[PATCH wireless v3 3/3] wifi: mt76: mt7996: clear cipher state on key removal for WED offload

[Joshua Klinesmith <joshuaklinesmith@gmail.com>]

Same issue as mt7915: link->mt76.cipher is set on key installation
but never cleared on removal. The WA firmware retains the stale
cipher in BSS_INFO, sets the protection bit on WED-offloaded
frames, and drops all plaintext traffic when encryption is
switched to open/none.

Reset link->mt76.cipher to zero and call mt7996_mcu_add_bss_info()
when the last group key is removed. The clearing is guarded by
checking that both hw_key_idx and hw_key_idx2 are unset (-1) so
that GTK rotation and BIGTK removal while another group key is
active do not trigger a premature zero-cipher BSS update.

Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
Cc: stable@vger.kernel.org
Signed-off-by: Joshua Klinesmith <joshuaklinesmith@gmail.com>
---
 .../net/wireless/mediatek/mt76/mt7996/main.c  | 23 ++++++++++++++++---
 1 file changed, 20 insertions(+), 3 deletions(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/main.c b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
index f16135f0b7f9..8b1bc3237527 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/main.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/main.c
@@ -244,10 +244,27 @@ mt7996_set_hw_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
 					&link->mt76, msta_link, true);
 	}
 
-	if (cmd == SET_KEY)
+	if (cmd == SET_KEY) {
 		*wcid_keyidx = idx;
-	else if (idx == *wcid_keyidx)
-		*wcid_keyidx = -1;
+	} else {
+		if (idx == *wcid_keyidx)
+			*wcid_keyidx = -1;
+
+		/* Clear BSS cipher only when the last group key is removed;
+		 * during GTK rotation the new key is installed before the old
+		 * one is removed, so hw_key_idx still points at the new key
+		 * and this condition stays false.
+		 */
+		if (!sta && link->mt76.cipher &&
+		    msta_link->wcid.hw_key_idx == (u8)-1 &&
+		    msta_link->wcid.hw_key_idx2 == (u8)-1) {
+			link->mt76.cipher = 0;
+			if (link->phy)
+				mt7996_mcu_add_bss_info(link->phy, vif,
+							link_conf, &link->mt76,
+							msta_link, true);
+		}
+	}
 
 	/* only do remove key for BIGTK */
 	if (cmd != SET_KEY && !is_bigtk)
-- 
2.43.0