{
        int ret;
        u16 index;
-       u8 usb_buf[6]; /* enough for all known requests,
-                         read returns 5 and write 6 bytes */
+       u8 *usb_buf;
+
+       /*
+        * allocate enough for all known requests,
+        * read returns 5 and write 6 bytes
+        */
+       usb_buf = kmalloc(6, GFP_KERNEL);
+       if (!usb_buf)
+               return -ENOMEM;
+
        switch (wlen) {
        case 1:
                index = wbuf[0] << 8;
                break;
        default:
                warn("wlen = %x, aborting.", wlen);
-               return -EINVAL;
+               ret = -EINVAL;
+               goto error;
        }
 
        ret = usb_control_msg(d->udev, usb_rcvctrlpipe(d->udev, 0), operation,
                              USB_TYPE_VENDOR|USB_DIR_IN, addr << 1, index,
-                             usb_buf, sizeof(usb_buf), AU6610_USB_TIMEOUT);
+                             usb_buf, 6, AU6610_USB_TIMEOUT);
        if (ret < 0)
-               return ret;
+               goto error;
 
        switch (operation) {
        case AU6610_REQ_I2C_READ:
                /* requested value is always 5th byte in buffer */
                rbuf[0] = usb_buf[4];
        }
-
+error:
+       kfree(usb_buf);
        return ret;
 }