RE: [PATCH] i40e: fix integer overflow in i40e_dbg_command_write()

[Loktionov, Aleksandr]

> -----Original Message-----
> From: rivaldihormat-debug <rivaldihormat@xxxxxxxxx>
> Sent: Saturday, September 5, 2026 6:32 PM
> To: intel-wired-lan@xxxxxxxxxxxxxxxx
> Cc: linux-kernel@xxxxxxxxxxxxxxx; Rifaldi Hormat
> <rivaldihormat@xxxxxxxxx>
> Subject: [PATCH] i40e: fix integer overflow in
> i40e_dbg_command_write()
> 
> From: Rifaldi Hormat <rivaldihormat@xxxxxxxxx>
> 

Dear Rifaldi,

Thank you for the patch to fix the integer overflow in i40e_dbg_command_write().
The fix is sensible. However, please ensure your commit message clearly states:

- The bug: An attacker or local user could trigger a buffer overflow or integer overflow by writing large amounts of data to the debugfs file.
- The fix: Limiting the write size to PAGE_SIZE.
- Why PAGE_SIZE: It is a common limit for debugfs writes to prevent excessive stack/heap allocation.

With the best regards
Alex

> Signed-off-by: Rifaldi Hormat <rivaldihormat@xxxxxxxxx>
> ---
>  drivers/net/ethernet/intel/i40e/i40e_debugfs.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/drivers/net/ethernet/intel/i40e/i40e_debugfs.c
> b/drivers/net/ethernet/intel/i40e/i40e_debugfs.c
> index 0b52509cb14c..74e75504fdda 100644
> --- a/drivers/net/ethernet/intel/i40e/i40e_debugfs.c
> +++ b/drivers/net/ethernet/intel/i40e/i40e_debugfs.c
> @@ -722,6 +722,8 @@ static ssize_t i40e_dbg_command_write(struct file
> *filp,
>  	int cnt;
> 
>  	/* don't allow partial writes */
> +	if (count == 0 || count > PAGE_SIZE)
> +		return -EINVAL;
>  	if (*ppos != 0)
>  		return 0;
> 
> @@ -1605,6 +1607,8 @@ static ssize_t i40e_dbg_netdev_ops_write(struct
> file *filp,
>  	int i, cnt;
> 
>  	/* don't allow partial writes */
> +	if (count == 0 || count > PAGE_SIZE)
> +		return -EINVAL;
>  	if (*ppos != 0)
>  		return 0;
> 
> --
> 2.53.0