From b930462e47d2297aab85439ffb23f1f93eb88dd1 Mon Sep 17 00:00:00 2001
From: Arjan van de Ven <arjan@infradead.org>
Date: Mon, 14 Dec 2009 18:00:11 -0800
Subject: [PATCH] --- yaml --- r: 176325 b: refs/heads/master c:
 2886a8bdfa007053b414ab01741a98c18c376a85 h: refs/heads/master i:   176323:
 4716178f4c4b3d83f31327bf9abb6f61a06f5bb7 v: v3

---
 [refs]                       | 2 +-
 trunk/drivers/block/floppy.c | 3 +++
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/[refs] b/[refs]
index dcf01cb8122b..b40f6573cd35 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: faa7b7ddca14887ac037f585d2fac7ca6c57037e
+refs/heads/master: 2886a8bdfa007053b414ab01741a98c18c376a85
diff --git a/trunk/drivers/block/floppy.c b/trunk/drivers/block/floppy.c
index d41d7f018549..3266b4f65daa 100644
--- a/trunk/drivers/block/floppy.c
+++ b/trunk/drivers/block/floppy.c
@@ -3497,6 +3497,9 @@ static int fd_ioctl(struct block_device *bdev, fmode_t mode, unsigned int cmd,
 	    ((cmd & 0x80) && !capable(CAP_SYS_ADMIN)))
 		return -EPERM;
 
+	if (WARN_ON(size < 0 || size > sizeof(inparam)))
+		return -EINVAL;
+
 	/* copyin */
 	CLEARSTRUCT(&inparam);
 	if (_IOC_DIR(cmd) & _IOC_WRITE)