diff --git a/[refs] b/[refs]
index 765082faff9f..b58993672f7e 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 0aef8ddc8bedac1db4c96fddc9fb1b44b730cf4f
+refs/heads/master: 8e81f65fdc7f5d292bb3c115b748767d921823c1
diff --git a/trunk/drivers/net/wireless/iwlwifi/iwl-testmode.c b/trunk/drivers/net/wireless/iwlwifi/iwl-testmode.c
index b8044bcd5044..b06c6763cb7a 100644
--- a/trunk/drivers/net/wireless/iwlwifi/iwl-testmode.c
+++ b/trunk/drivers/net/wireless/iwlwifi/iwl-testmode.c
@@ -185,7 +185,8 @@ static void iwl_testmode_ucode_rx_pkt(struct iwl_priv *priv,
 		return;
 	}
 	NLA_PUT_U32(skb, IWL_TM_ATTR_COMMAND, IWL_TM_CMD_DEV2APP_UCODE_RX_PKT);
-	NLA_PUT(skb, IWL_TM_ATTR_UCODE_RX_PKT, length, data);
+	/* the length doesn't include len_n_flags field, so add it manually */
+	NLA_PUT(skb, IWL_TM_ATTR_UCODE_RX_PKT, length + sizeof(__le32), data);
 	cfg80211_testmode_event(skb, GFP_ATOMIC);
 	return;