mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
From: Muhammad Bilal <meatuni001@gmail.com>
To: "Jorge Lopez" <jorge.lopez2@hp.com>,
	"Hans de Goede" <hansg@kernel.org>,
	"Ilpo Järvinen" <ilpo.jarvinen@linux.intel.com>
Cc: "Thomas Weißschuh" <linux@weissschuh.net>,
	platform-driver-x86@vger.kernel.org,
	linux-kernel@vger.kernel.org,
	"Muhammad Bilal" <meatuni001@gmail.com>
Subject: [PATCH] platform/x86: hp-bioscfg: zero the hex-string decode buffer in hp_convert_hexstr_to_str
Date: Wed, 16 Sep 2026 05:46:06 +0500	[thread overview]
Message-ID: <20260916004606.165065-1-meatuni001@gmail.com> (raw)
In-Reply-To: <0380b8d6-cff5-383f-b47f-700d1d17fefa@linux.intel.com>

hp_convert_hexstr_to_str() allocates its output buffer for the
worst-case decoded length, then fills in only as many bytes as the
input actually decodes to before shrinking the allocation down to
that length with krealloc(). Well-formed input can decode to
noticeably fewer bytes than the worst case, so the buffer is
frequently only partially written by the time it is realloc'd and
returned to the caller.

Use kzalloc() instead of kmalloc() for the initial allocation, so
any unused capacity starts out zeroed instead of holding leftover
heap contents, rather than relying on every current and future
caller and code path to fill the buffer exactly.

Suggested-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
---
Applies on top of "platform/x86: hp-bioscfg: fix slab-out-of-bounds
write in hp_convert_hexstr_to_str" (the DIV_ROUND_UP sizing fix),
which Ilpo has applied to review-ilpo-next but is not yet in
mainline. Sent as its own patch rather than a v3 of that one, since
the sizing fix itself was applied as-is; this is the separate change
requested on top of it.
---
 drivers/platform/x86/hp/hp-bioscfg/bioscfg.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c b/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c
index ff28db7..2dab9c0 100644
--- a/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c
+++ b/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c
@@ -442,7 +442,7 @@ int hp_convert_hexstr_to_str(const char *input, u32 input_len, char **str, int *
 	*len = 0;
 	*str = NULL;
 
-	new_str = kmalloc(2 * DIV_ROUND_UP(input_len, 5) + 1, GFP_KERNEL);
+	new_str = kzalloc(2 * DIV_ROUND_UP(input_len, 5) + 1, GFP_KERNEL);
 	if (!new_str)
 		return -ENOMEM;
 
-- 
2.43.0


  reply	other threads:[~2026-09-16  0:46 UTC|newest]

Thread overview: 5+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-09-15 17:46 [PATCH v2] platform/x86: hp-bioscfg: fix slab-out-of-bounds write " Muhammad Bilal
2026-09-15 19:53 ` Ilpo Järvinen
2026-09-16  0:46   ` Muhammad Bilal [this message]
2026-09-16 10:29     ` [PATCH] platform/x86: hp-bioscfg: zero the hex-string decode buffer " Ilpo Järvinen
2026-09-16 10:47       ` Muhammad Bilal

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260916004606.165065-1-meatuni001@gmail.com \
    --to=meatuni001@gmail.com \
    --cc=hansg@kernel.org \
    --cc=ilpo.jarvinen@linux.intel.com \
    --cc=jorge.lopez2@hp.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux@weissschuh.net \
    --cc=platform-driver-x86@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox

all inboxes | Powered by JetHome®