diff --git a/[refs] b/[refs]
index 36dc0f9c7c52..24d2742f27c3 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 53604dbe1371c3c4458c2d741adbd8cfd8fe8e79
+refs/heads/master: aa77d96ba94326db4f50d2aa36602824dd03286a
diff --git a/trunk/drivers/spi/spi_mpc83xx.c b/trunk/drivers/spi/spi_mpc83xx.c
index ab7ee445d8b2..ac0e3e4b3c54 100644
--- a/trunk/drivers/spi/spi_mpc83xx.c
+++ b/trunk/drivers/spi/spi_mpc83xx.c
@@ -312,11 +312,20 @@ static int mpc83xx_spi_bufs(struct spi_device *spi, struct spi_transfer *t)
 	if (t->bits_per_word)
 		bits_per_word = t->bits_per_word;
 	len = t->len;
-	if (bits_per_word > 8)
+	if (bits_per_word > 8) {
+		/* invalid length? */
+		if (len & 1)
+			return -EINVAL;
 		len /= 2;
-	if (bits_per_word > 16)
+	}
+	if (bits_per_word > 16) {
+		/* invalid length? */
+		if (len & 1)
+			return -EINVAL;
 		len /= 2;
+	}
 	mpc83xx_spi->count = len;
+
 	INIT_COMPLETION(mpc83xx_spi->done);
 
 	/* enable rx ints */