diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 2db01e9541e7..3d01abb2b813 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -822,10 +822,13 @@ static int __must_check __sta_info_destroy(struct sta_info *sta)
 	 * until the aggregation stop completes. Refer
 	 * http://thread.gmane.org/gmane.linux.kernel.wireless.general/81936
 	 */
+
+	mutex_lock(&sta->ampdu_mlme.mtx);
+
 	for (i = 0; i < STA_TID_NUM; i++) {
-		if (!sta->ampdu_mlme.tid_tx[i])
+		tid_tx = rcu_dereference_protected_tid_tx(sta, i);
+		if (!tid_tx)
 			continue;
-		tid_tx = sta->ampdu_mlme.tid_tx[i];
 		if (skb_queue_len(&tid_tx->pending)) {
 #ifdef CONFIG_MAC80211_HT_DEBUG
 			wiphy_debug(local->hw.wiphy, "TX A-MPDU  purging %d "
@@ -837,6 +840,8 @@ static int __must_check __sta_info_destroy(struct sta_info *sta)
 		kfree_rcu(tid_tx, rcu_head);
 	}
 
+	mutex_unlock(&sta->ampdu_mlme.mtx);
+
 	sta_info_free(local, sta);
 
 	return 0;