[Intel-wired-lan] [PATCH net v2] i40e: Limit expression passed to kzalloc() to 1280 bytes

[Tony Nguyen]

On 3/30/2023 3:37 AM, Aleksandr Loktionov wrote:

Why the multiple sends?
2023-03-30 10:37 UTC - [PATCH net v2] i40e: Limit expression passed to 
kzalloc() to 1280 bytes [1]
2023-03-30 11:17 UTC - [PATCH net v2] i40e: Limit expression passed to 
kzalloc() to 1280 bytes [2]
2023-03-30 11:20 UTC - [PATCH net v2] i40e: Limit expression passed to 
kzalloc() to 1280 bytes [3]

> Add buff_size limit of 1280 bytes as big enough for user input value.
> 
> Fixes: f1143c4b0f60 ("i40e: Expose AQ debugfs hooks")
> Signed-off-by: Aleksandr Loktionov <aleksandr.loktionov at intel.com>
> ---

Please include a changelog for new revisions.

>   drivers/net/ethernet/intel/i40e/i40e_debugfs.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/net/ethernet/intel/i40e/i40e_debugfs.c b/drivers/net/ethernet/intel/i40e/i40e_debugfs.c
> index c9dcd6d..b10d00d 100644
> --- a/drivers/net/ethernet/intel/i40e/i40e_debugfs.c
> +++ b/drivers/net/ethernet/intel/i40e/i40e_debugfs.c
> @@ -1356,7 +1356,7 @@ static ssize_t i40e_dbg_command_write(struct file *filp,
>   			goto command_write_done;
>   		}
>   		/* Just stub a buffer big enough in case user messed up */
> -		if (buffer_len == 0)
> +		if (buffer_len == 0 || buffer_len > 1280)

Based on Paul's question, it may be nice to add a comment here to 
explain the 1280 size; "big enough for user input value" doesn't really 
explain how we ended up at 1280.

Thanks,
Tony

>   			buffer_len = 1280; >
>   		buff = kzalloc(buffer_len, GFP_KERNEL);

[1] 
https://lore.kernel.org/intel-wired-lan/20230330103749.3759357-1-aleksandr.loktionov@intel.com/
[2] 
https://lore.kernel.org/intel-wired-lan/20230330111746.3809394-1-aleksandr.loktionov@intel.com/
[3] 
https://lore.kernel.org/intel-wired-lan/20230330112045.3811315-1-aleksandr.loktionov@intel.com/