1 files changed, 4 insertions, 0 deletions

diff --git a/drivers/scsi/dpt_i2o.c b/drivers/scsi/dpt_i2o.c
index b6af63ca980b..496764349c41 100644
--- a/drivers/scsi/dpt_i2o.c
+++ b/drivers/scsi/dpt_i2o.c
@@ -1918,6 +1918,10 @@ static int adpt_i2o_passthru(adpt_hba* pHba, u32 __user *arg)
                 }
                 size = size>>16;
                 size *= 4;
+                if (size > MAX_MESSAGE_SIZE) {
+                        rcode = -EINVAL;
+                        goto cleanup;
+                }
                 /* Copy in the user's I2O command */
                 if (copy_from_user (msg, user_msg, size)) {
                         rcode = -EFAULT;