[PATCH 2/6] powerpc/embedded6xx: Validate bus-range length in mvme5100_add_bridge()

[Thorsten Blum <blum@kernel.org>]

mvme5100_add_bridge() reads two cells from the bus-range property
without checking its length, and a truncated property can cause an
out-of-bounds read.

Check the length before reading the bus numbers.

Fixes: be2019816e4d ("powerpc/embedded6xx: Add support for Motorola/Emerson MVME5100")
Signed-off-by: Thorsten Blum <blum@kernel.org>
---
 arch/powerpc/platforms/embedded6xx/mvme5100.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/arch/powerpc/platforms/embedded6xx/mvme5100.c b/arch/powerpc/platforms/embedded6xx/mvme5100.c
index 5ca41972ef22..6a88abac047a 100644
--- a/arch/powerpc/platforms/embedded6xx/mvme5100.c
+++ b/arch/powerpc/platforms/embedded6xx/mvme5100.c
@@ -114,6 +114,10 @@ static int __init mvme5100_add_bridge(struct device_node *dev)
 	pr_info("Adding PCI host bridge %pOF\n", dev);
 
 	bus_range = of_get_property(dev, "bus-range", &len);
+	if (bus_range && len < 2 * sizeof(*bus_range)) {
+		pr_err("bus-range property is too short\n");
+		return -EINVAL;
+	}
 
 	hose = pcibios_alloc_controller(dev);
 	if (hose == NULL)