mei_cl_link is called both from mei_open and also from
in-kernel drivers so we need to protect open_handle_count
from overflow
Signed-off-by: Tomas Winkler <tomas.wink...@intel.com>
---
drivers/misc/mei/client.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/misc/mei/client.c b/drivers/misc/mei/client.c
index e0684b4..a82b443 100644
--- a/drivers/misc/mei/client.c
+++ b/drivers/misc/mei/client.c
@@ -287,6 +287,12 @@ int mei_cl_link(struct mei_cl *cl, int id)
return -ENOENT;
}
+ if (dev->open_handle_count >= MEI_MAX_OPEN_HANDLE_COUNT) {
+ dev_err(&dev->pdev->dev, "open_handle_count exceded %d",
+ MEI_MAX_OPEN_HANDLE_COUNT);
+ return -ENOENT;
+ }
+
dev->open_handle_count++;
cl->host_client_id = id;
--
1.8.3.1
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
