Merge commit 'v2.6.37-rc7' into spi/next

1 files changed, 6 insertions, 0 deletions

diff --git a/drivers/pci/hotplug/ibmphp_ebda.c b/drivers/pci/hotplug/ibmphp_ebda.c
index 5becbdee4027..2850e64dedae 100644
--- a/drivers/pci/hotplug/ibmphp_ebda.c
+++ b/drivers/pci/hotplug/ibmphp_ebda.c
@@ -276,6 +276,12 @@ int __init ibmphp_access_ebda (void)
 
         for (;;) {
                 offset = next_offset;
+
+                /* Make sure what we read is still in the mapped section */
+                if (WARN(offset > (ebda_sz * 1024 - 4),
+                         "ibmphp_ebda: next read is beyond ebda_sz\n"))
+                        break;
+
                 next_offset = readw (io_mem + offset);  /* offset of next blk */
 
                 offset += 2;