diff --git a/src/h2load_http2_session.cc b/src/h2load_http2_session.cc
index bc658380..2cdba9e1 100644
--- a/src/h2load_http2_session.cc
+++ b/src/h2load_http2_session.cc
@@ -119,7 +119,7 @@ ssize_t file_read_callback(nghttp2_session *session, int32_t stream_id,
   auto config = client->worker->config;
   auto req_stat = static_cast<RequestStat *>(
       nghttp2_session_get_stream_user_data(session, stream_id));
-
+  assert(req_stat);
   ssize_t nread;
   while ((nread = pread(config->data_fd, buf, length, req_stat->data_offset)) ==
              -1 &&
diff --git a/src/shrpx_http2_upstream.cc b/src/shrpx_http2_upstream.cc
index 10791f27..1e9bbda0 100644
--- a/src/shrpx_http2_upstream.cc
+++ b/src/shrpx_http2_upstream.cc
@@ -500,6 +500,10 @@ int on_frame_send_callback(nghttp2_session *session, const nghttp2_frame *frame,
     auto downstream = static_cast<Downstream *>(
         nghttp2_session_get_stream_user_data(session, stream_id));
 
+    if (!downstream) {
+      return 0;
+    }
+
     // For tunneling, issue RST_STREAM to finish the stream.
     if (downstream->get_upgraded() ||
         nghttp2_session_get_stream_remote_close(session, stream_id) == 0) {