2 files changed, 19 insertions, 7 deletions

diff --git a/drivers/net/wireless/rtl8180_dev.c b/drivers/net/wireless/rtl8180_dev.c
index d0928c91c21c..b1b3a478335b 100644
--- a/drivers/net/wireless/rtl8180_dev.c
+++ b/drivers/net/wireless/rtl8180_dev.c
@@ -257,19 +257,25 @@ static int rtl8180_tx(struct ieee80211_hw *dev, struct sk_buff *skb,
         mapping = pci_map_single(priv->pdev, skb->data,
                                  skb->len, PCI_DMA_TODEVICE);
 
+        BUG_ON(!control->tx_rate);
+
         tx_flags = RTL8180_TX_DESC_FLAG_OWN | RTL8180_TX_DESC_FLAG_FS |
                    RTL8180_TX_DESC_FLAG_LS |
-                   (control->tx_rate->hw_value << 24) |
-                   (control->rts_cts_rate->hw_value << 19) | skb->len;
+                   (control->tx_rate->hw_value << 24) | skb->len;
 
         if (priv->r8185)
                 tx_flags |= RTL8180_TX_DESC_FLAG_DMA |
                             RTL8180_TX_DESC_FLAG_NO_ENC;
 
-        if (control->flags & IEEE80211_TXCTL_USE_RTS_CTS)
+        if (control->flags & IEEE80211_TXCTL_USE_RTS_CTS) {
+                BUG_ON(!control->rts_cts_rate);
                 tx_flags |= RTL8180_TX_DESC_FLAG_RTS;
-        else if (control->flags & IEEE80211_TXCTL_USE_CTS_PROTECT)
+                tx_flags |= control->rts_cts_rate->hw_value << 19;
+        } else if (control->flags & IEEE80211_TXCTL_USE_CTS_PROTECT) {
+                BUG_ON(!control->rts_cts_rate);
                 tx_flags |= RTL8180_TX_DESC_FLAG_CTS;
+                tx_flags |= control->rts_cts_rate->hw_value << 19;
+        }
 
         *((struct ieee80211_tx_control **) skb->cb) =
                 kmemdup(control, sizeof(*control), GFP_ATOMIC);
diff --git a/drivers/net/wireless/rtl8187_dev.c b/drivers/net/wireless/rtl8187_dev.c
index 6ef67990692d..c03834d5cb0b 100644
--- a/drivers/net/wireless/rtl8187_dev.c
+++ b/drivers/net/wireless/rtl8187_dev.c
@@ -178,17 +178,23 @@ static int rtl8187_tx(struct ieee80211_hw *dev, struct sk_buff *skb,
 
         flags = skb->len;
         flags |= RTL8187_TX_FLAG_NO_ENCRYPT;
-        flags |= control->rts_cts_rate->hw_value << 19;
+
+        BUG_ON(!control->tx_rate);
+
         flags |= control->tx_rate->hw_value << 24;
         if (ieee80211_get_morefrag((struct ieee80211_hdr *)skb->data))
                 flags |= RTL8187_TX_FLAG_MORE_FRAG;
         if (control->flags & IEEE80211_TXCTL_USE_RTS_CTS) {
+                BUG_ON(!control->rts_cts_rate);
                 flags |= RTL8187_TX_FLAG_RTS;
+                flags |= control->rts_cts_rate->hw_value << 19;
                 rts_dur = ieee80211_rts_duration(dev, priv->vif,
                                                  skb->len, control);
-        }
-        if (control->flags & IEEE80211_TXCTL_USE_CTS_PROTECT)
+        } else if (control->flags & IEEE80211_TXCTL_USE_CTS_PROTECT) {
+                BUG_ON(!control->rts_cts_rate);
                 flags |= RTL8187_TX_FLAG_CTS;
+                flags |= control->rts_cts_rate->hw_value << 19;
+        }
 
         hdr = (struct rtl8187_tx_hdr *)skb_push(skb, sizeof(*hdr));
         hdr->flags = cpu_to_le32(flags);