2.6.24.4

 drivers

 scsi

diff --git a/drivers/scsi/advansys.c b/drivers/scsi/advansys.c
index 38a1ee2..f40417b 100644
--- a/drivers/scsi/advansys.c
+++ b/drivers/scsi/advansys.c
@@ -566,7 +566,7 @@ typedef struct asc_dvc_var {
    ASC_SCSI_BIT_ID_TYPE unit_not_ready;
    ASC_SCSI_BIT_ID_TYPE queue_full_or_busy;
    ASC_SCSI_BIT_ID_TYPE start_motor;
-   uchar overrun_buf[ASC_OVERRUN_BSIZE] __aligned(8);
+   uchar *overrun_buf;
    dma_addr_t overrun_dma;
    uchar scsi_reset_wait;
    uchar chip_no;
@@ -6439,7 +6439,7 @@ static int AdvLoadMicrocode(AdvPortAddr iop_base, unsigned char *buf, int size,
          i += 2;
          len += 2;
       } else {
-         unsigned char off = buf[i] * 2;
+         unsigned int off = buf[i] * 2;
          unsigned short word = (buf[off + 1] << 8) | buf[off];
          AdvWriteWordAutoIncLram(iop_base, word);
          len += 2;
@@ -13833,6 +13833,12 @@ static int __devinit advansys_board_found(struct Scsi_Host *shost,
     */
    if (ASC_NARROW_BOARD(boardp)) {
       ASC_DBG(2, "AscInitAsc1000Driver()\n");
+
+      asc_dvc_varp->overrun_buf = kzalloc(ASC_OVERRUN_BSIZE, GFP_KERNEL);
+      if (!asc_dvc_varp->overrun_buf) {
+         ret = -ENOMEM;
+         goto err_free_wide_mem;
+      }
       warn_code = AscInitAsc1000Driver(asc_dvc_varp);
 
       if (warn_code || asc_dvc_varp->err_code) {
@@ -13840,8 +13846,10 @@ static int __devinit advansys_board_found(struct Scsi_Host *shost,
                "warn 0x%x, error 0x%x\n",
                asc_dvc_varp->init_state, warn_code,
                asc_dvc_varp->err_code);
-         if (asc_dvc_varp->err_code)
+         if (asc_dvc_varp->err_code) {
             ret = -ENODEV;
+            kfree(asc_dvc_varp->overrun_buf);
+         }
       }
    } else {
       if (advansys_wide_init_chip(shost))
@@ -13894,6 +13902,7 @@ static int advansys_release(struct Scsi_Host *shost)
       dma_unmap_single(board->dev,
                board->dvc_var.asc_dvc_var.overrun_dma,
                ASC_OVERRUN_BSIZE, DMA_FROM_DEVICE);
+      kfree(board->dvc_var.asc_dvc_var.overrun_buf);
    } else {
       iounmap(board->ioremap_addr);
       advansys_wide_free_mem(board);