Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6

2 files changed, 9 insertions, 0 deletions

diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index 315ee301b75..8c02469b717 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -375,6 +375,12 @@ static void __ieee80211_key_destroy(struct ieee80211_key *key)
         if (!key)
                 return;
 
+        /*
+         * Synchronize so the TX path can no longer be using
+         * this key before we free/remove it.
+         */
+        synchronize_rcu();
+
         if (key->local)
                 ieee80211_key_disable_hw_accel(key);
 
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 9595e564bad..2b9db5ab904 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1808,6 +1808,8 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
                         if (!fwd_skb && net_ratelimit())
                                 printk(KERN_DEBUG "%s: failed to clone mesh frame\n",
                                                    sdata->name);
+                        if (!fwd_skb)
+                                goto out;
 
                         fwd_hdr =  (struct ieee80211_hdr *) fwd_skb->data;
                         memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN);
@@ -1845,6 +1847,7 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
                 }
         }
 
+ out:
         if (is_multicast_ether_addr(hdr->addr1) ||
             sdata->dev->flags & IFF_PROMISC)
                 return RX_CONTINUE;