[solved] wpa_supplicant-2.9 to 2.10 update: scan fails (-22)

[oneone]

Hi!

After recently updating wpa_supplicant to version net-wireless/wpa_supplicant-2.10-r1, scanning with wpa_cli (and hence establishing any connection) fails:

Code: Select all

$ wpa_cli
wpa_cli v2.10
Copyright (c) 2004-2022, Jouni Malinen <j@w1.fi> and contributors

This software may be distributed under the terms of the BSD license.
See README for more details.


Selected interface 'wlp3s0'

Interactive mode

<3>CTRL-EVENT-SCAN-FAILED ret=-22 retry=1
<3>CTRL-EVENT-SCAN-FAILED ret=-22 retry=1
<3>CTRL-EVENT-SCAN-FAILED ret=-22 retry=1
<3>CTRL-EVENT-SCAN-FAILED ret=-22 retry=1
<3>CTRL-EVENT-SCAN-FAILED ret=-22 retry=1

I remember having the same problem with wpa_supplicant-2.10 and that I just downgraded to wpa_supplicant-2.9-r8 as a workaround, which worked. But now wpa_supplicant-2.9-r8 and wpa_supplicant-2.10 both got removed from the tree, so it is probably time to sort this out properly. I have wpa_supplicant-2.9-r8 in a local repo, but that cannot be more than a temporary solution.

In the forums I've found the TKIP related thread viewtopic-t-1147741.html and the one about the kernel panic viewtopic-p-8701895.html#8701895, but both issues seem to be different to mine:

- wpa_supplicant-2.9-r8 works fine without the tkip useflag being enabled and enabling or disabling it for wpa_supplicant-2.10-r1 does not change anything. Also, the TKIP issue related to certain older routers, but my problem seems to be rather related to my wireless adapter.

- dmesg shows no related messages either.

The adapter is manufactured by Broadcom and I'm using the bcma and wl kernel modules (lspci -knn):

Code: Select all

03:00.0 Network controller [0280]: Broadcom Inc. and subsidiaries BCM4360 802.11ac Wireless Network Adapter [14e4:43a0] (rev 03)
        Subsystem: Apple Inc. BCM4360 802.11ac Wireless Network Adapter [106b:0117]
        Kernel driver in use: wl
        Kernel modules: bcma, wl

My wpa_supplicant.conf only contains this (plus the individual network configurations of course):

Code: Select all

ctrl_interface=/var/run/wpa_supplicant
ctrl_interface_group=1001
update_config=1

Did anybody experience anything similar or does anybody have a suggestion for further investigation?

[oneone]

Ha! Solved it.

Simply adding

Code: Select all

ap_scan=1

to my /etc/wpa_supplicant/wpa_supplicant.conf did the trick.

[oneone]

Actually, it's not solved

After a reboot version 2.10-r1 gives me the same problem again. I restarted the device as well as wpa_supplicant multiple times but to no avail. Currently I am a bit clueless. Any ideas?

[oneone]

Running

Code: Select all

sudo wpa_supplicant -Dnl80211 -iwlp3s0 -c/etc/wpa_supplicant/wpa_supplicant.conf -d

to get some debugging output gives me the following (only relevant part):

