From 28d3236ce3f8bc3787fecfbba45de711ee8816ab Mon Sep 17 00:00:00 2001
From: Lars-Peter Clausen <lars@metafoo.de>
Date: Wed, 26 Oct 2011 17:27:43 +0100
Subject: [PATCH] --- yaml --- r: 280996 b: refs/heads/master c:
 dc8f52643d494eaa844002ca866d30fda142db4f h: refs/heads/master v: v3

---
 [refs]                                        | 2 +-
 trunk/drivers/staging/iio/industrialio-core.c | 6 ++++--
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/[refs] b/[refs]
index 33831b50a734..978f35a586a7 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 0403e0d643809f1608448ada38a1877f26b7bf5d
+refs/heads/master: dc8f52643d494eaa844002ca866d30fda142db4f
diff --git a/trunk/drivers/staging/iio/industrialio-core.c b/trunk/drivers/staging/iio/industrialio-core.c
index fbf24bdc56d9..ee5e0640aa29 100644
--- a/trunk/drivers/staging/iio/industrialio-core.c
+++ b/trunk/drivers/staging/iio/industrialio-core.c
@@ -169,8 +169,11 @@ static ssize_t iio_event_chrdev_read(struct file *filep,
 {
 	struct iio_event_interface *ev_int = filep->private_data;
 	struct iio_detected_event_list *el;
+	size_t len = sizeof(el->ev);
 	int ret;
-	size_t len;
+
+	if (count < len)
+		return -EINVAL;
 
 	mutex_lock(&ev_int->event_list_lock);
 	if (list_empty(&ev_int->det_events)) {
@@ -192,7 +195,6 @@ static ssize_t iio_event_chrdev_read(struct file *filep,
 	el = list_first_entry(&ev_int->det_events,
 			      struct iio_detected_event_list,
 			      list);
-	len = sizeof el->ev;
 	if (copy_to_user(buf, &(el->ev), len)) {
 		ret = -EFAULT;
 		goto error_mutex_unlock;