--- /dev/null
+--- a/net80211/ieee80211_skb.c
++++ b/net80211/ieee80211_skb.c
+@@ -108,7 +108,7 @@ static void skb_print_message(
+ {
+ va_list args;
+ char skb_count[32] = { '\0' };
+- char expanded_message[1024] = { '\0' };
++ char *expanded_message;
+ if (show_counter) {
+ #ifdef IEEE80211_DEBUG_REFCNT
+ snprintf(skb_count,
+@@ -125,6 +125,7 @@ static void skb_print_message(
+
+ }
+ va_start(args, message);
++ expanded_message = kzalloc(1024, GFP_KERNEL);
+ vsnprintf(expanded_message, sizeof(expanded_message), message, args);
+ #ifdef IEEE80211_DEBUG_REFCNT
+ printk(KERN_DEBUG "%s: %s%s:%d -> %s:%d %s\n",
+@@ -138,6 +139,7 @@ static void skb_print_message(
+ #endif
+ func2, line2,
+ expanded_message);
++ kfree(expanded_message);
+ va_end(args);
+ }
+
+--- a/net80211/ieee80211_wireless.c
++++ b/net80211/ieee80211_wireless.c
+@@ -1647,17 +1647,21 @@ ieee80211_ioctl_iwaplist(struct net_devi
+ {
+ struct ieee80211vap *vap = netdev_priv(dev);
+ struct ieee80211com *ic = vap->iv_ic;
+- struct waplistreq req; /* XXX off stack */
++ struct waplistreq *req;
+
+- req.vap = vap;
+- req.i = 0;
+- ieee80211_scan_iterate(ic, waplist_cb, &req);
++ req = kmalloc(sizeof(struct waplistreq), GFP_KERNEL);
++ if (!req)
++ return -ENOMEM;
++ req->vap = vap;
++ req->i = 0;
++ ieee80211_scan_iterate(ic, waplist_cb, req);
+
+- data->length = req.i;
+- memcpy(extra, &req.addr, req.i * sizeof(req.addr[0]));
++ data->length = req->i;
++ memcpy(extra, &req->addr, req->i * sizeof(req->addr[0]));
+ data->flags = 1; /* signal quality present (sort of) */
+- memcpy(extra + req.i * sizeof(req.addr[0]), &req.qual,
+- req.i * sizeof(req.qual[0]));
++ memcpy(extra + req->i * sizeof(req->addr[0]), &req->qual,
++ req->i * sizeof(req->qual[0]));
++ kfree(req);
+
+ return 0;
+ }
+--- a/net80211/ieee80211_linux.c
++++ b/net80211/ieee80211_linux.c
+@@ -312,8 +312,9 @@ ieee80211_notify_sta_stats(struct ieee80
+ static const char *tag = "STA-TRAFFIC-STAT";
+ struct net_device *dev = vap->iv_dev;
+ union iwreq_data wreq;
+- char buf[1024];
++ char *buf;
+
++ buf = kmalloc(1024, GFP_KERNEL);
+ snprintf(buf, sizeof(buf), "%s\nmac=" MAC_FMT "\nrx_packets=%u\nrx_bytes=%llu\n"
+ "tx_packets=%u\ntx_bytes=%llu\n", tag,
+ MAC_ADDR(ni->ni_macaddr), ni->ni_stats.ns_rx_data,
+@@ -323,6 +324,7 @@ ieee80211_notify_sta_stats(struct ieee80
+ memset(&wreq, 0, sizeof(wreq));
+ wreq.data.length = strlen(buf);
+ wireless_send_event(dev, IWEVCUSTOM, &wreq, buf);
++ kfree(buf);
+ }
+
+ void