1 files changed, 13 insertions, 0 deletions

diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 7fc55846d601..8502936e5314 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -336,6 +336,12 @@ void ieee80211_add_pending_skb(struct ieee80211_local *local,
         struct ieee80211_hw *hw = &local->hw;
         unsigned long flags;
         int queue = skb_get_queue_mapping(skb);
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+
+        if (WARN_ON(!info->control.vif)) {
+                kfree(skb);
+                return;
+        }
 
         spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
         __ieee80211_stop_queue(hw, queue, IEEE80211_QUEUE_STOP_REASON_SKB_ADD);
@@ -358,6 +364,13 @@ int ieee80211_add_pending_skbs(struct ieee80211_local *local,
                         IEEE80211_QUEUE_STOP_REASON_SKB_ADD);
 
         while ((skb = skb_dequeue(skbs))) {
+                struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+
+                if (WARN_ON(!info->control.vif)) {
+                        kfree(skb);
+                        continue;
+                }
+
                 ret++;
                 queue = skb_get_queue_mapping(skb);
                 __skb_queue_tail(&local->pending[queue], skb);