diff --git a/[refs] b/[refs]
index da1be913394e..534551e70f27 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: e688a604807647c9450f9c12a7cb6d027150a895
+refs/heads/master: a0a129f8b6cff54ab479324a54aefdab5db4f240
diff --git a/trunk/net/core/net-sysfs.c b/trunk/net/core/net-sysfs.c
index c71c434a4c05..385aefe53648 100644
--- a/trunk/net/core/net-sysfs.c
+++ b/trunk/net/core/net-sysfs.c
@@ -665,11 +665,14 @@ static ssize_t store_rps_dev_flow_table_cnt(struct netdev_rx_queue *queue,
 	if (count) {
 		int i;
 
-		if (count > 1<<30) {
+		if (count > INT_MAX)
+			return -EINVAL;
+		count = roundup_pow_of_two(count);
+		if (count > (ULONG_MAX - sizeof(struct rps_dev_flow_table))
+				/ sizeof(struct rps_dev_flow)) {
 			/* Enforce a limit to prevent overflow */
 			return -EINVAL;
 		}
-		count = roundup_pow_of_two(count);
 		table = vmalloc(RPS_DEV_FLOW_TABLE_SIZE(count));
 		if (!table)
 			return -ENOMEM;