diff --git a/net/wireless/util.c b/net/wireless/util.c
index 56724b33af04..05bb49afd5ef 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -938,9 +938,9 @@ EXPORT_SYMBOL(ieee80211_amsdu_to_8023s);
 unsigned int cfg80211_classify8021d(struct sk_buff *skb,
 				    struct cfg80211_qos_map *qos_map)
 {
-	unsigned int dscp;
-	unsigned char vlan_priority;
-	unsigned int ret;
+	unsigned int dscp = 0;
+	unsigned char vlan_priority = 0;
+	unsigned int ret = 0;
 
 	/* skb->priority values from 256->263 are magic values to
 	 * directly indicate a specific 802.1d priority.  This is used
@@ -963,10 +963,18 @@ unsigned int cfg80211_classify8021d(struct sk_buff *skb,
 
 	switch (skb->protocol) {
 	case htons(ETH_P_IP):
-		dscp = ipv4_get_dsfield(ip_hdr(skb)) & 0xfc;
+		if (skb_network_header_len(skb) >= sizeof(struct iphdr)) {
+			struct iphdr *iph = ip_hdr(skb);
+			if (iph)
+				dscp = ipv4_get_dsfield(iph) & 0xfc;
+		}
 		break;
 	case htons(ETH_P_IPV6):
-		dscp = ipv6_get_dsfield(ipv6_hdr(skb)) & 0xfc;
+		if (skb_network_header_len(skb) >= sizeof(struct ipv6hdr)) {
+			struct ipv6hdr *ip6h = ipv6_hdr(skb);
+			if (ip6h)
+				dscp = ipv6_get_dsfield(ip6h) & 0xfc;
+		}
 		break;
 	case htons(ETH_P_MPLS_UC):
 	case htons(ETH_P_MPLS_MC): {