Don't panic if the stageq here is empty; just fall through with NULL

pointers and leave the stage queue flush routine to just do nothing
(since both head and tail here will be NULL.)

This should quieten the "stageq empty" panic where the stageq itself
is empty, but it won't fix the second KASSERT() here "staging queue empty"
as that's likely a different underlying problem.

PR:		kern/174283

sys/net80211/ieee80211_superg.c

@@ -547,6 +547,14 @@ ff_flush(struct mbuf *head, struct mbuf *last)
 
 /*
  * Age frames on the staging queue.
+ *
+ * This is called without the comlock held, but it does all its work
+ * behind the comlock.  Because of this, it's possible that the
+ * staging queue will be serviced between the function which called
+ * it and now; thus simply checking that the queue has work in it
+ * may fail.
+ *
+ * See PR kern/174283 for more details.
  */
 void
 ieee80211_ff_age(struct ieee80211com *ic, struct ieee80211_stageq *sq,
@@ -557,7 +565,9 @@ ieee80211_ff_age(struct ieee80211com *ic, struct ieee80211_stageq *sq,
 	struct ieee80211_node *ni;
 	struct ieee80211_tx_ampdu *tap;
 
+#if 0
 	KASSERT(sq->head != NULL, ("stageq empty"));
+#endif
 
 	IEEE80211_LOCK(ic);
 	head = sq->head;

sys/net80211/ieee80211_superg.h

@@ -87,6 +87,10 @@ struct mbuf *ieee80211_ff_check(struct ieee80211_node *, struct mbuf *);
 void	ieee80211_ff_age(struct ieee80211com *, struct ieee80211_stageq *,
 	     int quanta);
 
+/*
+ * See ieee80211_ff_age() for a description of the locking
+ * expectation here.
+ */
 static __inline void
 ieee80211_ff_flush(struct ieee80211com *ic, int ac)
 {
@@ -96,6 +100,10 @@ ieee80211_ff_flush(struct ieee80211com *ic, int ac)
 		ieee80211_ff_age(ic, &sg->ff_stageq[ac], 0x7fffffff);
 }
 
+/*
+ * See ieee80211_ff_age() for a description of the locking
+ * expectation here.
+ */
 static __inline void
 ieee80211_ff_age_all(struct ieee80211com *ic, int quanta)
 {