On Fri, 16 Oct 2026, Muhammad Bilal wrote:

> The input is copied with kstrdup(), which stops at the first NUL, but
> the full write size is passed to hp_enforce_single_line_input(). With
> an embedded NUL the helper reads, and can write one byte, past the
> copy. Return -EINVAL if the input contains a NUL.
>  
> Tested on HP EliteBook 840 G2 (Fedora 44, Linux 7.2.8): writing "A\0"
> followed by 4093 bytes of "B" to current_password 100 times returns
> -EINVAL every time, without reading into the heap.
>  
> Fixes: a34fc329b189 ("platform/x86: hp-bioscfg: bioscfg")
> Cc: stable@vger.kernel.org
> Suggested-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
> Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
> ---
> Changes in v6:
>  - Return -EINVAL on embedded NUL instead of limiting the scan (Ilpo)
>  
> v5: https://lore.kernel.org/all/20261007134711.473857-1-meatuni001@gmail.com/
>  
>  drivers/platform/x86/hp/hp-bioscfg/bioscfg.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c b/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c
> index 876fc35d035b..e306bd8b1e72 100644
> --- a/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c
> +++ b/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c
> @@ -162,6 +162,10 @@ int hp_enforce_single_line_input(char *buf, size_t count)
>  {
>  	char *p;
>  
> +	/* buf is a string, so a NUL before count is invalid input */
> +	if (strnlen(buf, count) < count)

Why use n variant?

> +		return -EINVAL;
> +
>  	p = memchr(buf, '\n', count);
>  
>  	if (p == buf + count - 1)
> 
> base-commit: 8667bd30fd033295b3038ce374c551d1059538ba
> 

-- 
 i.