> -----Original Message----- > From: rivaldihormat-debug <[email protected]> > Sent: Tuesday, September 8, 2026 8:40 AM > To: [email protected] > Cc: [email protected]; Loktionov, Aleksandr > <[email protected]>; rivaldihormat-debug <[email protected]> > Subject: [PATCH] i40e: fix integer overflow in i40e_dbg_command_write() > > The i40e_dbg_command_write() function uses 'count' from user space in > kzalloc(count + 1) without validation. If count = 0xFFFFFFFF, integer > overflow occurs. > > An attacker or local user could trigger a buffer overflow or integer overflow > by writing large amounts of data to the debugfs file. > > Fix by adding validation: > if (count == 0 || count > PAGE_SIZE) return -EINVAL. > > PAGE_SIZE is chosen as a common limit for debugfs writes to prevent excessive > stack/heap allocation. > > Signed-off-by: Rifaldi Hormat <[email protected]> > --- > drivers/net/ethernet/intel/i40e/i40e_debugfs.c | 4 ++++ > 1 file changed, 4 insertions(+)
Tested-by: Alexander Nowlin <[email protected]>
