diff --git a/[refs] b/[refs]
index 2811f2604183..40977dc0f9fa 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 0d7f1299ca5540b9a63ab6e8bf0e89ea963eb6af
+refs/heads/master: 9b16b9edb4fd0dc86ee0fbe1f7ede580e26e85f4
diff --git a/trunk/drivers/target/target_core_device.c b/trunk/drivers/target/target_core_device.c
index cf2c66f3c116..9fc9a6006ca0 100644
--- a/trunk/drivers/target/target_core_device.c
+++ b/trunk/drivers/target/target_core_device.c
@@ -669,6 +669,13 @@ int target_report_luns(struct se_cmd *se_cmd)
 	unsigned char *buf;
 	u32 lun_count = 0, offset = 8, i;
 
+	if (se_cmd->data_length < 16) {
+		pr_warn("REPORT LUNS allocation length %u too small\n",
+			se_cmd->data_length);
+		se_cmd->scsi_sense_reason = TCM_INVALID_CDB_FIELD;
+		return -EINVAL;
+	}
+
 	buf = transport_kmap_data_sg(se_cmd);
 	if (!buf)
 		return -ENOMEM;