diff options
| author | Yufeng Mo <moyufeng@huawei.com> | 2019-08-09 04:31:10 +0200 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2019-08-09 22:44:32 +0200 |
| commit | 7ac243f99d61f4580a72f62e638ed4e04aa52aa1 (patch) | |
| tree | cc21fc48b5180a8cf6b8bcd8a9b4b6ee56514631 | |
| parent | net: hns3: clean up for vlan handling in hns3_fill_desc_vtags (diff) | |
| download | linux-7ac243f99d61f4580a72f62e638ed4e04aa52aa1.tar.xz linux-7ac243f99d61f4580a72f62e638ed4e04aa52aa1.zip | |
net: hns3: add input length check for debugfs write function
If the input length reaches the maximum value of size_t, the reverse is
triggered when 1 is added. In addition, there is no need to have such a
large length. Therefore, the input length should be checked and the value
should be less than or equal to 1024.
Signed-off-by: Yufeng Mo <moyufeng@huawei.com>
Reviewed-by: Peng Li <lipeng321@huawei.com>
Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c b/drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c index a4b937286f55..7996dcc21cf6 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c +++ b/drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c @@ -8,6 +8,7 @@ #include "hns3_enet.h" #define HNS3_DBG_READ_LEN 256 +#define HNS3_DBG_WRITE_LEN 1024 static struct dentry *hns3_dbgfs_root; @@ -322,6 +323,9 @@ static ssize_t hns3_dbg_cmd_write(struct file *filp, const char __user *buffer, test_bit(HNS3_NIC_STATE_RESETTING, &priv->state)) return 0; + if (count > HNS3_DBG_WRITE_LEN) + return -ENOSPC; + cmd_buf = kzalloc(count + 1, GFP_KERNEL); if (!cmd_buf) return count; |