Commit 7ac243f9 authored Aug 09, 2019 by Yufeng Mo Committed by David S. Miller Aug 09, 2019

net: hns3: add input length check for debugfs write function



If the input length reaches the maximum value of size_t, the reverse is
triggered when 1 is added. In addition, there is no need to have such a
large length. Therefore, the input length should be checked and the value
should be less than or equal to 1024.

Signed-off-by: Yufeng Mo <moyufeng@huawei.com>
Reviewed-by: Peng Li <lipeng321@huawei.com>
Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent eb977d99

drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c

+4 −0

Original line number	Diff line number	Diff line
		@@ -8,6 +8,7 @@
		#include "hns3_enet.h"

		#define HNS3_DBG_READ_LEN 256
		#define HNS3_DBG_WRITE_LEN 1024

		static struct dentry *hns3_dbgfs_root;

		@@ -322,6 +323,9 @@ static ssize_t hns3_dbg_cmd_write(struct file filp, const char __user buffer,
		test_bit(HNS3_NIC_STATE_RESETTING, &priv->state))
		return 0;

		if (count > HNS3_DBG_WRITE_LEN)
		return -ENOSPC;

		cmd_buf = kzalloc(count + 1, GFP_KERNEL);
		if (!cmd_buf)
		return count;