diff --git a/[refs] b/[refs]
index feaf252615c4..3444d58ad914 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 6aba72cf76d21527dc73403e4147397375c8c232
+refs/heads/master: 22c859faf5e10e7f7b04a2c643a98eeee69c1815
diff --git a/trunk/drivers/media/video/v4l2-compat-ioctl32.c b/trunk/drivers/media/video/v4l2-compat-ioctl32.c
index dc7b8c23eac0..f77f84bfe714 100644
--- a/trunk/drivers/media/video/v4l2-compat-ioctl32.c
+++ b/trunk/drivers/media/video/v4l2-compat-ioctl32.c
@@ -475,6 +475,9 @@ static int get_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user
 			return -EFAULT;
 	switch (kp->memory) {
 	case V4L2_MEMORY_MMAP:
+		if (get_user(kp->length, &up->length) ||
+			get_user(kp->m.offset, &up->m.offset))
+			return -EFAULT;
 		break;
 	case V4L2_MEMORY_USERPTR:
 		{