2 files changed, 8 insertions, 2 deletions

diff --git a/net/mac80211/wext.c b/net/mac80211/wext.c
index df0531c28141..1babb979fe00 100644
--- a/net/mac80211/wext.c
+++ b/net/mac80211/wext.c
@@ -95,6 +95,13 @@ static int ieee80211_set_encryption(struct net_device *dev, u8 *sta_addr,
                         }
                 }
 
+                if (alg == ALG_WEP &&
+                        key_len != LEN_WEP40 && key_len != LEN_WEP104) {
+                        ieee80211_key_free(key);
+                        err = -EINVAL;
+                        goto out_unlock;
+                }
+
                 ieee80211_key_link(key, sdata, sta);
 
                 if (set_tx_key || (!sta && !sdata->default_key && key))
diff --git a/net/mac80211/wme.c b/net/mac80211/wme.c
index f23b5a4d4ac9..ffe1af82fa4d 100644
--- a/net/mac80211/wme.c
+++ b/net/mac80211/wme.c
@@ -308,8 +308,7 @@ static void wme_qdiscop_destroy(struct Qdisc* qd)
         struct ieee80211_hw *hw = &local->hw;
         int queue;
 
-        tcf_destroy_chain(q->filter_list);
-        q->filter_list = NULL;
+        tcf_destroy_chain(&q->filter_list);
 
         for (queue = 0; queue < QD_NUM(hw); queue++) {
                 skb_queue_purge(&q->requeued[queue]);