diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
index 8ff6945b9f8f4db3dc0c87689b700d35a0e6d11c..275122cc0b6d1aa6a9250dfb4a56c140f4aa9cdb 100644
--- a/net/sched/cls_flower.c
+++ b/net/sched/cls_flower.c
@@ -1080,6 +1080,9 @@ static int fl_set_geneve_opt(const struct nlattr *nla, struct fl_flow_key *key,
 	if (option_len > sizeof(struct geneve_opt))
 		data_len = option_len - sizeof(struct geneve_opt);
 
+	if (key->enc_opts.len > FLOW_DIS_TUN_OPTS_MAX - 4)
+		return -ERANGE;
+
 	opt = (struct geneve_opt *)&key->enc_opts.data[key->enc_opts.len];
 	memset(opt, 0xff, option_len);
 	opt->length = data_len / 4;