[PATCH AUTOSEL 6.18] wifi: iwlwifi: mld: call iwl_mld_free_ap_early_key() for AP only
From: Sasha Levin
Date: Mon Aug 31 2026 - 11:41:31 EST
From: Avraham Stern <avraham.stern@xxxxxxxxx>
[ Upstream commit c35c44434329c6b3bd2c6c1e5add5ae10d933a4d ]
The driver supports intalling IGTK on a NAN device interface. When
the IGTK is removed, iwl_mld_free_ap_early_key() is called which
results in a warning since no links are attached to this interface.
The iwl_mld_free_ap_early_key() function should be called for AP or
IBSS interfaces only. Check the interface type before calling it.
Signed-off-by: Avraham Stern <avraham.stern@xxxxxxxxx>
Link: https://patch.msgid.link/20260512222731.d67d658b421d.Ife2d1f3b17119ce696582ce6a2a69026d368d8af@changeid
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@xxxxxxxxx>
Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>
---
LLM Generated explanations, may be completely bogus:
# Stable Backport Analysis: `wifi: iwlwifi: mld: call
iwl_mld_free_ap_early_key() for AP only`
**Local tree:** `v6.18.44` (Makefile: 6.18.44)
---
## PHASE 1: COMMIT MESSAGE FORENSICS
### Step 1.1: Subject line
**Record:** `[wifi: iwlwifi: mld]` `[call/fix]` — Only call
`iwl_mld_free_ap_early_key()` on AP/IBSS interfaces, not on all non-
pairwise key removals.
### Step 1.2: Tags
**Record:**
- **Signed-off-by:** Avraham Stern `<avraham.stern@xxxxxxxxx>` (author)
- **Signed-off-by:** Miri Korenblit
`<miriam.rachel.korenblit@xxxxxxxxx>` (maintainer)
- **Link:** `https://patch.msgid.link/20260512222731.d67d658b421d...`
(patch submission reference)
- No `Fixes:`, `Reported-by:`, `Tested-by:`, `Reviewed-by:`, `Cc:
stable@xxxxxxxxxxxxxxx`
- Notable: no syzbot/fuzzer report; Intel iwlwifi maintainer sign-off
### Step 1.3: Body analysis
**Record:**
- **Bug:** IGTK can be installed on a NAN device interface. On removal,
`iwl_mld_free_ap_early_key()` is called unconditionally for non-
pairwise keys, but NAN has no attached links → `WARN_ON(!link)` fires
inside that helper.
- **Symptom:** Kernel warning (`WARN_ON`) during IGTK removal on NAN.
- **Root cause:** `iwl_mld_free_ap_early_key()` is AP/IBSS-only logic
(early key staging before bcast/mcast STAs exist), but the remove path
called it for every non-pairwise key regardless of interface type.
- **Fix:** Gate the call on `vif->type == NL80211_IFTYPE_AP || vif->type
== NL80211_IFTYPE_ADHOC`, matching the store path.
### Step 1.4: Hidden bug fix?
**Record:** Yes. Although not labeled "fix", this corrects an asymmetric
store/remove bug. The store path already restricts early-key handling to
AP/IBSS; the remove path did not.
---
## PHASE 2: DIFF ANALYSIS
### Step 2.1: Inventory
**Record:**
- **File:** `drivers/net/wireless/intel/iwlwifi/mld/mac80211.c` (+2
lines, scope unchanged)
- **Function:** `iwl_mld_set_key_remove()`
- **Scope:** Single-file, surgical (2-line condition extension)
### Step 2.2: Code flow change
**Record:**
- **Before:** Any non-pairwise key removal →
`iwl_mld_free_ap_early_key()`.
- **After:** Non-pairwise key removal on AP or IBSS only →
`iwl_mld_free_ap_early_key()`.
- **Affected path:** `DISABLE_KEY` → `iwl_mld_set_key_remove()` → early-
key cleanup before `iwl_mld_remove_key()`.
### Step 2.3: Bug mechanism
**Record:** **Logic / correctness fix.** `iwl_mld_free_ap_early_key()`
dereferences `mld_vif->link[key->link_id]`:
```196:207:drivers/net/wireless/intel/iwlwifi/mld/ap.c
void iwl_mld_free_ap_early_key(struct iwl_mld *mld,
struct ieee80211_key_conf *key,
struct iwl_mld_vif *mld_vif)
{
struct iwl_mld_link *link;
if (WARN_ON(key->link_id < 0))
return;
link = iwl_mld_link_dereference_check(mld_vif, key->link_id);
if (WARN_ON(!link))
return;
```
Called from interfaces that never use early-key storage → spurious
`WARN_ON`.
