diff --git a/[refs] b/[refs]
index 9b2f013ac875..d518f3c123c9 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: bae6d3038b7faff187f4207448a40b9912cf787d
+refs/heads/master: 505172e11f5a0d9916e20e40d3b0a6f87d3a59b6
diff --git a/trunk/crypto/ansi_cprng.c b/trunk/crypto/ansi_cprng.c
index ffa0245e2abc..6ddd99e6114b 100644
--- a/trunk/crypto/ansi_cprng.c
+++ b/trunk/crypto/ansi_cprng.c
@@ -414,10 +414,18 @@ static int fips_cprng_get_random(struct crypto_rng *tfm, u8 *rdata,
 static int fips_cprng_reset(struct crypto_rng *tfm, u8 *seed, unsigned int slen)
 {
 	u8 rdata[DEFAULT_BLK_SZ];
+	u8 *key = seed + DEFAULT_BLK_SZ;
 	int rc;
 
 	struct prng_context *prng = crypto_rng_ctx(tfm);
 
+	if (slen < DEFAULT_PRNG_KSZ + DEFAULT_BLK_SZ)
+		return -EINVAL;
+
+	/* fips strictly requires seed != key */
+	if (!memcmp(seed, key, DEFAULT_PRNG_KSZ))
+		return -EINVAL;
+
 	rc = cprng_reset(tfm, seed, slen);
 
 	if (!rc)