From 0192830307c51d2b2225365070578e2b30699cf5 Mon Sep 17 00:00:00 2001
From: Andrey Yurovsky <andrey@cozybit.com>
Date: Thu, 13 Aug 2009 17:34:40 -0700
Subject: [PATCH] --- yaml --- r: 159713 b: refs/heads/master c:
 6f632d57f35303118685b88c139f3da73df077e2 h: refs/heads/master i:   159711:
 88830c63ba373422f41c25a3cc131eaadab5e6b3 v: v3

---
 [refs]                                      | 2 +-
 trunk/drivers/net/wireless/libertas/assoc.c | 8 +++++++-
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/[refs] b/[refs]
index 2b0b3fede97d..ad2bb1858c00 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: b23da49e6db341f4721476394dd8b95e0be2d179
+refs/heads/master: 6f632d57f35303118685b88c139f3da73df077e2
diff --git a/trunk/drivers/net/wireless/libertas/assoc.c b/trunk/drivers/net/wireless/libertas/assoc.c
index 385b50f4b105..81f86ef26990 100644
--- a/trunk/drivers/net/wireless/libertas/assoc.c
+++ b/trunk/drivers/net/wireless/libertas/assoc.c
@@ -45,9 +45,14 @@ static int get_common_rates(struct lbs_private *priv,
 	u8 *card_rates = lbs_bg_rates;
 	size_t num_card_rates = sizeof(lbs_bg_rates);
 	int ret = 0, i, j;
-	u8 tmp[30];
+	u8 *tmp;
 	size_t tmp_size = 0;
 
+	tmp = kzalloc((ARRAY_SIZE(lbs_bg_rates) - 1) * (*rates_size - 1),
+			GFP_KERNEL);
+	if (!tmp)
+		return -1;
+
 	/* For each rate in card_rates that exists in rate1, copy to tmp */
 	for (i = 0; card_rates[i] && (i < num_card_rates); i++) {
 		for (j = 0; rates[j] && (j < *rates_size); j++) {
@@ -77,6 +82,7 @@ static int get_common_rates(struct lbs_private *priv,
 	memset(rates, 0, *rates_size);
 	*rates_size = min_t(int, tmp_size, *rates_size);
 	memcpy(rates, tmp, *rates_size);
+	kfree(tmp);
 	return ret;
 }