iwlwifi: mvm: fix TKIP key updating

When a TKIP key is updated with a station pointer that is NULL it is
a GTK, so it should use the AP's station ID. Fix the code to do that.

Signed-off-by: Beni Lev <beni.lev@intel.com>
Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

diff --git a/drivers/net/wireless/iwlwifi/mvm/sta.c b/drivers/net/wireless/iwlwifi/mvm/sta.c
index 8f8b66ea07eebad635cfdb68780b74223f97e300..6b22bacdc1df64bc1f64461036485fcd33e9a21e 100644 (file)
--- a/drivers/net/wireless/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/iwlwifi/mvm/sta.c
@@ -1155,14 +1155,26 @@ void iwl_mvm_update_tkip_key(struct iwl_mvm *mvm,
                             struct ieee80211_sta *sta, u32 iv32,
                             u16 *phase1key)
 {
-       struct iwl_mvm_sta *mvm_sta = (void *)sta->drv_priv;
+       struct iwl_mvm_sta *mvm_sta;
        u8 sta_id = iwl_mvm_get_key_sta_id(vif, sta);
 
-       if (sta_id == IWL_INVALID_STATION)
+       if (WARN_ON_ONCE(sta_id == IWL_INVALID_STATION))
                return;
 
+       rcu_read_lock();
+
+       if (!sta) {
+               sta = rcu_dereference(mvm->fw_id_to_mac_id[sta_id]);
+               if (WARN_ON(IS_ERR_OR_NULL(sta))) {
+                       rcu_read_unlock();
+                       return;
+               }
+       }
+
+       mvm_sta = (void *)sta->drv_priv;
        iwl_mvm_send_sta_key(mvm, mvm_sta, keyconf, sta_id,
                             iv32, phase1key, CMD_ASYNC);
+       rcu_read_unlock();
 }
 
 void iwl_mvm_sta_modify_ps_wake(struct iwl_mvm *mvm, int sta_id)