2 files changed, 4 insertions, 2 deletions

diff --git a/fs/xfs/xfs_ioctl.c b/fs/xfs/xfs_ioctl.c
index 4d613401a5e0..33ad9a77791f 100644
--- a/fs/xfs/xfs_ioctl.c
+++ b/fs/xfs/xfs_ioctl.c
@@ -442,7 +442,8 @@ xfs_attrlist_by_handle(
                 return -XFS_ERROR(EPERM);
         if (copy_from_user(&al_hreq, arg, sizeof(xfs_fsop_attrlist_handlereq_t)))
                 return -XFS_ERROR(EFAULT);
-        if (al_hreq.buflen > XATTR_LIST_MAX)
+        if (al_hreq.buflen < sizeof(struct attrlist) ||
+            al_hreq.buflen > XATTR_LIST_MAX)
                 return -XFS_ERROR(EINVAL);
 
         /*
diff --git a/fs/xfs/xfs_ioctl32.c b/fs/xfs/xfs_ioctl32.c
index e8fb1231db81..a7992f8de9d3 100644
--- a/fs/xfs/xfs_ioctl32.c
+++ b/fs/xfs/xfs_ioctl32.c
@@ -356,7 +356,8 @@ xfs_compat_attrlist_by_handle(
         if (copy_from_user(&al_hreq, arg,
                            sizeof(compat_xfs_fsop_attrlist_handlereq_t)))
                 return -XFS_ERROR(EFAULT);
-        if (al_hreq.buflen > XATTR_LIST_MAX)
+        if (al_hreq.buflen < sizeof(struct attrlist) ||
+            al_hreq.buflen > XATTR_LIST_MAX)
                 return -XFS_ERROR(EINVAL);
 
         /*