From 7ac243f99d61f4580a72f62e638ed4e04aa52aa1 Mon Sep 17 00:00:00 2001 From: Yufeng Mo Date: Fri, 9 Aug 2019 10:31:10 +0800 Subject: [PATCH] net: hns3: add input length check for debugfs write function If the input length reaches the maximum value of size_t, the reverse is triggered when 1 is added. In addition, there is no need to have such a large length. Therefore, the input length should be checked and the value should be less than or equal to 1024. Signed-off-by: Yufeng Mo Reviewed-by: Peng Li Signed-off-by: Huazhong Tan Signed-off-by: David S. Miller --- drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c b/drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c index a4b9372..7996dcc 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c +++ b/drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c @@ -8,6 +8,7 @@ #include "hns3_enet.h" #define HNS3_DBG_READ_LEN 256 +#define HNS3_DBG_WRITE_LEN 1024 static struct dentry *hns3_dbgfs_root; @@ -322,6 +323,9 @@ static ssize_t hns3_dbg_cmd_write(struct file *filp, const char __user *buffer, test_bit(HNS3_NIC_STATE_RESETTING, &priv->state)) return 0; + if (count > HNS3_DBG_WRITE_LEN) + return -ENOSPC; + cmd_buf = kzalloc(count + 1, GFP_KERNEL); if (!cmd_buf) return count; -- 2.7.4