The i40e_dbg_command_write() function uses 'count' from user space in kzalloc(count + 1) without validation. If count = 0xFFFFFFFF, integer overflow occurs.
An attacker or local user could trigger a buffer overflow or integer overflow by writing large amounts of data to the debugfs file. Fix by adding validation: if (count == 0 || count > PAGE_SIZE) return -EINVAL. PAGE_SIZE is chosen as a common limit for debugfs writes to prevent excessive stack/heap allocation. Signed-off-by: Rifaldi Hormat <[email protected]> --- drivers/net/ethernet/intel/i40e/i40e_debugfs.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/net/ethernet/intel/i40e/i40e_debugfs.c b/drivers/net/ethernet/intel/i40e/i40e_debugfs.c index 0b52509cb14c..74e75504fdda 100644 --- a/drivers/net/ethernet/intel/i40e/i40e_debugfs.c +++ b/drivers/net/ethernet/intel/i40e/i40e_debugfs.c @@ -722,6 +722,8 @@ static ssize_t i40e_dbg_command_write(struct file *filp, int cnt; /* don't allow partial writes */ + if (count == 0 || count > PAGE_SIZE) + return -EINVAL; if (*ppos != 0) return 0; @@ -1605,6 +1607,8 @@ static ssize_t i40e_dbg_netdev_ops_write(struct file *filp, int i, cnt; /* don't allow partial writes */ + if (count == 0 || count > PAGE_SIZE) + return -EINVAL; if (*ppos != 0) return 0; -- 2.53.0
