diff
--- a/drivers/net/wireless/intel/iwlwifi/mvm/txq.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/txq.c
@@ -2,6 +2,8 @@
 4 	struct iwl_txq *txq = trans->txqs.txq[txq_id];
 5 	int tfd_num, read_ptr, last_to_free;
 8 	if (WARN_ON(txq_id == trans->txqs.cmd.q_id))
+10 	if (WARN_ON(txq_id >= (sizeof(trans->txqs.txq) / sizeof(trans->txqs.txq[0])) || txq_id < 0))
+
 11 	if (WARN_ON(!txq))
 15 	read_ptr = iwl_txq_get_cmd_index(txq, txq->read_ptr);

