From b5c237a417a317d363829e6ccd3b92da4001c45b Mon Sep 17 00:00:00 2001
From: Max Filippov <jcmvbkbc@gmail.com>
Date: Fri, 27 Mar 2009 07:50:53 +0300
Subject: [PATCH] --- yaml --- r: 149831 b: refs/heads/master c:
 9f201a87831af9458df1eda65941c955f2da87ed h: refs/heads/master i:   149829:
 dce1d88c59303340faa06975cc538a80bb63df94   149827:
 4109bbbeacc7e350bcd2849b15465ef947db8462   149823:
 47690b0cbea4f0bec48762d7e790befcfb609f1c v: v3

---
 [refs]                                  |  2 +-
 trunk/drivers/net/wireless/p54/p54spi.c | 10 +++++++++-
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/[refs] b/[refs]
index aa0017a30a25..901611ca39ea 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 488829f1b141858944a24fd793220fa1d52cd9a6
+refs/heads/master: 9f201a87831af9458df1eda65941c955f2da87ed
diff --git a/trunk/drivers/net/wireless/p54/p54spi.c b/trunk/drivers/net/wireless/p54/p54spi.c
index f8af09610180..52023127cf37 100644
--- a/trunk/drivers/net/wireless/p54/p54spi.c
+++ b/trunk/drivers/net/wireless/p54/p54spi.c
@@ -395,7 +395,12 @@ static int p54spi_rx(struct p54s_priv *priv)
 		return 0;
 	}
 
-	skb = dev_alloc_skb(len);
+
+	/* Firmware may insert up to 4 padding bytes after the lmac header,
+	 * but it does not amend the size of SPI data transfer.
+	 * Such packets has correct data size in header, thus referencing
+	 * past the end of allocated skb. Reserve extra 4 bytes for this case */
+	skb = dev_alloc_skb(len + 4);
 	if (!skb) {
 		dev_err(&priv->spi->dev, "could not alloc skb");
 		return 0;
@@ -403,6 +408,9 @@ static int p54spi_rx(struct p54s_priv *priv)
 
 	p54spi_spi_read(priv, SPI_ADRS_DMA_DATA, skb_put(skb, len), len);
 	p54spi_sleep(priv);
+	/* Put additional bytes to compensate for the possible
+	 * alignment-caused truncation */
+	skb_put(skb, 4);
 
 	if (p54_rx(priv->hw, skb) == 0)
 		dev_kfree_skb(skb);