Re: [PATCH] platform/x86: hp-bioscfg: fix slab-out-of-bounds write in hp_convert_hexstr_to_str

["Ilpo Järvinen" <ilpo.jarvinen@linux.intel.com>]

On Sun, 2 Aug 2026, Muhammad Bilal wrote:

> hp_convert_hexstr_to_str() sizes its output buffer using the raw
> hex-encoded input length, but the decoded string written into it can
> need up to two bytes of output per five bytes of input when escaping
> '\\', '\r', '\n', or '\t', plus one more byte for the NUL terminator
> written unconditionally after the decode loop. For a short encoded
> value the decoded length plus terminator can reach or exceed the
> allocated size, causing an out-of-bounds slab write.

Please try to improve the wording so that I don't have to figure the 
input and output formats from the code.

Does the input format contain leading 0x "0x09 0x.." which is decoded to 
"\t..." as that is the only way I can make the 5 -> 2 relation make sense?

I suppose you could add an example input and the resulting output. ...That 
might be enough.

> KASAN caught a one-byte overflow during BIOS attribute enumeration
> on boot, triggered by a one-byte encoded input value:
> 
> BUG: KASAN: slab-out-of-bounds in hp_convert_hexstr_to_str+0x6d8/0x710 [hp_bioscfg]
> Write of size 1 at addr ffff8881032e5d81 by task (udev-worker)/520
> The buggy address is located 0 bytes to the right of
> allocated 1-byte region [ffff8881032e5d80, ffff8881032e5d81)
> 
> Size the allocation to the worst-case decoded length, two bytes per
> five-byte input chunk, plus the terminator, instead of the raw input
> length.
> 
> Fixes: a34fc329b189 ("platform/x86: hp-bioscfg: bioscfg")
> Cc: stable@vger.kernel.org
> Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
> ---
>  drivers/platform/x86/hp/hp-bioscfg/bioscfg.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c b/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c
> --- a/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c
> +++ b/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c
> @@ -442,7 +442,7 @@ int hp_convert_hexstr_to_str(const char *input, u32 input_len, char **str, int *len)
>  	*len = 0;
>  	*str = NULL;
>  
> -	new_str = kmalloc(input_len, GFP_KERNEL);
> +	new_str = kmalloc(2 * DIV_ROUND_UP(input_len, 5) + 1, GFP_KERNEL);
>  	if (!new_str)
>  		return -ENOMEM;
>  
> 

-- 
 i.