1 files changed, 5 insertions, 0 deletions

diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 4ba3c540fcf3..dd3593c1fd23 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -239,6 +239,11 @@ void sta_info_destroy(struct sta_info *sta)
                 tid_tx = sta->ampdu_mlme.tid_tx[i];
                 if (tid_tx) {
                         del_timer_sync(&tid_tx->addba_resp_timer);
+                        /*
+                         * STA removed while aggregation session being
+                         * started? Bit odd, but purge frames anyway.
+                         */
+                        skb_queue_purge(&tid_tx->pending);
                         kfree(tid_tx);
                 }
         }