RE: [PATCH] i40e: fix integer overflow in i40e_dbg_command_write()

[Nowlin, Alexander]

> -----Original Message-----
> From: rivaldihormat-debug <rivaldihormat@xxxxxxxxx> 
> Sent: Tuesday, September 8, 2026 8:40 AM
> To: intel-wired-lan@xxxxxxxxxxxxxxxx
> Cc: linux-kernel@xxxxxxxxxxxxxxx; Loktionov, Aleksandr <aleksandr.loktionov@xxxxxxxxx>; rivaldihormat-debug <rivaldihormat@xxxxxxxxx>
> Subject: [PATCH] i40e: fix integer overflow in i40e_dbg_command_write()
> 
> The i40e_dbg_command_write() function uses 'count' from user space in kzalloc(count + 1) without validation. If count = 0xFFFFFFFF, integer overflow occurs.
> 
> An attacker or local user could trigger a buffer overflow or integer overflow by writing large amounts of data to the debugfs file.
> 
> Fix by adding validation:
> if (count == 0 || count > PAGE_SIZE) return -EINVAL.
> 
> PAGE_SIZE is chosen as a common limit for debugfs writes to prevent excessive stack/heap allocation.
> 
> Signed-off-by: Rifaldi Hormat <rivaldihormat@xxxxxxxxx>
> ---
>  drivers/net/ethernet/intel/i40e/i40e_debugfs.c | 4 ++++
>  1 file changed, 4 insertions(+)

Tested-by: Alexander Nowlin <alexander.nowlin@xxxxxxxxx>