Daemon.err hostapd: nl80211: kernel reports: key addition failed - is this a problem?

For Developers
81

So weird here, i put on stable. FT not working. Put on snapshot, FT work.

No idea why lol, no errors on my 4a xiaomi. Staying on snapshots for now (and yes both snapshots and stable kernel are 5.15.xxx)

82

Hi, is there a workaround for this error message?
nl80211: kernel reports: key addition failed
I have a router and a dumb ap (both are linksys 1900acs).
Thank you.

83

No need to work around it, i moved to stable.
Fast roaming is still working even tho it throws this error.

Guess you can remove this error in the source code but to much effort

84

I still get this issue... kernel 6.6.x

@fodiator do you have news?

Thanks

85

see them here too (snapshot 26161):

daemon.err hostapd: nl80211: kernel reports: key addition failed

86

Just to inform, the patch from @fodiator in my MT6000 have issue, wifi speed is limited.

87

This error log still seems prevalent even on the latest stable build.
OpenWrt 23.05.3 r23809-234f1a2efa

88

Same here, on STABLE 23.05.04 but roaming still working tho.
(Xiaomi 4a gigabit)

89

6 Months on and I can confirm this error is still present in the 24.10 RELEASE branch.. I've only just switch FT on, but as far as I can see the functionality works, despite the error.

90

Your patch can work in 22.03.6, and FT work well with a log about "mwv2 - no sta assoc"怂thanks a lot.
Router mir3p(xiaomi 3 pro) 5G wifi ā€˜s bandwidth will down to 30+Mbps testing of speedtest ļ¼Œbut mir3g's bandwidth is ok when FT finished.
I guess : neet to adapte the patch for diff wifi driver.
mir3g 5G wifi : MediaTek MT76x2E
mir3p wifi : MediaTek MT7615E

91

Iā€™ve submitted a PR (#23181) which should solve this problem.

@Fodiator's patch identified the right race and for that reason works: during AP-side FT, hostapd can install the pairwise key after the STA object exists but before mac80211 marks it associated. The missing part was the deferred hardware upload. Simply accepting the key before ASSOC can leave the key in mac80211 without clearly controlling when the driver sees it, so the original hostapd error may disappear while hardware offload behavior remains ambiguous.

The patch submitted keeps the pre-ASSOC acceptance narrow to AP/AP_VLAN pairwise keys, skips the premature driver upload, and explicitly retries the upload when the STA reaches ASSOC, with AUTHORIZED as a fallback retry point.

Any testing of the submitted patch at #23181 is welcome.

92

I think the reason could be @Fodiatorā€™s patch lets mac80211 accept the key before association, but does not add the missing ā€œupload it to hardware laterā€ step. Hostapd installs the PTK early, mac80211 accepts it instead of returning -ENOENT, but the driver may still not be ready for that STA key. If the key then stays only in mac80211/software state traffic can still work through the software crypto path, but hardware crypto/offload may not be used correctly, causing drops in packets throughput.

93

i have tested @AndJ23 patch, it seems with mt76 the log is gone, but with ath10k it is still there.

tested on ea7500v2, ea8100,

for ath10k tested on onhub and eap1200h

waiting for others test