From 63fc4b2c1004400c2a29f80ed8438513662ae614 Mon Sep 17 00:00:00 2001
From: Alan Cox <alan@linux.intel.com>
Date: Tue, 27 Oct 2009 15:35:35 +0000
Subject: [PATCH] --- yaml --- r: 167882 b: refs/heads/master c:
 ef7562b7f28319e6dd1f85dc1af87df2a7a84832 h: refs/heads/master v: v3

---
 [refs]                       | 2 +-
 trunk/drivers/scsi/dpt_i2o.c | 4 ++++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/[refs] b/[refs]
index 09cc81de2396..1b0389eb041f 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 0a53f1693cb956ebd8ba0a9acca6adb2dcb99d5f
+refs/heads/master: ef7562b7f28319e6dd1f85dc1af87df2a7a84832
diff --git a/trunk/drivers/scsi/dpt_i2o.c b/trunk/drivers/scsi/dpt_i2o.c
index b6af63ca980b..7d1aac31ec8d 100644
--- a/trunk/drivers/scsi/dpt_i2o.c
+++ b/trunk/drivers/scsi/dpt_i2o.c
@@ -1918,6 +1918,10 @@ static int adpt_i2o_passthru(adpt_hba* pHba, u32 __user *arg)
 		}
 		size = size>>16;
 		size *= 4;
+		if (size > MAX_MESSAGE_SIZE) {
+			rcode = EINVAL;
+			goto cleanup;
+		}
 		/* Copy in the user's I2O command */
 		if (copy_from_user (msg, user_msg, size)) {
 			rcode = -EFAULT;