[PATCH 2/6] powerpc/embedded6xx: Validate bus-range length in mvme5100_add_bridge()

[Thorsten Blum]

mvme5100_add_bridge() reads two cells from the bus-range property
without checking its length, and a truncated property can cause an
out-of-bounds read.

Check the length before reading the bus numbers.

Fixes: be2019816e4d ("powerpc/embedded6xx: Add support for Motorola/Emerson 
MVME5100")
Signed-off-by: Thorsten Blum <b...@kernel.org>
---
 arch/powerpc/platforms/embedded6xx/mvme5100.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/arch/powerpc/platforms/embedded6xx/mvme5100.c 
b/arch/powerpc/platforms/embedded6xx/mvme5100.c
index 5ca41972ef22..6a88abac047a 100644
--- a/arch/powerpc/platforms/embedded6xx/mvme5100.c
+++ b/arch/powerpc/platforms/embedded6xx/mvme5100.c
@@ -114,6 +114,10 @@ static int __init mvme5100_add_bridge(struct device_node 
*dev)
        pr_info("Adding PCI host bridge %pOF\n", dev);
 
        bus_range = of_get_property(dev, "bus-range", &len);
+       if (bus_range && len < 2 * sizeof(*bus_range)) {
+               pr_err("bus-range property is too short\n");
+               return -EINVAL;
+       }
 
        hose = pcibios_alloc_controller(dev);
        if (hose == NULL)