From 7219ec681e66e105880b7faeea34f02024957c0f Mon Sep 17 00:00:00 2001
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Fri, 4 Nov 2011 21:20:43 +0300
Subject: [PATCH] --- yaml --- r: 276321 b: refs/heads/master c:
 e384a41141949843899affcf51f4e6e646c1fe9f h: refs/heads/master i:   276319:
 4ee37ee9742b1b913ee65705253158bea15d866f v: v3

---
 [refs]                                     | 2 +-
 trunk/drivers/staging/comedi/comedi_fops.c | 5 +++++
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/[refs] b/[refs]
index 5d7ce9e6a349..fed58c2a252c 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 6a9ce6b654e491981f6ef7e214cbd4f63e033848
+refs/heads/master: e384a41141949843899affcf51f4e6e646c1fe9f
diff --git a/trunk/drivers/staging/comedi/comedi_fops.c b/trunk/drivers/staging/comedi/comedi_fops.c
index ebdcecda3583..ed4853f194c4 100644
--- a/trunk/drivers/staging/comedi/comedi_fops.c
+++ b/trunk/drivers/staging/comedi/comedi_fops.c
@@ -670,6 +670,11 @@ static int do_insnlist_ioctl(struct comedi_device *dev,
 		goto error;
 	}
 
+	if (sizeof(struct comedi_insn) * insnlist.n_insns < insnlist.n_insns) {
+		ret = -EINVAL;
+		goto error;
+	}
+
 	insns =
 	    kmalloc(sizeof(struct comedi_insn) * insnlist.n_insns, GFP_KERNEL);
 	if (!insns) {