### Step 2.4: Fix quality
**Record:** Obviously correct; mirrors existing store guard at lines
2099–2102. Minimal regression risk. No new APIs or behavior changes
beyond suppressing incorrect helper calls.
---
## PHASE 3: GIT HISTORY INVESTIGATION
### Step 3.1: Blame
**Record:** All lines in this file blame to `7e22de67e545d` (squashed
stable snapshot). Meaningful per-line history unavailable in this
checkout.
### Step 3.2: Fixes: tag
**Record:** N/A — no `Fixes:` tag present.
### Step 3.3: File history
**Record:** `git log` on `mld/mac80211.c` returns only the squashed HEAD
commit. Cannot trace introduction of the asymmetry via git history in
this tree.
### Step 3.4: Author context
**Record:** Avraham Stern (Intel iwlwifi). Miri Korenblit signed off —
iwlwifi maintainer. Part of May 2026 iwlwifi update series (NAN/IGTK
work in
`20260511_miriam_rachel_korenblit_wifi_iwlwifi_updates_2026_05_11.mbx`).
### Step 3.5: Dependencies
**Record:** Standalone. No series dependency. Applies to existing
`iwl_mld_set_key_remove()` without prerequisite commits.
---
## PHASE 4: MAILING LIST AND EXTERNAL RESEARCH
### Step 4.1: Original discussion
**Record:** `b4 dig -c HEAD` did not match this patch (HEAD is unrelated
amdgpu commit). No `.mbx` file for this specific patch in the workspace.
Lore.kernel.org blocked by bot protection. Link tag points to May 12,
2026 submission; not directly fetchable.
### Step 4.2: Reviewers
**Record:** UNVERIFIED — could not retrieve thread via b4/lore.
### Step 4.3: Bug report
**Record:** No external bug report referenced. Bug described in commit
message only (NAN IGTK removal warning).
### Step 4.4: Related patches
**Record:** Related iwlwifi mld NAN/IGTK work in
`20260511_miriam_rachel_korenblit_wifi_iwlwifi_updates_2026_05_11.mbx`
(patches 8–10 add NAN TLC, NAN data, separate TX/RX IGTK tracking). This
fix is a follow-on to that work.
### Step 4.5: Stable list history
**Record:** UNVERIFIED — lore stable search inaccessible.
---
## PHASE 5: CODE SEMANTIC ANALYSIS
### Step 5.1: Key functions
**Record:** `iwl_mld_set_key_remove()`, `iwl_mld_free_ap_early_key()`,
`iwl_mld_store_ap_early_key()`, `iwl_mld_mac80211_set_key()`.
### Step 5.2: Callers
**Record:**
- `iwl_mld_set_key_remove()` ← `iwl_mld_mac80211_set_key()`
(`DISABLE_KEY`)
- `iwl_mld_mac80211_set_key()` is the mac80211 `set_key` driver callback
— reachable on normal WiFi key install/remove from userspace
(wpa_supplicant, hostapd, NetworkManager).
### Step 5.3: Callees
**Record:** `iwl_mld_free_ap_early_key()` →
`iwl_mld_link_dereference_check()` → `WARN_ON` on invalid/missing link.
`iwl_mld_remove_key()` handles actual FW key removal afterward.
### Step 5.4: Reachability
**Record:** **Yes, from userspace.** Any `DISABLE_KEY` for a group key
(GTK/IGTK/BIGTK) triggers this path. Store path is already AP/IBSS-only:
```2094:2102:drivers/net/wireless/intel/iwlwifi/mld/mac80211.c
/* After exiting from RFKILL, hostapd configures GTK/ITGK before
the
- AP is started, but those keys can't be sent to the FW before the
- MCAST/BCAST STAs are added to it (which happens upon AP start).
- Store it here to be sent later when the AP is started.
