2 files changed, 18 insertions, 0 deletions

diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 9e5dff1c8f27..4e1b2ba122cd 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1889,6 +1889,11 @@ void ieee80211_tx_pending(unsigned long data)
                         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
                         struct ieee80211_sub_if_data *sdata;
 
+                        if (WARN_ON(!info->control.vif)) {
+                                kfree_skb(skb);
+                                continue;
+                        }
+
                         sdata = vif_to_sdata(info->control.vif);
                         dev_hold(sdata->dev);
                         spin_unlock_irqrestore(&local->queue_stop_reason_lock,
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 7fc55846d601..8502936e5314 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -336,6 +336,12 @@ void ieee80211_add_pending_skb(struct ieee80211_local *local,
         struct ieee80211_hw *hw = &local->hw;
         unsigned long flags;
         int queue = skb_get_queue_mapping(skb);
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+
+        if (WARN_ON(!info->control.vif)) {
+                kfree(skb);
+                return;
+        }
 
         spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
         __ieee80211_stop_queue(hw, queue, IEEE80211_QUEUE_STOP_REASON_SKB_ADD);
@@ -358,6 +364,13 @@ int ieee80211_add_pending_skbs(struct ieee80211_local *local,
                         IEEE80211_QUEUE_STOP_REASON_SKB_ADD);
 
         while ((skb = skb_dequeue(skbs))) {
+                struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+
+                if (WARN_ON(!info->control.vif)) {
+                        kfree(skb);
+                        continue;
+                }
+
                 ret++;
                 queue = skb_get_queue_mapping(skb);
                 __skb_queue_tail(&local->pending[queue], skb);