CachyOS / CachyOS/linux-cachyos

[BUG] mt7921e: TDLS key addition failure causes complete TX/RX interface lockup during 802.11z negotiation

Open
#983 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Shell
Stars
4.5k
Forks
160
Avg merge
2d 12h
Merged PRs (30d)
1

Description

### Pre-flight checklist
- [x] I have searched existing issues and this is not a duplicate.
- [x] I have read the [Contributing Guidelines](https://github.com/CachyOS/linux-cachyos/blob/master/CONTRIBUTING.md).
- [x] I have verified the issue is reproducible with the latest available CachyOS kernel.
- [x] I have tried to reproduce the issue on Arch Linux's `linux` kernel.

### Upstream / vanilla kernel check
I have not tested with a vanilla/upstream kernel

### Kernel variant
linux-cachyos (EEVDF, Clang)

### System information (cachyos-bugreport.sh)
- **OS:** CachyOS (Kernel 7.1.8-1-cachyos x86_64)
- **CPU:** AMD Ryzen 5 7640HS w/ Radeon 760M Graphics
- **Wi-Fi Hardware:** MEDIATEK Corp. MT7921 802.11ax PCIe Wireless Network Adapter [Filogic 330] [14c3:7961]
- **Subsystem:** AzureWave Device [1a3b:4682]
- **Driver:** `mt7921e` (in-tree)
- **Firmware:** HW/SW: 0x8a108a10 (Build: 20260224110909a), WM Firmware Version: ____010000 (Build: 20260224110949)
- **Wireless Stack:** `wpa_supplicant 2.12` / `NetworkManager`

### Bug description
When an external wireless peer on the same local BSSID (e.g., an Android device) initiates an 802.11z TDLS (Tunneled Direct Link Setup) request during peer-to-peer IP traffic (such as an SSH session over local IP or Tailscale direct peer communication), `wpa_supplicant` attempts to install the TDLS Pairwise Key (TPK) into the `mt7921e` kernel driver via `nl80211`.

The kernel driver rejects the key addition with `kernel reports: key addition failed`. Immediately following this failure, the MT7921 interface (`wlan0`) enters a hung state where it completely stops transmitting and receiving frames. All network connectivity drops indefinitely on the host until the wireless interface is hard-toggled via `rfkill` / NetworkManager restart.

### Steps to reproduce
1. Connect a machine equipped with a MediaTek MT7921 adapter to an 802.11ax/ac Wi-Fi AP using `NetworkManager` with default `wpa_supplicant`.
2. Connect another device that supports/triggers 802.11z TDLS (such as a Samsung Galaxy Android smartphone) to the same Wi-Fi network.
3. Initiate direct peer-to-peer traffic between the two devices (e.g. SSH into the laptop from the phone over local Wi-Fi or direct Tailscale socket).
4. Once the phone sends TDLS discovery / setup requests, the MT7921 driver fails on TPK key configuration.
5. All subsequent IP traffic on `wlan0` times out / drops until Wi-Fi is restarted.

### Expected behavior
The driver should either successfully configure the TDLS TPK encryption key, or gracefully ignore/reject the TDLS setup request without corrupting the active TX/RX queue / PHY state.

### Actual behavior
The driver rejects the key and permanently wedges the interface until restart:
```text
wpa_supplicant: TDLS: Creating peer entry for ce:8e:61:eb:5b:29
wpa_supplicant: TDLS: Dialog Token in TPK M1 1
wpa_supplicant: wlan0: nl80211: kernel reports: key addition failed
wpa_supplicant: TDLS: Failed to set TPK to the driver
```

### Logs / stack traces

System journal logs

```text
Aug 17 03:27:17 tito-cachyos sshd-session[59964]: Accepted publickey for nozomi from 100.125.253.5 port 59376 ssh2: ED25519
Aug 17 03:27:17 tito-cachyos sshd-session[59964]: pam_unix(sshd:session): session opened for user nozomi(uid=1000) by nozomi(uid=0)
Aug 17 03:27:19 tito-cachyos wpa_supplicant[808]: TDLS: Creating peer entry for ce:8e:61:eb:5b:29
Aug 17 03:27:21 tito-cachyos wpa_supplicant[808]: TDLS: Dialog Token in TPK M1 1
Aug 17 03:27:21 tito-cachyos wpa_supplicant[808]: wlan0: nl80211: kernel reports: key addition failed
Aug 17 03:27:21 tito-cachyos wpa_supplicant[808]: TDLS: Failed to set TPK to the driver
Aug 17 03:27:47 tito-cachyos tailscaled[807]: open-conn-track: timeout opening ...
Aug 17 03:27:48 tito-cachyos tailscaled[807]: netcheck: UDP is blocked, trying HTTPS
Aug 17 03:27:48 tito-cachyos tailscaled[807]: netcheck: UDP is blocked, trying ICMP
```

### Additional system information & Workaround
- **Workaround:** Switching NetworkManager backend to `iwd` (`/etc/NetworkManager/conf.d/wifi_backend.conf` -> `wifi.backend=iwd`) solves the issue completely since `iwd` does not negotiate the failing TDLS handshake.

Contributor guide

Open the contributing guide

Research direction

Reproduce the TDLS negotiation with the mt7921e adapter and inspect the wpa_supplicant, nl80211, and driver messages around TPK key installation. The only configuration path mentioned is /etc/NetworkManager/conf.d/wifi_backend.conf, where switching to iwd avoids the failure. Done means a rejected or accepted TDLS setup no longer wedges wlan0, with subsequent traffic continuing without an interface restart.

Written by the indexing model from the issue text.

Assessment

Tech stack
linux
Domain
networking, operating-systems
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Needs clarification
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.