*/
if ((vif->type == NL80211_IFTYPE_ADHOC ||
vif->type == NL80211_IFTYPE_AP) && !sta &&
!mld_vif->ap_ibss_active)
return iwl_mld_store_ap_early_key(mld, key, mld_vif);
```
For STA, `key->link_id` is often `-1` (non per-link keys per `key.c`),
which also triggers `WARN_ON(key->link_id < 0)` in the helper today.
### Step 5.5: Similar patterns
**Record:** Store/remove asymmetry is the only instance. Fix aligns
remove with store.
---
## PHASE 6: CROSS-REFERENCING AGAINST LOCAL TREE (6.18.44)
### Step 6.1: Buggy code present?
**Record:** **Yes.** Current tree at lines 2160–2162 still has the
unconditional call:
```2160:2162:drivers/net/wireless/intel/iwlwifi/mld/mac80211.c
/* if this key was stored to be added later to the FW - free it
here */
if (!(key->flags & IEEE80211_KEY_FLAG_PAIRWISE))
iwl_mld_free_ap_early_key(mld, key, mld_vif);
```
`iwl_mld` driver fully present (65 files under `mld/`).
### Step 6.2: Backport difficulty
**Record:** Clean apply expected — 2-line condition change, no conflicts
anticipated.
### Step 6.3: Related fixes already present?
**Record:** No equivalent fix found. `git log --grep` found nothing
(squashed history).
### NAN-specific note for this tree
**Record:** `NL80211_IFTYPE_NAN` is **not** in `wiphy->interface_modes`
in this tree (lines 268–273). Full NAN IGTK support from the May 11
series (patches 8–10) is **not** present (no `tx_igtk`/`rx_igtk`, no
`NL80211_IFTYPE_NAN` in mac80211.c). The commit-message NAN scenario is
not yet reachable here, but the STA group-key removal path **is**
reachable and can hit the same helper incorrectly.
---
## PHASE 7: SUBSYSTEM CONTEXT
### Step 7.1: Subsystem criticality
**Record:** `drivers/net/wireless/intel/iwlwifi/mld` — IMPORTANT (Intel
WiFi driver, iwl_mld for newer MLD-capable hardware). Not core kernel,
but affects WiFi users on supported Intel hardware.
### Step 7.2: Activity
**Record:** Actively developed; iwl_mld is relatively new (copyright
2024–2025) with ongoing NAN/MLO work.
---
## PHASE 8: IMPACT AND RISK ASSESSMENT
### Step 8.1: Who is affected
**Record:** Users of Intel iwl_mld hardware (WiFi 6E/7 MLD-capable
devices). All interface types that remove group keys (STA most common
today; NAN when that support lands).
### Step 8.2: Trigger conditions
**Record:** Removing any non-pairwise key (GTK/IGTK/BIGTK) on a non-
AP/IBSS interface. Common during STA disconnect/roaming. Unprivileged
users trigger via normal WiFi stack operations.
### Step 8.3: Failure mode severity
**Record:** `WARN_ON` in driver — **MEDIUM**. No crash, corruption, or
deadlock by default. Can spam dmesg; with `panic_on_warn` enabled, could
panic. Functional key removal continues via `iwl_mld_remove_key()`.
### Step 8.4: Risk-benefit
**Record:**
- **Benefit:** Eliminates spurious warnings on STA (and future NAN)
group-key removal; corrects logic bug; trivial fix.
- **Risk:** Very low — 2 lines, mirrors existing store guard, no
behavior change for AP/IBSS.
- **Ratio:** Favorable for backport.
---
## PHASE 9: FINAL SYNTHESIS
### Step 9.1: Evidence summary
**FOR backport:**
- Real logic bug: remove path calls AP-only helper for all non-pairwise
keys
- Reachable today on STA group-key removal (common path)
- Matches existing store-path guard — obviously correct
- 2-line, contained fix; no new APIs
- iwl_mld code exists in v6.18.44; fix applies cleanly
- Intel maintainer sign-off
**AGAINST backport:**
- Failure mode is `WARN_ON` only, not crash/corruption (borderline
importance)
- NAN-specific scenario from commit message not yet reachable in 6.18.44
(NAN not exposed)
- iwl_mld user base still growing vs legacy mvm
**UNRESOLVED:**
- No mailing-list review thread retrieved
- Cannot confirm via git when asymmetry was introduced (squashed tree)
### Step 9.2: Stable rules checklist
1. Obviously correct and tested? **PASS** — mirrors store guard;
maintainer SOB; logic verifiable by inspection. No independent
Tested-by.
