diff --git a/[refs] b/[refs]
index c85e76240a75..ef5abcc96170 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: b7a8d17db9a86db1040862600cf3a02848f83844
+refs/heads/master: db332bc9b26bbd79a37241721cccc9919489d5a9
diff --git a/trunk/drivers/usb/gadget/f_mass_storage.c b/trunk/drivers/usb/gadget/f_mass_storage.c
index 52583a235330..dfd0044cc15a 100644
--- a/trunk/drivers/usb/gadget/f_mass_storage.c
+++ b/trunk/drivers/usb/gadget/f_mass_storage.c
@@ -639,7 +639,8 @@ static int fsg_setup(struct usb_function *f,
 		if (ctrl->bRequestType !=
 		    (USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE))
 			break;
-		if (w_index != fsg->interface_number || w_value != 0)
+		if (w_index != fsg->interface_number || w_value != 0 ||
+				w_length != 1)
 			return -EDOM;
 		VDBG(fsg, "get max LUN\n");
 		*(u8 *)req->buf = fsg->common->nluns - 1;
diff --git a/trunk/drivers/usb/gadget/file_storage.c b/trunk/drivers/usb/gadget/file_storage.c
index f7e39b0365ce..4314cf201420 100644
--- a/trunk/drivers/usb/gadget/file_storage.c
+++ b/trunk/drivers/usb/gadget/file_storage.c
@@ -875,7 +875,7 @@ static int class_setup_req(struct fsg_dev *fsg,
 			if (ctrl->bRequestType != (USB_DIR_IN |
 					USB_TYPE_CLASS | USB_RECIP_INTERFACE))
 				break;
-			if (w_index != 0 || w_value != 0) {
+			if (w_index != 0 || w_value != 0 || w_length != 1) {
 				value = -EDOM;
 				break;
 			}