diff --git a/[refs] b/[refs]
index 6e52d9c9f32b..bc71018f0493 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 2b611cb6eed04062d0a9861c82248e02c844ba3f
+refs/heads/master: 88f16db7a2fa63b9242e8a0fbc40d51722f2e2f9
diff --git a/trunk/net/wireless/wext.c b/trunk/net/wireless/wext.c
index cb6a5bb85d80..0e59f9ae9b81 100644
--- a/trunk/net/wireless/wext.c
+++ b/trunk/net/wireless/wext.c
@@ -786,6 +786,13 @@ static int ioctl_standard_iw_point(struct iw_point *iwp, unsigned int cmd,
 			err = -EFAULT;
 			goto out;
 		}
+
+		if (cmd == SIOCSIWENCODEEXT) {
+			struct iw_encode_ext *ee = (void *) extra;
+
+			if (iwp->length < sizeof(*ee) + ee->key_len)
+				return -EFAULT;
+		}
 	}
 
 	err = handler(dev, info, (union iwreq_data *) iwp, extra);