mei: mei_cl_link protect open_handle_count from overflow

mei_cl_link is called both from mei_open and also from
in-kernel drivers so we need to protect open_handle_count
from overflow

Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/misc/mei/client.c b/drivers/misc/mei/client.c
index e0684b4d9a08aebd26453de23c5b88fb69b6b7d7..a82b443e45187de80d041f404d389c9330d97029 100644 (file)
--- a/drivers/misc/mei/client.c
+++ b/drivers/misc/mei/client.c
@@ -287,6 +287,12 @@ int mei_cl_link(struct mei_cl *cl, int id)
                return -ENOENT;
        }
 
+       if (dev->open_handle_count >= MEI_MAX_OPEN_HANDLE_COUNT) {
+               dev_err(&dev->pdev->dev, "open_handle_count exceded %d",
+                       MEI_MAX_OPEN_HANDLE_COUNT);
+               return -ENOENT;
+       }
+
        dev->open_handle_count++;
 
        cl->host_client_id = id;