From 6dac6aeecf6e7886ca8e4ab07ce2fa04e6679e45 Mon Sep 17 00:00:00 2001 From: Yufeng Mo Date: Tue, 14 May 2019 20:38:27 +0800 Subject: [PATCH] net: hns3: add input length check for debugfs write function driver inclusion category: bugfix bugzilla: NA CVE: NA If the input length reaches the maximum value of size_t, the reverse is triggered when 1 is added. In addition, there is no need to have such a large length. Therefore, the input length should be checked and the value should be less than or equal to 1024. Feature or Bugfix:Bugfix Signed-off-by: Yufeng Mo Reviewed-by: lipeng Reviewed-by: Yang Yingliang Signed-off-by: Yang Yingliang --- drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c b/drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c index 23b58ce52ddd..e25c7503706d 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c +++ b/drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c @@ -8,6 +8,7 @@ #include "hns3_enet.h" #define HNS3_DBG_READ_LEN 256 +#define HNS3_DBG_WRITE_LEN 1024 static struct dentry *hns3_dbgfs_root; @@ -320,6 +321,9 @@ static ssize_t hns3_dbg_cmd_write(struct file *filp, const char __user *buffer, test_bit(HNS3_NIC_STATE_RESETTING, &priv->state)) return 0; + if (count > HNS3_DBG_WRITE_LEN) + return 0; + cmd_buf = kzalloc(count + 1, GFP_KERNEL); if (!cmd_buf) return count; -- GitLab