diff --git a/[refs] b/[refs]
index de616acd1c4a..30127d9bbd31 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 9d90c1fd9bdbffb456d1b1ef05215343503fd0b0
+refs/heads/master: e265cfa19c1220938de5f0291ed8d549a523de3c
diff --git a/trunk/drivers/i2c/i2c-dev.c b/trunk/drivers/i2c/i2c-dev.c
index 64eee9551b22..df6e14c192d6 100644
--- a/trunk/drivers/i2c/i2c-dev.c
+++ b/trunk/drivers/i2c/i2c-dev.c
@@ -226,8 +226,10 @@ static int i2cdev_ioctl(struct inode *inode, struct file *file,
 
 		res = 0;
 		for( i=0; i<rdwr_arg.nmsgs; i++ ) {
-			/* Limit the size of the message to a sane amount */
-			if (rdwr_pa[i].len > 8192) {
+			/* Limit the size of the message to a sane amount;
+			 * and don't let length change either. */
+			if ((rdwr_pa[i].len > 8192) ||
+			    (rdwr_pa[i].flags & I2C_M_RECV_LEN)) {
 				res = -EINVAL;
 				break;
 			}