Code: Select all

...
wlp3s0: RSN: flushing PMKID list in the driver
nl80211: Flush PMKIDs
wlp3s0: Setting scan request: 0.100000 sec
TDLS: TDLS operation not supported by driver
TDLS: Driver uses internal link setup
TDLS: Driver does not support TDLS channel switching
EAPOL: SUPP_PAE entering state DISCONNECTED
EAPOL: Supplicant port status: Unauthorized
nl80211: Skip set_supp_port(unauthorized) while not associated
EAPOL: KEY_RX entering state NO_KEY_RECEIVE
EAPOL: SUPP_BE entering state INITIALIZE
EAP: EAP entering state DISABLED
ctrl_interface_group=1001
wlp3s0: Added interface wlp3s0
wlp3s0: State: DISCONNECTED -> DISCONNECTED
nl80211: Set wlp3s0 operstate 0->0 (DORMANT)
netlink: Operstate: ifindex=3 linkmode=-1 (no change), operstate=5 (IF_OPER_DORMANT)
RTM_NEWLINK: ifi_index=3 ifname=wlp3s0 operstate=6 linkmode=0 ifi_family=0 ifi_flags=0x11043 ([UP][RUNNING][LOWER_UP])
RTM_NEWLINK: ifi_index=3 ifname=wlp3s0 operstate=5 linkmode=0 ifi_family=0 ifi_flags=0x11003 ([UP][LOWER_UP])
RTM_NEWLINK: ifi_index=3 ifname=wlp3s0 operstate=5 linkmode=1 ifi_family=0 ifi_flags=0x11003 ([UP][LOWER_UP])
RTM_NEWLINK: ifi_index=3 ifname=wlp3s0 operstate=5 linkmode=1 ifi_family=0 ifi_flags=0x11003 ([UP][LOWER_UP])
wlp3s0: State: DISCONNECTED -> SCANNING
Scan SSID - hexdump_ascii(len=9):
     74 79 63 2d 36 36 34 33 34                        tyc-66434
wlp3s0: Starting AP scan for wildcard SSID (Interleave with specific)
wlp3s0: Add radio work 'scan'@0x56280745d940
wlp3s0: First radio work item in the queue - schedule start immediately
wlp3s0: Starting radio work 'scan'@0x56280745d940 after 0.000011 second wait
wlp3s0: nl80211: scan request
nl80211: Scan trigger failed: ret=-22 (Invalid argument)
wlp3s0: State: SCANNING -> DISCONNECTED
nl80211: Set wlp3s0 operstate 0->0 (DORMANT)
netlink: Operstate: ifindex=3 linkmode=-1 (no change), operstate=5 (IF_OPER_DORMANT)
wlp3s0: CTRL-EVENT-SCAN-FAILED ret=-22 retry=1
wlp3s0: Radio work 'scan'@0x56280745d940 done in 0.000097 seconds
wlp3s0: radio_work_free('scan'@0x56280745d940): num_active_works --> 0
wlp3s0: Setting scan request: 1.000000 sec
EAPOL: disable timer tick
wlp3s0: State: DISCONNECTED -> SCANNING
Scan SSID - hexdump_ascii(len=9):
     74 79 63 2d 36 36 34 33 34                        tyc-66434
wlp3s0: Starting AP scan for specific SSID: tyc-66434
wlp3s0: Add radio work 'scan'@0x56280745dd20
wlp3s0: First radio work item in the queue - schedule start immediately
wlp3s0: Starting radio work 'scan'@0x56280745dd20 after 0.000016 second wait
wlp3s0: nl80211: scan request
nl80211: Scan trigger failed: ret=-22 (Invalid argument)
wlp3s0: State: SCANNING -> DISCONNECTED
nl80211: Set wlp3s0 operstate 0->0 (DORMANT)
netlink: Operstate: ifindex=3 linkmode=-1 (no change), operstate=5 (IF_OPER_DORMANT)
wlp3s0: CTRL-EVENT-SCAN-FAILED ret=-22 retry=1
wlp3s0: Radio work 'scan'@0x56280745dd20 done in 0.000081 seconds
wlp3s0: radio_work_free('scan'@0x56280745dd20): num_active_works --> 0
wlp3s0: Setting scan request: 1.000000 sec
wlp3s0: State: DISCONNECTED -> SCANNING
wlp3s0: Starting AP scan for wildcard SSID
wlp3s0: Add radio work 'scan'@0x56280745df90
wlp3s0: First radio work item in the queue - schedule start immediately
wlp3s0: Starting radio work 'scan'@0x56280745df90 after 0.000012 second wait
wlp3s0: nl80211: scan request
nl80211: Scan trigger failed: ret=-22 (Invalid argument)
wlp3s0: State: SCANNING -> DISCONNECTED
nl80211: Set wlp3s0 operstate 0->0 (DORMANT)
netlink: Operstate: ifindex=3 linkmode=-1 (no change), operstate=5 (IF_OPER_DORMANT)
wlp3s0: CTRL-EVENT-SCAN-FAILED ret=-22 retry=1
wlp3s0: Radio work 'scan'@0x56280745df90 done in 0.000083 seconds
wlp3s0: radio_work_free('scan'@0x56280745df90): num_active_works --> 0
wlp3s0: Setting scan request: 1.000000 sec
wlp3s0: State: DISCONNECTED -> SCANNING
Scan SSID - hexdump_ascii(len=9):
     74 79 63 2d 36 36 34 33 34
...

