diff --git a/[refs] b/[refs]
index 5d7ce9e6a349..fed58c2a252c 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 6a9ce6b654e491981f6ef7e214cbd4f63e033848
+refs/heads/master: e384a41141949843899affcf51f4e6e646c1fe9f
diff --git a/trunk/drivers/staging/comedi/comedi_fops.c b/trunk/drivers/staging/comedi/comedi_fops.c
index ebdcecda3583..ed4853f194c4 100644
--- a/trunk/drivers/staging/comedi/comedi_fops.c
+++ b/trunk/drivers/staging/comedi/comedi_fops.c
@@ -670,6 +670,11 @@ static int do_insnlist_ioctl(struct comedi_device *dev,
 		goto error;
 	}
 
+	if (sizeof(struct comedi_insn) * insnlist.n_insns < insnlist.n_insns) {
+		ret = -EINVAL;
+		goto error;
+	}
+
 	insns =
 	    kmalloc(sizeof(struct comedi_insn) * insnlist.n_insns, GFP_KERNEL);
 	if (!insns) {