1 files changed, 18 insertions, 12 deletions

diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index b510721e3b3d..31afd712930d 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -195,7 +195,7 @@ static void __ieee80211_set_default_key(struct ieee80211_sub_if_data *sdata,
         assert_key_lock(sdata->local);
 
         if (idx >= 0 && idx < NUM_DEFAULT_KEYS)
-                key = sdata->keys[idx];
+                key = key_mtx_dereference(sdata->local, sdata->keys[idx]);
 
         if (uni)
                 rcu_assign_pointer(sdata->default_unicast_key, key);
@@ -222,7 +222,7 @@ __ieee80211_set_default_mgmt_key(struct ieee80211_sub_if_data *sdata, int idx)
 
         if (idx >= NUM_DEFAULT_KEYS &&
             idx < NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS)
-                key = sdata->keys[idx];
+                key = key_mtx_dereference(sdata->local, sdata->keys[idx]);
 
         rcu_assign_pointer(sdata->default_mgmt_key, key);
 
@@ -266,9 +266,15 @@ static void __ieee80211_key_replace(struct ieee80211_sub_if_data *sdata,
                 else
                         idx = new->conf.keyidx;
 
-                defunikey = old && sdata->default_unicast_key == old;
-                defmultikey = old && sdata->default_multicast_key == old;
-                defmgmtkey = old && sdata->default_mgmt_key == old;
+                defunikey = old &&
+                        old == key_mtx_dereference(sdata->local,
+                                                sdata->default_unicast_key);
+                defmultikey = old &&
+                        old == key_mtx_dereference(sdata->local,
+                                                sdata->default_multicast_key);
+                defmgmtkey = old &&
+                        old == key_mtx_dereference(sdata->local,
+                                                sdata->default_mgmt_key);
 
                 if (defunikey && !new)
                         __ieee80211_set_default_key(sdata, -1, true, false);
@@ -451,11 +457,11 @@ int ieee80211_key_link(struct ieee80211_key *key,
         mutex_lock(&sdata->local->key_mtx);
 
         if (sta && pairwise)
-                old_key = sta->ptk;
+                old_key = key_mtx_dereference(sdata->local, sta->ptk);
         else if (sta)
-                old_key = sta->gtk[idx];
+                old_key = key_mtx_dereference(sdata->local, sta->gtk[idx]);
         else
-                old_key = sdata->keys[idx];
+                old_key = key_mtx_dereference(sdata->local, sdata->keys[idx]);
 
         __ieee80211_key_replace(sdata, sta, pairwise, old_key, key);
         __ieee80211_key_destroy(old_key);
@@ -471,8 +477,11 @@ int ieee80211_key_link(struct ieee80211_key *key,
         return ret;
 }
 
-static void __ieee80211_key_free(struct ieee80211_key *key)
+void __ieee80211_key_free(struct ieee80211_key *key)
 {
+        if (!key)
+                return;
+
         /*
          * Replace key with nothingness if it was ever used.
          */
@@ -486,9 +495,6 @@ static void __ieee80211_key_free(struct ieee80211_key *key)
 void ieee80211_key_free(struct ieee80211_local *local,
                         struct ieee80211_key *key)
 {
-        if (!key)
-                return;
-
         mutex_lock(&local->key_mtx);
         __ieee80211_key_free(key);
         mutex_unlock(&local->key_mtx);