diff --git a/[refs] b/[refs]
index a88b12cf1461..328c8b89c4d6 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 6ae8ec27868bfdbb815287bee8146acbefaee867
+refs/heads/master: 1186980dafcd14d0e257a4dd6990cefdc6f3e362
diff --git a/trunk/net/mac80211/scan.c b/trunk/net/mac80211/scan.c
index 58ffa7d069c7..669d2e32efb6 100644
--- a/trunk/net/mac80211/scan.c
+++ b/trunk/net/mac80211/scan.c
@@ -877,7 +877,8 @@ int ieee80211_request_sched_scan_start(struct ieee80211_sub_if_data *sdata,
 	for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
 		local->sched_scan_ies.ie[i] = kzalloc(2 +
 						      IEEE80211_MAX_SSID_LEN +
-						      local->scan_ies_len,
+						      local->scan_ies_len +
+						      req->ie_len,
 						      GFP_KERNEL);
 		if (!local->sched_scan_ies.ie[i]) {
 			ret = -ENOMEM;