1 files changed, 4 insertions, 1 deletions

diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c b/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
index 659e0ca95c64..d0b0d43b9a6d 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
@@ -504,7 +504,7 @@ void rtl92cu_tx_fill_desc(struct ieee80211_hw *hw,
         struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
         struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw));
         bool defaultadapter = true;
-        struct ieee80211_sta *sta = ieee80211_find_sta(mac->vif, mac->bssid);
+        struct ieee80211_sta *sta;
         struct rtl_tcb_desc tcb_desc;
         u8 *qc = ieee80211_get_qos_ctl(hdr);
         u8 tid = qc[0] & IEEE80211_QOS_CTL_TID_MASK;
@@ -562,10 +562,13 @@ void rtl92cu_tx_fill_desc(struct ieee80211_hw *hw,
                 SET_TX_DESC_DATA_BW(txdesc, 0);
                 SET_TX_DESC_DATA_SC(txdesc, 0);
         }
+        rcu_read_lock();
+        sta = ieee80211_find_sta(mac->vif, mac->bssid);
         if (sta) {
                 u8 ampdu_density = sta->ht_cap.ampdu_density;
                 SET_TX_DESC_AMPDU_DENSITY(txdesc, ampdu_density);
         }
+        rcu_read_unlock();
         if (info->control.hw_key) {
                 struct ieee80211_key_conf *keyconf = info->control.hw_key;
                 switch (keyconf->cipher) {