1 files changed, 7 insertions, 2 deletions

diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 2db01e9541e7..3d01abb2b813 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -822,10 +822,13 @@ static int __must_check __sta_info_destroy(struct sta_info *sta)
          * until the aggregation stop completes. Refer
          * http://thread.gmane.org/gmane.linux.kernel.wireless.general/81936
          */
+
+        mutex_lock(&sta->ampdu_mlme.mtx);
+
         for (i = 0; i < STA_TID_NUM; i++) {
-                if (!sta->ampdu_mlme.tid_tx[i])
+                tid_tx = rcu_dereference_protected_tid_tx(sta, i);
+                if (!tid_tx)
                         continue;
-                tid_tx = sta->ampdu_mlme.tid_tx[i];
                 if (skb_queue_len(&tid_tx->pending)) {
 #ifdef CONFIG_MAC80211_HT_DEBUG
                         wiphy_debug(local->hw.wiphy, "TX A-MPDU  purging %d "
@@ -837,6 +840,8 @@ static int __must_check __sta_info_destroy(struct sta_info *sta)
                 kfree_rcu(tid_tx, rcu_head);
         }
 
+        mutex_unlock(&sta->ampdu_mlme.mtx);
+
         sta_info_free(local, sta);
 
         return 0;