diff --git a/[refs] b/[refs]
index a16f7c3ffd1f..5b6571e7060c 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 695c60f21c69e525a89279a5f35bae4ff237afbc
+refs/heads/master: 481fe17e973fb97aa3edf17c69557afe88d8334f
diff --git a/trunk/fs/nilfs2/ioctl.c b/trunk/fs/nilfs2/ioctl.c
index 3e654273cfc2..ac258beeda3c 100644
--- a/trunk/fs/nilfs2/ioctl.c
+++ b/trunk/fs/nilfs2/ioctl.c
@@ -625,6 +625,9 @@ static int nilfs_ioctl_clean_segments(struct inode *inode, struct file *filp,
 		if (argv[n].v_nmembs > nsegs * nilfs->ns_blocks_per_segment)
 			goto out_free;
 
+		if (argv[n].v_nmembs >= UINT_MAX / argv[n].v_size)
+			goto out_free;
+
 		len = argv[n].v_size * argv[n].v_nmembs;
 		base = (void __user *)(unsigned long)argv[n].v_base;
 		if (len == 0) {