Also, I have built wpa_supplicant (applies to both versions) with the following USE flags:

Code: Select all

[ebuild   R    ] net-wireless/wpa_supplicant-2.9-r8::localrepo  USE="broadcom-sta crda dbus hs2-0 readline -ap -eap-sim -eapol-test -fasteap -fils -macsec -mbo -mesh -p2p -privsep (-ps3) -qt5 (-selinux) -smartcard -tdls -uncommon-eap-types (-wimax) -wps" 0 KiB

I remember having a similar problem with an earlier update about a year or more ago (not sure which versions). Back then, the issue could be resolved by removing the "mesh" useflag.

[oneone]

Progress

The issue has been discussed on the wpa_supplicant mailing list in January. According to this thread (https://lists.infradead.org/pipermail/h ... 40178.html), the following patch should fix the issue:

Code: Select all

--- a/src/drivers/driver.h
+++ b/src/drivers/driver.h
@@ -2052,6 +2052,9 @@ struct wpa_driver_capa {
 	/** Maximum number of iterations in a single scan plan */
 	u32 max_sched_scan_plan_iterations;
 
+	/** Maximum number of extra IE bytes for scans */
+	u16 max_scan_ie_len;
+
 	/** Whether sched_scan (offloaded scanning) is supported */
 	int sched_scan_supported;
 
--- a/src/drivers/driver_nl80211_capa.c
+++ b/src/drivers/driver_nl80211_capa.c
@@ -885,6 +885,10 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
 			nla_get_u32(tb[NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS]);
 	}
 
+	if (tb[NL80211_ATTR_MAX_SCAN_IE_LEN])
+		capa->max_scan_ie_len =
+			nla_get_u16(tb[NL80211_ATTR_MAX_SCAN_IE_LEN]);
+
 	if (tb[NL80211_ATTR_MAX_MATCH_SETS])
 		capa->max_match_sets =
 			nla_get_u8(tb[NL80211_ATTR_MAX_MATCH_SETS]);
--- a/src/drivers/driver_nl80211_scan.c
+++ b/src/drivers/driver_nl80211_scan.c
@@ -207,7 +207,7 @@ nl80211_scan_common(struct i802_bss *bss, u8 cmd,
 		wpa_printf(MSG_DEBUG, "nl80211: Passive scan requested");
 	}
 
-	if (params->extra_ies) {
+	if (params->extra_ies && drv->capa.max_scan_ie_len >= params->extra_ies_len) {
 		wpa_hexdump(MSG_MSGDUMP, "nl80211: Scan extra IEs",
 			    params->extra_ies, params->extra_ies_len);
 		if (nla_put(msg, NL80211_ATTR_IE, params->extra_ies_len,

I had to apply the patch via eapply in a local repo, since the wpa_supplicant ebuild uses a non-standard directory to prepare the source, i.e.

Code: Select all

S="${WORKDIR}/${P}/${PN}"

instead of

Code: Select all

S="${WORKDIR}/${P}"

Would be nice to apply it as a user patch instead, but I could not figure out how, yet.

I have rebooted a couple of times and activated/deativated the network adapter a few times as well and so far things seem to work. I'll give it one more day to give me some issues and if it doesn't I'll mark this thread as solved.

[oneone]

Sorry for renaming the thread all the time. I think the name is good now. I just want it to be easily searchable for people with a similar issue. The previous titles could have related to similar problems due to different reasons in earlier updates.