提交 6dac6aee 编写于 作者: Y Yufeng Mo 提交者: Xie XiuQi

net: hns3: add input length check for debugfs write function

driver inclusion
category: bugfix
bugzilla: NA
CVE: NA

If the input length reaches the maximum value of size_t, the reverse is
triggered when 1 is added. In addition, there is no need to have such a
large length. Therefore, the input length should be checked and the value
should be less than or equal to 1024.

Feature or Bugfix:Bugfix
Signed-off-by: NYufeng Mo <moyufeng@huawei.com>
Reviewed-by: Nlipeng <lipeng321@huawei.com>
Reviewed-by: NYang Yingliang <yangyingliang@huawei.com>
Signed-off-by: NYang Yingliang <yangyingliang@huawei.com>
上级 17752032
...@@ -8,6 +8,7 @@ ...@@ -8,6 +8,7 @@
#include "hns3_enet.h" #include "hns3_enet.h"
#define HNS3_DBG_READ_LEN 256 #define HNS3_DBG_READ_LEN 256
#define HNS3_DBG_WRITE_LEN 1024
static struct dentry *hns3_dbgfs_root; static struct dentry *hns3_dbgfs_root;
...@@ -320,6 +321,9 @@ static ssize_t hns3_dbg_cmd_write(struct file *filp, const char __user *buffer, ...@@ -320,6 +321,9 @@ static ssize_t hns3_dbg_cmd_write(struct file *filp, const char __user *buffer,
test_bit(HNS3_NIC_STATE_RESETTING, &priv->state)) test_bit(HNS3_NIC_STATE_RESETTING, &priv->state))
return 0; return 0;
if (count > HNS3_DBG_WRITE_LEN)
return 0;
cmd_buf = kzalloc(count + 1, GFP_KERNEL); cmd_buf = kzalloc(count + 1, GFP_KERNEL);
if (!cmd_buf) if (!cmd_buf)
return count; return count;
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册