2 files changed, 5 insertions, 14 deletions

diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index e568d98167d0..12e61543a37c 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -628,8 +628,7 @@ void ieee80211_free_keys(struct ieee80211_sub_if_data *sdata)
 void ieee80211_free_sta_keys(struct ieee80211_local *local,
                              struct sta_info *sta)
 {
-        struct ieee80211_key *key, *tmp;
-        LIST_HEAD(keys);
+        struct ieee80211_key *key;
         int i;
 
         mutex_lock(&local->key_mtx);
@@ -640,7 +639,7 @@ void ieee80211_free_sta_keys(struct ieee80211_local *local,
                 ieee80211_key_replace(key->sdata, key->sta,
                                 key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE,
                                 key, NULL);
-                list_add(&key->list, &keys);
+                __ieee80211_key_destroy(key, true);
         }
 
         for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
@@ -650,17 +649,8 @@ void ieee80211_free_sta_keys(struct ieee80211_local *local,
                 ieee80211_key_replace(key->sdata, key->sta,
                                 key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE,
                                 key, NULL);
-                list_add(&key->list, &keys);
-        }
-
-        /*
-         * NB: the station code relies on this being
-         * done even if there aren't any keys
-         */
-        synchronize_net();
-
-        list_for_each_entry_safe(key, tmp, &keys, list)
                 __ieee80211_key_destroy(key, true);
+        }
 
         mutex_unlock(&local->key_mtx);
 }
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 7241f3229a27..08e50760e092 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -831,7 +831,8 @@ int __must_check __sta_info_destroy(struct sta_info *sta)
             rcu_access_pointer(sdata->u.vlan.sta) == sta)
                 RCU_INIT_POINTER(sdata->u.vlan.sta, NULL);
 
-        /* this always calls synchronize_net() */
+        synchronize_net();
+        /* now keys can no longer be reached */
         ieee80211_free_sta_keys(local, sta);
 
         sta->dead = true;