--- drivers/net/wireless/iwlwifi/iwl-tx.c

+++ drivers/net/wireless/iwlwifi/iwl-tx.c

@@ -1088,11 +1088,15 @@ int iwl_tx_queue_reclaim(struct iwl_priv

q->read_ptr = iwl_queue_inc_wrap(q->read_ptr, q->n_bd)) {

tx_info = &txq->txb[txq->q.read_ptr];

- ieee80211_tx_status_irqsafe(priv->hw, tx_info->skb[0]);

+

+ if (WARN_ON_ONCE(tx_info->skb == NULL))

+ continue;

hdr = (struct ieee80211_hdr *)tx_info->skb[0]->data;

- if (hdr && ieee80211_is_data_qos(hdr->frame_control))

+ if (ieee80211_is_data_qos(hdr->frame_control))

nfreed++;

+

+ ieee80211_tx_status_irqsafe(priv->hw, tx_info->skb[0]);

tx_info->skb[0] = NULL;

if (priv->cfg->ops->lib->txq_inval_byte_cnt_tbl)