[char-misc-next 2/8] mei: hbm: validate client index is not exceeding allocated array size

[Tomas Winkler]

Signed-off-by: Tomas Winkler <tomas.winkler@xxxxxxxxx>
---
 drivers/misc/mei/hbm.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/misc/mei/hbm.c b/drivers/misc/mei/hbm.c
index 9b3a0fb..0f5e8ca 100644
--- a/drivers/misc/mei/hbm.c
+++ b/drivers/misc/mei/hbm.c
@@ -228,8 +228,6 @@ static int mei_hbm_prop_req(struct mei_device *dev)
 	unsigned long client_num;
 
 
-	client_num = dev->me_client_presentation_num;
-
 	next_client_index = find_next_bit(dev->me_clients_map, MEI_CLIENTS_MAX,
 					  dev->me_client_index);
 
@@ -241,6 +239,10 @@ static int mei_hbm_prop_req(struct mei_device *dev)
 		return 0;
 	}
 
+	client_num = dev->me_client_presentation_num;
+	if (WARN_ON(dev->me_clients_num <= client_num))
+		return -EIO;
+
 	dev->me_clients[client_num].client_id = next_client_index;
 	dev->me_clients[client_num].mei_flow_ctrl_creds = 0;
 
-- 
1.8.3.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/