linux

mirror of https://github.com/torvalds/linux.git synced 2026-07-30 11:11:26 +02:00

Linux kernel source tree

Go to file

Jacob Keller 9fcdb1c3c4 i40e: remove read access to debugfs files The 'command' and 'netdev_ops' debugfs files are a legacy debugging interface supported by the i40e driver since its early days by commit `02e9c29081` ("i40e: debugfs interface"). Both of these debugfs files provide a read handler which is mostly useless, and which is implemented with questionable logic. They both use a static 256 byte buffer which is initialized to the empty string. In the case of the 'command' file this buffer is literally never used and simply wastes space. In the case of the 'netdev_ops' file, the last command written is saved here. On read, the files contents are presented as the name of the device followed by a colon and then the contents of their respective static buffer. For 'command' this will always be "<device>: ". For 'netdev_ops', this will be "<device>: <last command written>". But note the buffer is shared between all devices operated by this module. At best, it is mostly meaningless information, and at worse it could be accessed simultaneously as there doesn't appear to be any locking mechanism. We have also recently received multiple reports for both read functions about their use of snprintf and potential overflow that could result in reading arbitrary kernel memory. For the 'command' file, this is definitely impossible, since the static buffer is always zero and never written to. For the 'netdev_ops' file, it does appear to be possible, if the user carefully crafts the command input, it will be copied into the buffer, which could be large enough to cause snprintf to truncate, which then causes the copy_to_user to read beyond the length of the buffer allocated by kzalloc. A minimal fix would be to replace snprintf() with scnprintf() which would cap the return to the number of bytes written, preventing an overflow. A more involved fix would be to drop the mostly useless static buffers, saving 512 bytes and modifying the read functions to stop needing those as input. Instead, lets just completely drop the read access to these files. These are debug interfaces exposed as part of debugfs, and I don't believe that dropping read access will break any script, as the provided output is pretty useless. You can find the netdev name through other more standard interfaces, and the 'netdev_ops' interface can easily result in garbage if you issue simultaneous writes to multiple devices at once. In order to properly remove the i40e_dbg_netdev_ops_buf, we need to refactor its write function to avoid using the static buffer. Instead, use the same logic as the i40e_dbg_command_write, with an allocated buffer. Update the code to use this instead of the static buffer, and ensure we free the buffer on exit. This fixes simultaneous writes to 'netdev_ops' on multiple devices, and allows us to remove the now unused static buffer along with removing the read access. Fixes: `02e9c29081` ("i40e: debugfs interface") Reported-by: Kunwu Chan <chentao@kylinos.cn> Closes: https://lore.kernel.org/intel-wired-lan/20231208031950.47410-1-chentao@kylinos.cn/ Reported-by: Wang Haoran <haoranwangsec@gmail.com> Closes: https://lore.kernel.org/all/CANZ3JQRRiOdtfQJoP9QM=6LS1Jto8PGBGw6y7-TL=BcnzHQn1Q@mail.gmail.com/ Reported-by: Amir Mohammad Jahangirzad <a.jahangirzad@gmail.com> Closes: https://lore.kernel.org/all/20250722115017.206969-1-a.jahangirzad@gmail.com/ Signed-off-by: Jacob Keller <jacob.e.keller@intel.com> Reviewed-by: Dawid Osuchowski <dawid.osuchowski@linux.intel.com> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Reviewed-by: Simon Horman <horms@kernel.org> Reviewed-by: Kunwu Chan <kunwu.chan@linux.dev> Tested-by: Rinitha S <sx.rinitha@intel.com> (A Contingent worker at Intel) Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>		2025-09-02 11:05:51 -07:00
arch	powerpc fixes for 6.17 #3	2025-08-28 15:39:06 -07:00
block	block: avoid cpu_hotplug_lock depedency on freeze_lock	2025-08-21 07:11:11 -06:00
certs	sign-file,extract-cert: use pkcs11 provider for OPENSSL MAJOR >= 3	2024-09-20 19:52:48 +03:00
crypto	Significant patch series in this pull request:	2025-08-03 16:23:09 -07:00
Documentation	docs: remove obsolete description about threaded NAPI	2025-09-01 13:09:08 -07:00
drivers	i40e: remove read access to debugfs files	2025-09-02 11:05:51 -07:00
fs	Driver core fixes for 6.16-rc3	2025-08-23 09:04:32 -04:00
include	Including fixes from Bluetooth.	2025-08-28 17:35:51 -07:00
init	Significant patch series in this pull request:	2025-08-03 16:23:09 -07:00
io_uring	io_uring: clear ->async_data as part of normal init	2025-08-21 13:54:01 -06:00
ipc	vfs-6.17-rc1.mmap_prepare	2025-07-28 13:43:25 -07:00
kernel	dma-mapping fixes for Linux 6.17	2025-08-28 16:04:14 -07:00
lib	Crypto library fixes for v6.17-rc3	2025-08-21 04:54:01 -07:00
LICENSES	LICENSES: Replace the obsolete address of the FSF in the GFDL-1.2	2025-07-24 11:15:39 +02:00
mm	memblock fixes for v6.17-rc4	2025-08-28 15:46:06 -07:00
net	net: mctp: mctp_fraq_queue should take ownership of passed skb	2025-09-02 14:45:51 +02:00
rust	Driver core fixes for 6.16-rc3	2025-08-23 09:04:32 -04:00
samples	Significant patch series in this pull request:	2025-08-03 16:23:09 -07:00
scripts	Kbuild updates for v6.17	2025-08-06 07:32:52 +03:00
security	+ Features	2025-08-04 08:17:28 -07:00
sound	ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation	2025-08-21 17:10:14 +02:00
tools	selftests: drv-net: csum: fix interface name for remote host	2025-09-01 12:43:10 -07:00
usr	usr/include: openrisc: don't HDRTEST bpf_perf_event.h	2025-05-12 15:03:17 +09:00
virt	Merge tag 'kvm-x86-no_assignment-6.17' of https://github.com/kvm-x86/linux into HEAD	2025-07-29 08:36:42 -04:00
.clang-format	Linux 6.15-rc5	2025-05-06 16:39:25 +10:00
.clippy.toml	rust: clean Rust 1.88.0's warning about `clippy::disallowed_macros` configuration	2025-05-07 00:11:47 +02:00
.cocciconfig
.editorconfig	.editorconfig: remove trim_trailing_whitespace option	2024-06-13 16:47:52 +02:00
.get_maintainer.ignore	MAINTAINERS: Retire Ralf Baechle	2024-11-12 15:48:59 +01:00
.gitattributes
.gitignore	gitignore: allow .pylintrc to be tracked	2025-07-02 17:10:04 -06:00
.mailmap	.mailmap: add entry for Easwar Hariharan	2025-08-19 16:35:55 -07:00
.pylintrc	docs: add a .pylintrc file with sys path for docs scripts	2025-04-09 12:10:33 -06:00
.rustfmt.toml
COPYING
CREDITS	MAINTAINERS: retire Boris from TLS maintainers	2025-08-26 17:36:01 -07:00
Kbuild	drm: ensure drm headers are self-contained and pass kernel-doc	2025-02-12 10:44:43 +02:00
Kconfig	io_uring: Rename KConfig to Kconfig	2025-02-19 14:53:27 -07:00
MAINTAINERS	Including fixes from Bluetooth.	2025-08-28 17:35:51 -07:00
Makefile	Linux 6.17-rc3	2025-08-24 12:04:12 -04:00
README	README: Fix spelling	2024-03-18 03:36:32 -06:00

README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the reStructuredText markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.