diff --git a/[refs] b/[refs]
index 2b0b3fede97d..ad2bb1858c00 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: b23da49e6db341f4721476394dd8b95e0be2d179
+refs/heads/master: 6f632d57f35303118685b88c139f3da73df077e2
diff --git a/trunk/drivers/net/wireless/libertas/assoc.c b/trunk/drivers/net/wireless/libertas/assoc.c
index 385b50f4b105..81f86ef26990 100644
--- a/trunk/drivers/net/wireless/libertas/assoc.c
+++ b/trunk/drivers/net/wireless/libertas/assoc.c
@@ -45,9 +45,14 @@ static int get_common_rates(struct lbs_private *priv,
 	u8 *card_rates = lbs_bg_rates;
 	size_t num_card_rates = sizeof(lbs_bg_rates);
 	int ret = 0, i, j;
-	u8 tmp[30];
+	u8 *tmp;
 	size_t tmp_size = 0;
 
+	tmp = kzalloc((ARRAY_SIZE(lbs_bg_rates) - 1) * (*rates_size - 1),
+			GFP_KERNEL);
+	if (!tmp)
+		return -1;
+
 	/* For each rate in card_rates that exists in rate1, copy to tmp */
 	for (i = 0; card_rates[i] && (i < num_card_rates); i++) {
 		for (j = 0; rates[j] && (j < *rates_size); j++) {
@@ -77,6 +82,7 @@ static int get_common_rates(struct lbs_private *priv,
 	memset(rates, 0, *rates_size);
 	*rates_size = min_t(int, tmp_size, *rates_size);
 	memcpy(rates, tmp, *rates_size);
+	kfree(tmp);
 	return ret;
 }