1 files changed, 7 insertions, 1 deletions

diff --git a/drivers/platform/chrome/cros_ec_dev.c b/drivers/platform/chrome/cros_ec_dev.c
index 6d8ee3b15872..8abd80dbcbed 100644
--- a/drivers/platform/chrome/cros_ec_dev.c
+++ b/drivers/platform/chrome/cros_ec_dev.c
@@ -151,13 +151,19 @@ static long ec_device_ioctl_xcmd(struct cros_ec_dev *ec, void __user *arg)
                 goto exit;
         }
 
+        if (u_cmd.outsize != s_cmd->outsize ||
+            u_cmd.insize != s_cmd->insize) {
+                ret = -EINVAL;
+                goto exit;
+        }
+
         s_cmd->command += ec->cmd_offset;
         ret = cros_ec_cmd_xfer(ec->ec_dev, s_cmd);
         /* Only copy data to userland if data was received. */
         if (ret < 0)
                 goto exit;
 
-        if (copy_to_user(arg, s_cmd, sizeof(*s_cmd) + u_cmd.insize))
+        if (copy_to_user(arg, s_cmd, sizeof(*s_cmd) + s_cmd->insize))
                 ret = -EFAULT;
 exit:
         kfree(s_cmd);