Messages in this thread Patch in this message | | | From | Tomas Winkler <> | Subject | [char-misc-next 1/5] mei: mei_cl_link protect open_handle_count from overflow | Date | Mon, 2 Sep 2013 03:11:00 +0300 |
| |
mei_cl_link is called both from mei_open and also from in-kernel drivers so we need to protect open_handle_count from overflow
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com> --- drivers/misc/mei/client.c | 6 ++++++ 1 file changed, 6 insertions(+)
diff --git a/drivers/misc/mei/client.c b/drivers/misc/mei/client.c index e0684b4..a82b443 100644 --- a/drivers/misc/mei/client.c +++ b/drivers/misc/mei/client.c @@ -287,6 +287,12 @@ int mei_cl_link(struct mei_cl *cl, int id) return -ENOENT; } + if (dev->open_handle_count >= MEI_MAX_OPEN_HANDLE_COUNT) { + dev_err(&dev->pdev->dev, "open_handle_count exceded %d", + MEI_MAX_OPEN_HANDLE_COUNT); + return -ENOENT; + } + dev->open_handle_count++; cl->host_client_id = id; -- 1.8.3.1
| |