1 files changed, 16 insertions, 9 deletions

diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
index 106e15a4649f..93aab0715e8a 100644
--- a/net/mac80211/wpa.c
+++ b/net/mac80211/wpa.c
@@ -223,14 +223,14 @@ static int tkip_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
 ieee80211_tx_result
 ieee80211_crypto_tkip_encrypt(struct ieee80211_tx_data *tx)
 {
-        struct sk_buff *skb = tx->skb;
+        struct sk_buff *skb;
 
         ieee80211_tx_set_protected(tx);
 
-        do {
+        skb_queue_walk(&tx->skbs, skb) {
                 if (tkip_encrypt_skb(tx, skb) < 0)
                         return TX_DROP;
-        } while ((skb = skb->next));
+        }
 
         return TX_CONTINUE;
 }
@@ -449,14 +449,14 @@ static int ccmp_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
 ieee80211_tx_result
 ieee80211_crypto_ccmp_encrypt(struct ieee80211_tx_data *tx)
 {
-        struct sk_buff *skb = tx->skb;
+        struct sk_buff *skb;
 
         ieee80211_tx_set_protected(tx);
 
-        do {
+        skb_queue_walk(&tx->skbs, skb) {
                 if (ccmp_encrypt_skb(tx, skb) < 0)
                         return TX_DROP;
-        } while ((skb = skb->next));
+        }
 
         return TX_CONTINUE;
 }
@@ -554,15 +554,22 @@ static inline void bip_ipn_swap(u8 *d, const u8 *s)
 ieee80211_tx_result
 ieee80211_crypto_aes_cmac_encrypt(struct ieee80211_tx_data *tx)
 {
-        struct sk_buff *skb = tx->skb;
-        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        struct sk_buff *skb;
+        struct ieee80211_tx_info *info;
         struct ieee80211_key *key = tx->key;
         struct ieee80211_mmie *mmie;
         u8 aad[20];
         u64 pn64;
 
+        if (WARN_ON(skb_queue_len(&tx->skbs) != 1))
+                return TX_DROP;
+
+        skb = skb_peek(&tx->skbs);
+
+        info = IEEE80211_SKB_CB(skb);
+
         if (info->control.hw_key)
-                return 0;
+                return TX_CONTINUE;
 
         if (WARN_ON(skb_tailroom(skb) < sizeof(*mmie)))
                 return TX_DROP;