summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorTomas Winkler <tomas.winkler@intel.com>2013-09-02 03:11:00 +0300
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2013-09-26 08:23:00 -0700
commitcaaeb09afda3a2239e02d495cea7e629136e09ee (patch)
treeeff6eae0ab25604bd0f202a3c1757ba6d8702966
parent4a10c2ac2f368583138b774ca41fac4207911983 (diff)
mei: mei_cl_link protect open_handle_count from overflow
mei_cl_link is called both from mei_open and also from in-kernel drivers so we need to protect open_handle_count from overflow Signed-off-by: Tomas Winkler <tomas.winkler@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-rw-r--r--drivers/misc/mei/client.c6
1 files changed, 6 insertions, 0 deletions
diff --git a/drivers/misc/mei/client.c b/drivers/misc/mei/client.c
index e0684b4d9a08..a82b443e4518 100644
--- a/drivers/misc/mei/client.c
+++ b/drivers/misc/mei/client.c
@@ -287,6 +287,12 @@ int mei_cl_link(struct mei_cl *cl, int id)
return -ENOENT;
}
+ if (dev->open_handle_count >= MEI_MAX_OPEN_HANDLE_COUNT) {
+ dev_err(&dev->pdev->dev, "open_handle_count exceded %d",
+ MEI_MAX_OPEN_HANDLE_COUNT);
+ return -ENOENT;
+ }
+
dev->open_handle_count++;
cl->host_client_id = id;