mei: mei_cl_link protect open_handle_count from overflow

mei_cl_link is called both from mei_open and also from
in-kernel drivers so we need to protect open_handle_count
from overflow
Signed-off-by: NTomas Winkler <tomas.winkler@intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

drivers/misc/mei/client.c

@@ -287,6 +287,12 @@ int mei_cl_link(struct mei_cl *cl, int id)
 		return -ENOENT;
 	}
 
+	if (dev->open_handle_count >= MEI_MAX_OPEN_HANDLE_COUNT) {
+		dev_err(&dev->pdev->dev, "open_handle_count exceded %d",
+			MEI_MAX_OPEN_HANDLE_COUNT);
+		return -ENOENT;
+	}
+
 	dev->open_handle_count++;
 
 	cl->host_client_id = id;