diff --git a/[refs] b/[refs]
index 5b86799be04b..946c398a9e39 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 71b3e938cb97f6cf324fb5aaca46d8e400dc38f0
+refs/heads/master: d1ff320f0a9766a53ae412d96f72bd861a889af6
diff --git a/trunk/drivers/input/touchscreen/atmel_mxt_ts.c b/trunk/drivers/input/touchscreen/atmel_mxt_ts.c
index 15ae6fd575b2..8f0dc7776e7d 100644
--- a/trunk/drivers/input/touchscreen/atmel_mxt_ts.c
+++ b/trunk/drivers/input/touchscreen/atmel_mxt_ts.c
@@ -506,7 +506,7 @@ static int mxt_write_object(struct mxt_data *data,
 	u16 reg;
 
 	object = mxt_get_object(data, type);
-	if (!object)
+	if (!object || offset >= object->size + 1)
 		return -EINVAL;
 
 	reg = object->start_address;