[PATCH] i40e: fix integer overflow in i40e_dbg_command_write()

[rivaldihormat-debug]

The i40e_dbg_command_write() function uses 'count' from user space
in kzalloc(count + 1) without validation. If count = 0xFFFFFFFF,
integer overflow occurs.

An attacker or local user could trigger a buffer overflow or integer
overflow by writing large amounts of data to the debugfs file.

Fix by adding validation:
if (count == 0 || count > PAGE_SIZE) return -EINVAL.

PAGE_SIZE is chosen as a common limit for debugfs writes to prevent
excessive stack/heap allocation.

Signed-off-by: Rifaldi Hormat <rivaldihormat@xxxxxxxxx>
---
 drivers/net/ethernet/intel/i40e/i40e_debugfs.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/net/ethernet/intel/i40e/i40e_debugfs.c b/drivers/net/ethernet/intel/i40e/i40e_debugfs.c
index 0b52509cb14c..74e75504fdda 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_debugfs.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_debugfs.c
@@ -722,6 +722,8 @@ static ssize_t i40e_dbg_command_write(struct file *filp,
 	int cnt;
 
 	/* don't allow partial writes */
+	if (count == 0 || count > PAGE_SIZE)
+		return -EINVAL;
 	if (*ppos != 0)
 		return 0;
 
@@ -1605,6 +1607,8 @@ static ssize_t i40e_dbg_netdev_ops_write(struct file *filp,
 	int i, cnt;
 
 	/* don't allow partial writes */
+	if (count == 0 || count > PAGE_SIZE)
+		return -EINVAL;
 	if (*ppos != 0)
 		return 0;
 
-- 
2.53.0