2. Fixes a real bug affecting users? **PASS** — spurious `WARN_ON` on
group-key removal for non-AP/IBSS interfaces.
3. Important issue? **PASS (borderline)** — `WARN_ON` spam; possible
panic with `panic_on_warn`; not data corruption or security.
4. Small and contained? **PASS** — 2 lines, one function.
5. No new features or APIs? **PASS**.
6. Can apply to local tree? **PASS** — buggy code confirmed present.
### Step 9.3: Exception categories
**Record:** None (not device ID, quirk, DT, build fix, or docs).
### Step 9.4: Decision rationale
This is a small, obviously correct fix for a real driver logic error.
The store path already limits early-key handling to AP/IBSS; the remove
path should match. Without the fix, removing group keys on STA (and
eventually NAN) triggers unnecessary `WARN_ON` calls inside
`iwl_mld_free_ap_early_key()`. While severity is medium (warning, not
crash), the fix is minimal, low-risk, and aligns two code paths that
should never have diverged. It meets stable criteria for iwlwifi driver
bug fixes.
---
## Verification
- **[Phase 1]** Parsed commit message, tags, and body from user query
- **[Phase 2]** Read diff and `iwl_mld_free_ap_early_key()` in `ap.c`;
confirmed `WARN_ON` mechanism
- **[Phase 2]** Read `iwl_mld_set_key_remove()` and store-path guard in
`mac80211.c`
- **[Phase 3]** `git describe HEAD` → `v6.18.44`
- **[Phase 3]** `git blame -L 2160,2162` → lines present, squashed
history
- **[Phase 3]** `git log --oneline --
drivers/net/wireless/intel/iwlwifi/mld/mac80211.c` → single squashed
commit
- **[Phase 4]** `b4 dig -c HEAD` → no match for this patch
- **[Phase 4]** Searched workspace `.mbx` files → no mbox for this
specific patch
- **[Phase 4]** WebFetch lore.kernel.org → blocked (bot protection)
- **[Phase 4]** Read
`20260511_miriam_rachel_korenblit_wifi_iwlwifi_updates_2026_05_11.mbx`
→ related NAN/IGTK series context
- **[Phase 5]** `rg iwl_mld_free_ap_early_key` → call sites in
`mac80211.c`, definition in `ap.c`
- **[Phase 5]** Traced `iwl_mld_mac80211_set_key()` → `DISABLE_KEY` →
`iwl_mld_set_key_remove()`
- **[Phase 5]** Read `key.c` `iwl_mld_get_key_sta_mask()` →
`key->link_id < 0` common for non per-link STA keys
- **[Phase 6]** Confirmed buggy code at lines 2160–2162 without AP/IBSS
check
- **[Phase 6]** Confirmed `NL80211_IFTYPE_NAN` not in `interface_modes`
(lines 268–273)
- **[Phase 6]** Confirmed no `tx_igtk`/`rx_igtk` NAN IGTK refactor from
May series in current tree
- **[Phase 6]** Confirmed `iwl_mld` driver present (65 files)
- **[Phase 7]** Identified subsystem as iwlwifi mld driver
- **[Phase 8]** Assessed failure mode as `WARN_ON` (MEDIUM severity)
- **UNVERIFIED:** Mailing-list review discussion and explicit stable
nominations
- **UNVERIFIED:** Whether `panic_on_warn` reports exist for this issue
- **UNVERIFIED:** Exact commit SHA on mainline (not in this tree's git
log)
**YES**
drivers/net/wireless/intel/iwlwifi/mld/mac80211.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c
index 322669d78b193..27ae06e208402 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/mac80211.c
@@ -2164,7 +2164,9 @@ static void iwl_mld_set_key_remove(struct iwl_mld *mld,
}
/* if this key was stored to be added later to the FW - free it here */
- if (!(key->flags & IEEE80211_KEY_FLAG_PAIRWISE))
+ if (!(key->flags & IEEE80211_KEY_FLAG_PAIRWISE) &&
+ (vif->type == NL80211_IFTYPE_AP ||
+ vif->type == NL80211_IFTYPE_ADHOC))
iwl_mld_free_ap_early_key(mld, key, mld_vif);
/* We already removed it */
--
2.53.0