Messages in this thread Patch in this message | | | From | Tomas Winkler <> | Subject | [char-misc-next 2/8] mei: hbm: validate client index is not exceeding allocated array size | Date | Mon, 21 Oct 2013 22:05:37 +0300 |
| |
Signed-off-by: Tomas Winkler <tomas.winkler@intel.com> --- drivers/misc/mei/hbm.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/misc/mei/hbm.c b/drivers/misc/mei/hbm.c index 9b3a0fb..0f5e8ca 100644 --- a/drivers/misc/mei/hbm.c +++ b/drivers/misc/mei/hbm.c @@ -228,8 +228,6 @@ static int mei_hbm_prop_req(struct mei_device *dev) unsigned long client_num; - client_num = dev->me_client_presentation_num; - next_client_index = find_next_bit(dev->me_clients_map, MEI_CLIENTS_MAX, dev->me_client_index); @@ -241,6 +239,10 @@ static int mei_hbm_prop_req(struct mei_device *dev) return 0; } + client_num = dev->me_client_presentation_num; + if (WARN_ON(dev->me_clients_num <= client_num)) + return -EIO; + dev->me_clients[client_num].client_id = next_client_index; dev->me_clients[client_num].mei_flow_ctrl_creds = 0; -- 1.8.3.1
| |