diff --git a/[refs] b/[refs]
index 4d88dc520feb..14d86d566c35 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: a1da9da99152e065912d58950089405b15d0aebd
+refs/heads/master: 1f9e9ce1f99e89ee180a3994c44bdff43ebeb139
diff --git a/trunk/drivers/staging/wlan-ng/p80211conv.c b/trunk/drivers/staging/wlan-ng/p80211conv.c
index 993e8f480736..dfc7b3a1e9c9 100644
--- a/trunk/drivers/staging/wlan-ng/p80211conv.c
+++ b/trunk/drivers/staging/wlan-ng/p80211conv.c
@@ -328,11 +328,11 @@ int skb_p80211_to_ether( wlandevice_t *wlandev, u32 ethconv, struct sk_buff *skb
 		memcpy(saddr, w_hdr->a3.a2, WLAN_ETHADDR_LEN);
 	} else {
 		payload_offset = WLAN_HDR_A4_LEN;
-		payload_length -= ( WLAN_HDR_A4_LEN - WLAN_HDR_A3_LEN );
-		if (payload_length < 0 ) {
+		if (payload_length < WLAN_HDR_A4_LEN - WLAN_HDR_A3_LEN) {
 			WLAN_LOG_ERROR("A4 frame too short!\n");
 			return 1;
 		}
+		payload_length -= (WLAN_HDR_A4_LEN - WLAN_HDR_A3_LEN);
 		memcpy(daddr, w_hdr->a4.a3, WLAN_ETHADDR_LEN);
 		memcpy(saddr, w_hdr->a4.a4, WLAN_ETHADDR_LEN);
 	}