2 files changed, 5 insertions, 2 deletions

diff --git a/drivers/net/wireless/ath/ath6kl/core.c b/drivers/net/wireless/ath/ath6kl/core.c
index 5c20a043a47..fdb3b1decc7 100644
--- a/drivers/net/wireless/ath/ath6kl/core.c
+++ b/drivers/net/wireless/ath/ath6kl/core.c
@@ -20,6 +20,7 @@
 #include <linux/module.h>
 #include <linux/moduleparam.h>
 #include <linux/export.h>
+#include <linux/vmalloc.h>
 
 #include "debug.h"
 #include "hif-ops.h"
@@ -305,7 +306,7 @@ void ath6kl_core_cleanup(struct ath6kl *ar)
 
         kfree(ar->fw_board);
         kfree(ar->fw_otp);
-        kfree(ar->fw);
+        vfree(ar->fw);
         kfree(ar->fw_patch);
         kfree(ar->fw_testscript);
 
diff --git a/drivers/net/wireless/ath/ath6kl/init.c b/drivers/net/wireless/ath/ath6kl/init.c
index 092e4cddfed..5949ab5357f 100644
--- a/drivers/net/wireless/ath/ath6kl/init.c
+++ b/drivers/net/wireless/ath/ath6kl/init.c
@@ -21,6 +21,7 @@
 #include <linux/export.h>
 #include <linux/of.h>
 #include <linux/mmc/sdio_func.h>
+#include <linux/vmalloc.h>
 
 #include "core.h"
 #include "cfg80211.h"
@@ -928,13 +929,14 @@ static int ath6kl_fetch_fw_apin(struct ath6kl *ar, const char *name)
                         if (ar->fw != NULL)
                                 break;
 
-                        ar->fw = kmemdup(data, ie_len, GFP_KERNEL);
+                        ar->fw = vmalloc(ie_len);
 
                         if (ar->fw == NULL) {
                                 ret = -ENOMEM;
                                 goto out;
                         }
 
+                        memcpy(ar->fw, data, ie_len);
                         ar->fw_len = ie_len;
                         break;
                 case ATH6KL_FW_IE_PATCH_IMAGE: