1 files changed, 6 insertions, 0 deletions

diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index e08c8174d656..5de9878d2c12 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -238,6 +238,10 @@ static struct ath_buf* ath_clone_txbuf(struct ath_softc *sc, struct ath_buf *bf)
         struct ath_buf *tbf;
 
         spin_lock_bh(&sc->tx.txbuflock);
+        if (WARN_ON(list_empty(&sc->tx.txbuf))) {
+                spin_unlock_bh(&sc->tx.txbuflock);
+                return NULL;
+        }
         ASSERT(!list_empty((&sc->tx.txbuf)));
         tbf = list_first_entry(&sc->tx.txbuf, struct ath_buf, list);
         list_del(&tbf->list);
@@ -379,6 +383,8 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
                                 struct ath_buf *tbf;
 
                                 tbf = ath_clone_txbuf(sc, bf_last);
+                                if (!tbf)
+                                        break;
                                 ath9k_hw_cleartxdesc(sc->sc_ah, tbf->bf_desc);
                                 list_add_tail(&tbf->list, &bf_head);
                         } else {