--- a/drivers/spi/spi-dln2.c
+++ b/drivers/spi/spi-dln2.c
@@ -70,7 +70,9 @@
 #define DLN2_SPI_GET_MIN_DELAY_BETWEEN_FRAMES	DLN2_SPI_CMD(0x4B)
 #define DLN2_SPI_GET_MAX_DELAY_BETWEEN_FRAMES	DLN2_SPI_CMD(0x4C)

 #define DLN2_SPI_MAX_XFER_SIZE			256
+/* The CS bitmask is carried in a u8 on the wire, so 8 lines is the ceiling. */
+#define DLN2_SPI_MAX_CS				8
 #define DLN2_SPI_BUF_SIZE			(DLN2_SPI_MAX_XFER_SIZE + 16)
 #define DLN2_SPI_ATTR_LEAVE_SS_LOW		BIT(0)
 #define DLN2_TRANSFERS_WAIT_COMPLETE		1
@@ -200,7 +202,9 @@ static int dln2_spi_get_cs_num(struct dln2_spi *dln2, u16 *cs_num)
 	if (rx_len < sizeof(rx))
 		return -EPROTO;

 	*cs_num = le16_to_cpu(rx.cs_count);
+	if (*cs_num == 0 || *cs_num > DLN2_SPI_MAX_CS)
+		return -EPROTO;

 	dev_dbg(&dln2->pdev->dev, "cs_num = %d\n", *cs_num);