Re: [PATCH v8] platform/x86: hp-bioscfg: fix heap OOB in hp_enforce_single_line_input()

[Armin Wolf <W_Armin@gmx.de>]

Am 09.11.26 um 20:39 schrieb Ilpo Järvinen:
> On Mon, 26 Oct 2026 10:17:40 +0500, Muhammad Bilal wrote:
> 
>> The input is copied with kstrdup(), which stops at the first NUL, but
>> the full write size is passed to hp_enforce_single_line_input(). With
>> an embedded NUL the helper reads, and can write one byte, past the
>> copy. Use strnchrnul() so the scan stops at the first NUL, and return
>> -EINVAL for a NUL or newline before the last byte.
>>
>> Tested on HP EliteBook 840 G2 (Fedora 44, Linux 7.2.8): writing "A\0"
>> followed by 4093 bytes of "B" to current_password 100 times returns
>> -EINVAL every time, without reading into the heap.
>>
>> [...]
> 
> Thank you for your contribution, it has been applied to my local
> review-ilpo-next branch. Note it will show up in the public
> platform-drivers-x86/review-ilpo-next branch only once I've pushed my
> local branch there, which might take a while.

This commit now causes build errors on for-next because strnchrnul() is 
not exported using EXPORT_SYMBOL().

Thanks,
Armin Wolf

> FYI [if applicable to your patch], as per Linus' policy change, also
> fixes are mostly routed through for-next unless the fix is for a
> commit introduced in the most recent cycle or is clearly a regression
> fix.
> 
> The list of commits applied:
> [1/1] platform/x86: hp-bioscfg: fix heap OOB in hp_enforce_single_line_input()
>        commit: e7cf4282a8694f14eb44a2f110c7628a161e9692
> 
> --
>   i.
> 
>