---

yaml
---
r: 149831
b: refs/heads/master
c: 9f201a8
h: refs/heads/master
i:
  149829: dce1d88
  149827: 4109bbb
  149823: 47690b0
v: v3

[refs]

@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 488829f1b141858944a24fd793220fa1d52cd9a6
+refs/heads/master: 9f201a87831af9458df1eda65941c955f2da87ed

trunk/drivers/net/wireless/p54/p54spi.c

@@ -395,14 +395,22 @@ static int p54spi_rx(struct p54s_priv *priv)
 		return 0;
 	}
 
-	skb = dev_alloc_skb(len);
+
+	/* Firmware may insert up to 4 padding bytes after the lmac header,
+	 * but it does not amend the size of SPI data transfer.
+	 * Such packets has correct data size in header, thus referencing
+	 * past the end of allocated skb. Reserve extra 4 bytes for this case */
+	skb = dev_alloc_skb(len + 4);
 	if (!skb) {
 		dev_err(&priv->spi->dev, "could not alloc skb");
 		return 0;
 	}
 
 	p54spi_spi_read(priv, SPI_ADRS_DMA_DATA, skb_put(skb, len), len);
 	p54spi_sleep(priv);
+	/* Put additional bytes to compensate for the possible
+	 * alignment-caused truncation */
+	skb_put(skb, 4);
 
 	if (p54_rx(priv->hw, skb) == 0)
 		dev_kfree_skb(skb);