diff --git a/[refs] b/[refs]
index c6d0c175170a..a890cea3d981 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: dcc8fb87f2aceb25929b2a82b65c22f425badbfc
+refs/heads/master: 22d5d59b8c4bac63b1466dce5bee5dc48e8ee447
diff --git a/trunk/drivers/staging/brcm80211/brcmfmac/wl_cfg80211.c b/trunk/drivers/staging/brcm80211/brcmfmac/wl_cfg80211.c
index b44daf959e8f..c60fc7cb7436 100644
--- a/trunk/drivers/staging/brcm80211/brcmfmac/wl_cfg80211.c
+++ b/trunk/drivers/staging/brcm80211/brcmfmac/wl_cfg80211.c
@@ -1616,6 +1616,7 @@ wl_cfg80211_add_key(struct wiphy *wiphy, struct net_device *dev,
 	s32 val;
 	s32 wsec;
 	s32 err = 0;
+	u8 keybuf[8];
 
 	WL_DBG("key index (%d)\n", key_idx);
 	CHECK_SYS_UP();
@@ -1644,6 +1645,9 @@ wl_cfg80211_add_key(struct wiphy *wiphy, struct net_device *dev,
 		WL_DBG("WLAN_CIPHER_SUITE_WEP104\n");
 		break;
 	case WLAN_CIPHER_SUITE_TKIP:
+		memcpy(keybuf, &key.data[24], sizeof(keybuf));
+		memcpy(&key.data[24], &key.data[16], sizeof(keybuf));
+		memcpy(&key.data[16], keybuf, sizeof(keybuf));
 		key.algo = CRYPTO_ALGO_TKIP;
 		WL_DBG("WLAN_CIPHER_SUITE_TKIP\n");
 		break;