1 files changed, 16 insertions, 0 deletions

diff --git a/drivers/net/wireless/p54/fwio.c b/drivers/net/wireless/p54/fwio.c
index 349375f4a14b..21f19018fab5 100644
--- a/drivers/net/wireless/p54/fwio.c
+++ b/drivers/net/wireless/p54/fwio.c
@@ -686,6 +686,8 @@ int p54_upload_key(struct p54_common *priv, u8 algo, int slot, u8 idx, u8 len,
 
 int p54_fetch_statistics(struct p54_common *priv)
 {
+        struct ieee80211_tx_info *txinfo;
+        struct p54_tx_info *p54info;
         struct sk_buff *skb;
 
         skb = p54_alloc_skb(priv, P54_HDR_FLAG_CONTROL,
@@ -694,6 +696,20 @@ int p54_fetch_statistics(struct p54_common *priv)
         if (!skb)
                 return -ENOMEM;
 
+        /*
+         * The statistic feedback causes some extra headaches here, if it
+         * is not to crash/corrupt the firmware data structures.
+         *
+         * Unlike all other Control Get OIDs we can not use helpers like
+         * skb_put to reserve the space for the data we're requesting.
+         * Instead the extra frame length -which will hold the results later-
+         * will only be told to the p54_assign_address, so that following
+         * frames won't be placed into the  allegedly empty area.
+         */
+        txinfo = IEEE80211_SKB_CB(skb);
+        p54info = (void *) txinfo->rate_driver_data;
+        p54info->extra_len = sizeof(struct p54_statistics);
+
         p54_tx(priv, skb);
         return 0;
 }