Messages in this thread Patch in this message | | | From | Huazhong Tan <> | Subject | [PATCH net-next 04/12] net: hns3: add input length check for debugfs write function | Date | Fri, 9 Aug 2019 10:31:10 +0800 |
| |
From: Yufeng Mo <moyufeng@huawei.com>
If the input length reaches the maximum value of size_t, the reverse is triggered when 1 is added. In addition, there is no need to have such a large length. Therefore, the input length should be checked and the value should be less than or equal to 1024.
Signed-off-by: Yufeng Mo <moyufeng@huawei.com> Reviewed-by: Peng Li <lipeng321@huawei.com> Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com> --- drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c | 4 ++++ 1 file changed, 4 insertions(+)
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c b/drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c index a4b9372..7996dcc 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c +++ b/drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c @@ -8,6 +8,7 @@ #include "hns3_enet.h" #define HNS3_DBG_READ_LEN 256 +#define HNS3_DBG_WRITE_LEN 1024 static struct dentry *hns3_dbgfs_root; @@ -322,6 +323,9 @@ static ssize_t hns3_dbg_cmd_write(struct file *filp, const char __user *buffer, test_bit(HNS3_NIC_STATE_RESETTING, &priv->state)) return 0; + if (count > HNS3_DBG_WRITE_LEN) + return -ENOSPC; + cmd_buf = kzalloc(count + 1, GFP_KERNEL); if (!cmd_buf) return count; -- 2.7.4
| |