"len" comes from the USB transfer and it's probably correct.  The thing
is that we already have similar checks like:

        if (data[i] >= serial->num_ports) {

So adding a sanity test here matches the rest of the code and is a good
idea.
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>