diff options
| author |   Tomas Winkler <tomas.winkler@intel.com> | 2013-09-02 03:11:00 +0300 |
|---|---|---|
| committer |   Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2013-09-26 08:23:00 -0700 |
| commit | caaeb09afda3a2239e02d495cea7e629136e09ee (patch) | |
| tree | eff6eae0ab25604bd0f202a3c1757ba6d8702966 /drivers/misc/mei/client.c | |
| parent | Linux 3.12-rc2 (diff) | |
| download | linux-dev-caaeb09afda3a2239e02d495cea7e629136e09ee.tar.xz linux-dev-caaeb09afda3a2239e02d495cea7e629136e09ee.zip | |
mei: mei_cl_link protect open_handle_count from overflow
mei_cl_link is called both from mei_open and also from
in-kernel drivers so we need to protect open_handle_count
from overflow
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to '')
| -rw-r--r-- | drivers/misc/mei/client.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/drivers/misc/mei/client.c b/drivers/misc/mei/client.c index e0684b4d9a08..a82b443e4518 100644 --- a/drivers/misc/mei/client.c +++ b/drivers/misc/mei/client.c @@ -287,6 +287,12 @@ int mei_cl_link(struct mei_cl *cl, int id) return -ENOENT; } + if (dev->open_handle_count >= MEI_MAX_OPEN_HANDLE_COUNT) { + dev_err(&dev->pdev->dev, "open_handle_count exceded %d", + MEI_MAX_OPEN_HANDLE_COUNT); + return -ENOENT; + } + dev->open_handle_count++; cl->host_client_id = id; |