diff --git a/hostapd/eapol_sm.c b/hostapd/eapol_sm.c
index 519cb2ea0..a6e6c18bd 100644
--- a/hostapd/eapol_sm.c
+++ b/hostapd/eapol_sm.c
@@ -297,7 +297,7 @@ SM_STATE(AUTH_PAE, AUTHENTICATED)
 	sm->reAuthCount = 0;
 	if (sm->flags & EAPOL_SM_PREAUTH)
 		extra = " (pre-authentication)";
-	else if (wpa_auth_sta_get_pmksa(sm->sta->wpa_sm))
+	else if (sm->flags & EAPOL_SM_FROM_PMKSA_CACHE)
 		extra = " (PMKSA cache)";
 	eapol_auth_vlogger(sm->eapol, sm->addr, EAPOL_LOGGER_INFO,
 			   "authenticated - EAP type: %d (%s)%s",
diff --git a/hostapd/eapol_sm.h b/hostapd/eapol_sm.h
index 82017bfcf..14b5fe648 100644
--- a/hostapd/eapol_sm.h
+++ b/hostapd/eapol_sm.h
@@ -203,6 +203,7 @@ struct eapol_state_machine {
 #define EAPOL_SM_PREAUTH BIT(0)
 #define EAPOL_SM_WAIT_START BIT(1)
 #define EAPOL_SM_USES_WPA BIT(2)
+#define EAPOL_SM_FROM_PMKSA_CACHE BIT(3)
 	int flags; /* EAPOL_SM_* */
 
 	/* EAPOL/AAA <-> EAP full authenticator interface */
diff --git a/hostapd/ieee802_1x.c b/hostapd/ieee802_1x.c
index ab612163a..aa4965fd1 100644
--- a/hostapd/ieee802_1x.c
+++ b/hostapd/ieee802_1x.c
@@ -645,6 +645,22 @@ static void handle_eap(struct hostapd_data *hapd, struct sta_info *sta,
 }
 
 
+static struct eapol_state_machine *
+ieee802_1x_alloc_eapol_sm(struct hostapd_data *hapd, struct sta_info *sta)
+{
+	int flags = 0;
+	if (sta->flags & WLAN_STA_PREAUTH)
+		flags |= EAPOL_SM_PREAUTH;
+	if (sta->wpa_sm) {
+		if (wpa_auth_sta_get_pmksa(sta->wpa_sm))
+			flags |= EAPOL_SM_USES_WPA;
+		if (wpa_auth_sta_get_pmksa(sta->wpa_sm))
+			flags |= EAPOL_SM_FROM_PMKSA_CACHE;
+	}
+	return eapol_auth_alloc(hapd->eapol_auth, sta->addr, flags, sta);
+}
+
+
 /**
  * ieee802_1x_receive - Process the EAPOL frames from the Supplicant
  * @hapd: hostapd BSS data
@@ -719,13 +735,7 @@ void ieee802_1x_receive(struct hostapd_data *hapd, const u8 *sa, const u8 *buf,
 		return;
 
 	if (!sta->eapol_sm) {
-		int flags = 0;
-		if (sta->flags & WLAN_STA_PREAUTH)
-			flags |= EAPOL_SM_PREAUTH;
-		if (sta->wpa_sm)
-			flags |= EAPOL_SM_USES_WPA;
-		sta->eapol_sm = eapol_auth_alloc(hapd->eapol_auth, sta->addr,
-						 flags, sta);
+		sta->eapol_sm = ieee802_1x_alloc_eapol_sm(hapd, sta);
 		if (!sta->eapol_sm)
 			return;
 
@@ -840,15 +850,9 @@ void ieee802_1x_new_station(struct hostapd_data *hapd, struct sta_info *sta)
 		return;
 
 	if (sta->eapol_sm == NULL) {
-		int flags = 0;
-		if (sta->flags & WLAN_STA_PREAUTH)
-			flags |= EAPOL_SM_PREAUTH;
-		if (sta->wpa_sm)
-			flags |= EAPOL_SM_USES_WPA;
 		hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE8021X,
 			       HOSTAPD_LEVEL_DEBUG, "start authentication");
-		sta->eapol_sm = eapol_auth_alloc(hapd->eapol_auth, sta->addr,
-						 flags, sta);
+		sta->eapol_sm = ieee802_1x_alloc_eapol_sm(hapd, sta);
 		if (sta->eapol_sm == NULL) {
 			hostapd_logger(hapd, sta->addr,
 				       HOSTAPD_MODULE_IEEE8021X,