diff
--- a/drivers/net/wireless/intel/iwlwifi/mvm/txq.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/txq.c
@@ -1,7 +1,18 @@
+1 static struct iwl_txq *get_txq_safe(struct iwl_trans *trans, int txq_id) {
+2     if (txq_id >= 0 && txq_id < ARRAY_SIZE(trans->txqs.txq))
+3         return trans->txqs.txq[txq_id];
+4     return NULL;
+5 }
+
 1 static void iwl_txq_reclaim(struct iwl_trans *trans, int txq_id, int ssn,
-4 	struct iwl_txq *txq = trans->txqs.txq[txq_id];
-5 	int tfd_num, read_ptr, last_to_free;
+7 	struct iwl_txq *txq = get_txq_safe(trans, txq_id);
+8 	int tfd_num, read_ptr, last_to_free;
+
 8 	if (WARN_ON(txq_id == trans->txqs.cmd.q_id))
+9 		return;
+10 	
 11 	if (WARN_ON(!txq))
+12 		return;
 15 	read_ptr = iwl_txq_get_cmd_index(txq, txq->read_ptr);

