struct gelic_eurus_cmd *cmd;
        struct iw_statistics *is;
        struct gelic_eurus_rssi_info *rssi;
+       void *buf;
 
        pr_debug("%s: <-\n", __func__);
 
+       buf = (void *)__get_free_page(GFP_KERNEL);
+       if (!buf)
+               return NULL;
+
        is = &wl->iwstat;
        memset(is, 0, sizeof(*is));
        cmd = gelic_eurus_sync_cmd(wl, GELIC_EURUS_CMD_GET_RSSI_CFG,
-                                  wl->buf, sizeof(*rssi));
+                                  buf, sizeof(*rssi));
        if (cmd && !cmd->status && !cmd->cmd_status) {
-               rssi = wl->buf;
+               rssi = buf;
                is->qual.level = be16_to_cpu(rssi->rssi);
                is->qual.updated = IW_QUAL_LEVEL_UPDATED |
                        IW_QUAL_QUAL_INVALID | IW_QUAL_NOISE_INVALID;
                is->qual.updated = IW_QUAL_ALL_INVALID;
 
        kfree(cmd);
+       free_page((unsigned long)buf);
        pr_debug("%s: ->\n", __func__);
        return is;
 }
        union iwreq_data data;
        unsigned long this_time = jiffies;
        unsigned int data_len, i, found, r;
+       void *buf;
        DECLARE_MAC_BUF(mac);
 
        pr_debug("%s:start\n", __func__);
        mutex_lock(&wl->scan_lock);
 
+       buf = (void *)__get_free_page(GFP_KERNEL);
+       if (!buf) {
+               pr_info("%s: scan buffer alloc failed\n", __func__);
+               goto out;
+       }
+
        if (wl->scan_stat != GELIC_WL_SCAN_STAT_SCANNING) {
                /*
                 * stop() may be called while scanning, ignore result
        }
 
        cmd = gelic_eurus_sync_cmd(wl, GELIC_EURUS_CMD_GET_SCAN,
-                                  wl->buf, PAGE_SIZE);
+                                  buf, PAGE_SIZE);
        if (!cmd || cmd->status || cmd->cmd_status) {
                wl->scan_stat = GELIC_WL_SCAN_STAT_INIT;
                pr_info("%s:cmd failed\n", __func__);
        }
 
        /* put them in the newtork_list */
-       for (i = 0, scan_info_size = 0, scan_info = wl->buf;
+       for (i = 0, scan_info_size = 0, scan_info = buf;
             scan_info_size < data_len;
             i++, scan_info_size += be16_to_cpu(scan_info->size),
             scan_info = (void *)scan_info + be16_to_cpu(scan_info->size)) {
        wireless_send_event(port_to_netdev(wl_port(wl)), SIOCGIWSCAN, &data,
                            NULL);
 out:
+       free_page((unsigned long)buf);
        complete(&wl->scan_done);
        mutex_unlock(&wl->scan_lock);
        pr_debug("%s:end\n", __func__);
 
        pr_debug("%s: <-\n", __func__);
        /* we can assume no one should uses the buffer */
-       wep = wl->buf;
+       wep = (struct gelic_eurus_wep_cfg *)__get_free_page(GFP_KERNEL);
+       if (!wep)
+               return -ENOMEM;
+
        memset(wep, 0, sizeof(*wep));
 
        if (wl->group_cipher_method == GELIC_WL_CIPHER_WEP) {
 
        kfree(cmd);
 out:
+       free_page((unsigned long)wep);
        pr_debug("%s: ->\n", __func__);
        return ret;
 }
 
        pr_debug("%s: <-\n", __func__);
        /* we can assume no one should uses the buffer */
-       wpa = wl->buf;
+       wpa = (struct gelic_eurus_wpa_cfg *)__get_free_page(GFP_KERNEL);
+       if (!wpa)
+               return -ENOMEM;
+
        memset(wpa, 0, sizeof(*wpa));
 
        if (!test_bit(GELIC_WL_STAT_WPA_PSK_SET, &wl->stat))
        else if (cmd->status || cmd->cmd_status)
                ret = -ENXIO;
        kfree(cmd);
+       free_page((unsigned long)wpa);
        pr_debug("%s: --> %d\n", __func__, ret);
        return ret;
 }
        pr_debug("%s: <-\n", __func__);
 
        /* do common config */
-       common = wl->buf;
+       common = (struct gelic_eurus_common_cfg *)__get_free_page(GFP_KERNEL);
+       if (!common)
+               return -ENOMEM;
+
        memset(common, 0, sizeof(*common));
        common->bss_type = cpu_to_be16(GELIC_EURUS_BSS_INFRA);
        common->op_mode = cpu_to_be16(GELIC_EURUS_OPMODE_11BG);
                pr_info("%s: connected\n", __func__);
        }
 out:
+       free_page((unsigned long)common);
        pr_debug("%s: ->\n", __func__);
        return ret;
 }