From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f49.google.com (mail-wm1-f49.google.com [209.85.128.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D06832773DE for ; Sun, 2 Aug 2026 01:09:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.49 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785632979; cv=none; b=TBPMNl2T3oCoEZ+WTweCPvcqbOcPf9UHHV4RuE+WVFmL83DiKkEFGJt86vTA7HfCDUhDhCyaj9tdVco6P3da0heJ1A9mucJ0JBviPo61X6+8gdMC3OaNtg67tPa87FPKRoDUPKNIVFVz98eTslfKuyN6J1yicWrwwYhJdNc1aQQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785632979; c=relaxed/simple; bh=XGVeqwLGG9Yi8rlWz0MjL6XX5o9AEpbMfH8iIsKVna4=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=V1DfGt//WFZn5CL1lVYPmn1UEP945J2DFitR6jFM29mWJw6mmLth1kJ1IHdw2O1O3B3iLooImgIl7PO2HbYU+ZWTBalwZzCu0nyXxM+Ci7/WnggnuMopVwuPekVZ8SfrH9LTydbKTV8sEHTyGeMuTnrbhmEaiENl85xupT9UfNI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=HCSoRAQU; arc=none smtp.client-ip=209.85.128.49 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="HCSoRAQU" Received: by mail-wm1-f49.google.com with SMTP id 5b1f17b1804b1-49553515a8bso15710045e9.1 for ; Sat, 01 Aug 2026 18:09:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1785632975; x=1786237775; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=mTIJMZeV8CmN/ypHsLJVAdwnkDUycpvxjXJ8wexL9fw=; b=HCSoRAQUeaPbKb0VlD1T3NTlTAS0nRqL06gX+y9vSG6yO1CPnHiCwgGRdYOS29/YSc P8M8M/NanWx+z4opl5BbyRGFBb0UUY1t31apQGO//74Q96/23S9MAkojqhKMbseGesfS bBg4uKNG2CR29McSnH/kdJYA8EnWOXrzOIXPHoWK8MgqGLtMfd44AT2EeqDkWmbF562/ H1TWjXbbWwtXwcd4iOttG76rfXLOsWHo7Ii6gqfkJQy70jWRsV7Py5d84kJFXmwWZ44X UXOQN65bCvH+lNugt3gmpZSCJ8SqLQ0C/hG8Ks/moH2oJaEBG/tQDTY0xKEqTTwJIUo+ EJYA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785632975; x=1786237775; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=mTIJMZeV8CmN/ypHsLJVAdwnkDUycpvxjXJ8wexL9fw=; b=NRSWlUbBxR/iF1fWAgKOtdCLgMtyiNHVB4txv5KjTNnGm4YPZLEiGRfJqjxtyYOyCw UqkCqDUafi0kgwUqS0HEV6WQii2fMiWO3f/Qh892KQc+lxpEgNmeyn0ZEnmdviwYQW8k ByS9ak0yXyk/H/Q0oC8aE2+FqxynCVxGJFLKjNScO8+gFj3Dr5QqBbClZw3BCy07hf3Q nG+jLYQAC2pn9mrZWnmd0eKsm8NnCOOGf0DosIouK49iHugO3Eq2dloXmvZ13RaYCAEO 6cmux+LEX3EWc5iYXrYD5haex9sHGmq+SMC7+ysd5MLVojK8dYz6UdVMTUmJz1EaFzBT ANnQ== X-Forwarded-Encrypted: i=1; AHgh+RqaurvGWW7YDb6iQsxoC8u0dIGfHq9dfsMIru5YogtkRnJCTaf9r5eBSotob7xya327g3UINgUpq06q9Bg=@vger.kernel.org X-Gm-Message-State: AOJu0YznBOwtpCtcpgsJ7EX00NfqFl/4MJF1dPaB9UlnzY+t9Te09pjV V5Y/Tlcdr6tvpK1ngSo0d2rns7pO9xwxX6SjNN7csO2aHfR7nrXREmEt X-Gm-Gg: AR+sD11Xuq7agHb0KcwfA+xP/1ADIyo6/9dZA1/vB/8uMkx8+O9fSw7tveUA/JpUWam gRw35EhPxLqRsEO5lNjQ6RlHPrrhV4nYpR7TpNRvrZP7jmYZ7Ukr9qmwFrHrglvoDOTCBNAJhXb 80yz7AK71r2Ae7nqmDWH+nJMATeGlNWJFJ8aH0Zuy27r8/rn8GH7s/8wE5A3naQv+iGqRKpCdPL P8FGNI6ghHGRpSGVepUO3MDnSy+npY7JaWidwqJmT2MtsbvubVtQ8/zXFBi7oYIojysmmlg/7xn