key_idx2 == (u8)-1) { + link->mt76.cipher = 0; + if (link->phy) + mt7996_mcu_add_bss_info(link->phy, vif, + link_conf, &link->mt76, + msta_link, true); + } + } /* only do remove key for BIGTK */ if (cmd != SET_KEY && !is_bigtk) -- 2.43.0