OpenPROM: Sigh, put the length overflow check back it is needed.

drivers/sbus/char/openprom.c

@@ -334,6 +334,9 @@ static int copyin_string(char *user, size_t len, char **ptr)
 {
 	char *tmp;
 
+	if ((ssize_t)len < 0 || (ssize_t)(len + 1) < 0)
+		return -EINVAL;
+
 	tmp = kmalloc(len + 1, GFP_KERNEL);
 	if (!tmp)
 		return -ENOMEM;