k8aWWT6KZExVcnWjHVu6WmABPBRe1/tdbziJYyI0tuWASpXtjFyLxSegGg+IdM6dejbRT0tsNDR tokYgyJe344J+73HpRE+DbhVuVtbgiI7PhcUlolWVT2/gJ+fRRrzcbzBOhnJH1hMCskFRZvdW8l xrWDlwged5TjoxVh5d52l5BVZSQIaGM49Vitdar6ezGp9bD/87IUzJTrg3GumchHltr1UmANmww HmQ3r2mzZaSAKzbd1M02IBliH7Zd3Qy3UBSvXL9Sg== X-Received: by 2002:a05:6000:25f3:b0:46e:1815:6a83 with SMTP id ffacd0b85a97d-47fd72f1666mr11652820f8f.29.1785632974413; Sat, 01 Aug 2026 18:09:34 -0700 (PDT) Received: from fedora ([202.47.63.86]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-47fd458b73asm17531468f8f.29.2026.08.01.18.09.32 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 01 Aug 2026 18:09:34 -0700 (PDT) From: Muhammad Bilal To: Jorge Lopez , Hans de Goede Cc: =?UTF-8?q?Ilpo=20J=C3=A4rvinen?= , =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= , platform-driver-x86@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, Muhammad Bilal Subject: [PATCH] platform/x86: hp-bioscfg: fix slab-out-of-bounds write in hp_convert_hexstr_to_str Date: Sun, 2 Aug 2026 06:09:21 +0500 Message-ID: <20260802010921.7487-1-meatuni001@gmail.com> X-Mailer: git-send-email 2.55.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit hp_convert_hexstr_to_str() sizes its output buffer using the raw hex-encoded input length, but the decoded string written into it can need up to two bytes of output per five bytes of input when escaping '\\', '\r', '\n', or '\t', plus one more byte for the NUL terminator written unconditionally after the decode loop. For a short encoded value the decoded length plus terminator can reach or exceed the allocated size, causing an out-of-bounds slab write. KASAN caught a one-byte overflow during BIOS attribute enumeration on boot, triggered by a one-byte encoded input value: BUG: KASAN: slab-out-of-bounds in hp_convert_hexstr_to_str+0x6d8/0x710 [hp_bioscfg] Write of size 1 at addr ffff8881032e5d81 by task (udev-worker)/520 The buggy address is located 0 bytes to the right of allocated 1-byte region [ffff8881032e5d80, ffff8881032e5d81) Size the allocation to the worst-case decoded length, two bytes per five-byte input chunk, plus the terminator, instead of the raw input length. Fixes: a34fc329b189 ("platform/x86: hp-bioscfg: bioscfg") Cc: stable@vger.kernel.org Signed-off-by: Muhammad Bilal --- drivers/platform/x86/hp/hp-bioscfg/bioscfg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c b/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c --- a/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c +++ b/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c @@ -442,7 +442,7 @@ int hp_convert_hexstr_to_str(const char *input, u32 input_len, char **str, int *len) *len = 0; *str = NULL; - new_str = kmalloc(input_len, GFP_KERNEL); + new_str = kmalloc(2 * DIV_ROUND_UP(input_len, 5) + 1, GFP_KERNEL); if (!new_str) return -ENOMEM;