> -----Original Message-----
> From: rivaldihormat-debug <[email protected]>
> Sent: Saturday, September 5, 2026 6:32 PM
> To: [email protected]
> Cc: [email protected]; Rifaldi Hormat
> <[email protected]>
> Subject: [PATCH] i40e: fix integer overflow in
> i40e_dbg_command_write()
>
> From: Rifaldi Hormat <[email protected]>
>
Dear Rifaldi,
Thank you for the patch to fix the integer overflow in i40e_dbg_command_write().
The fix is sensible. However, please ensure your commit message clearly states:
- The bug: An attacker or local user could trigger a buffer overflow or integer
overflow by writing large amounts of data to the debugfs file.
- The fix: Limiting the write size to PAGE_SIZE.
- Why PAGE_SIZE: It is a common limit for debugfs writes to prevent excessive
stack/heap allocation.
With the best regards
Alex
> Signed-off-by: Rifaldi Hormat <[email protected]>
> ---
> drivers/net/ethernet/intel/i40e/i40e_debugfs.c | 4 ++++
> 1 file changed, 4 insertions(+)
>
> diff --git a/drivers/net/ethernet/intel/i40e/i40e_debugfs.c
> b/drivers/net/ethernet/intel/i40e/i40e_debugfs.c
> index 0b52509cb14c..74e75504fdda 100644
> --- a/drivers/net/ethernet/intel/i40e/i40e_debugfs.c
> +++ b/drivers/net/ethernet/intel/i40e/i40e_debugfs.c
> @@ -722,6 +722,8 @@ static ssize_t i40e_dbg_command_write(struct file
> *filp,
> int cnt;
>
> /* don't allow partial writes */
> + if (count == 0 || count > PAGE_SIZE)
> + return -EINVAL;
> if (*ppos != 0)
> return 0;
>
> @@ -1605,6 +1607,8 @@ static ssize_t i40e_dbg_netdev_ops_write(struct
> file *filp,
> int i, cnt;
>
> /* don't allow partial writes */
> + if (count == 0 || count > PAGE_SIZE)
> + return -EINVAL;
> if (*ppos != 0)
> return 0;
>
> --
> 2.53.0
