On Wed, 16 Sep 2026, Muhammad Bilal wrote:

> hp_convert_hexstr_to_str() allocates its output buffer for the
> worst-case decoded length, then fills in only as many bytes as the
> input actually decodes to before shrinking the allocation down to
> that length with krealloc(). Well-formed input can decode to
> noticeably fewer bytes than the worst case, so the buffer is
> frequently only partially written by the time it is realloc'd and
> returned to the caller.
> 
> Use kzalloc() instead of kmalloc() for the initial allocation, so
> any unused capacity starts out zeroed instead of holding leftover
> heap contents, rather than relying on every current and future
> caller and code path to fill the buffer exactly.
> 
> Suggested-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
> Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
> ---
> Applies on top of "platform/x86: hp-bioscfg: fix slab-out-of-bounds
> write in hp_convert_hexstr_to_str" (the DIV_ROUND_UP sizing fix),
> which Ilpo has applied to review-ilpo-next but is not yet in
> mainline. Sent as its own patch rather than a v3 of that one, since
> the sizing fix itself was applied as-is; this is the separate change
> requested on top of it.

Thanks, applied to review-ilpo-next.

In future, please try to add parenthesis into function names in the 
shortlog (on Subject line) as well so I don't need to manually add them 
myself.

--
 i.

> ---
>  drivers/platform/x86/hp/hp-bioscfg/bioscfg.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c b/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c
> index ff28db7..2dab9c0 100644
> --- a/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c
> +++ b/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c
> @@ -442,7 +442,7 @@ int hp_convert_hexstr_to_str(const char *input, u32 input_len, char **str, int *
>  	*len = 0;
>  	*str = NULL;
>  
> -	new_str = kmalloc(2 * DIV_ROUND_UP(input_len, 5) + 1, GFP_KERNEL);
> +	new_str = kzalloc(2 * DIV_ROUND_UP(input_len, 5) + 1, GFP_KERNEL);
>  	if (!new_str)
>  		return -ENOMEM;
>  
>