[PATCH] platform/x86: hp-bioscfg: fix slab-out-of-bounds write in hp_convert_hexstr_to_str

[PATCH] platform/x86: hp-bioscfg: fix slab-out-of-bounds write in hp_convert_hexstr_to_str

[Muhammad Bilal]

hp_convert_hexstr_to_str() sizes its output buffer using the raw
hex-encoded input length, but the decoded string written into it can
need up to two bytes of output per five bytes of input when escaping
'\\', '\r', '\n', or '\t', plus one more byte for the NUL terminator
written unconditionally after the decode loop. For a short encoded
value the decoded length plus terminator can reach or exceed the
allocated size, causing an out-of-bounds slab write.

KASAN caught a one-byte overflow during BIOS attribute enumeration
on boot, triggered by a one-byte encoded input value:

BUG: KASAN: slab-out-of-bounds in hp_convert_hexstr_to_str+0x6d8/0x710 [hp_bioscfg]
Write of size 1 at addr ffff8881032e5d81 by task (udev-worker)/520
The buggy address is located 0 bytes to the right of
allocated 1-byte region [ffff8881032e5d80, ffff8881032e5d81)

Size the allocation to the worst-case decoded length, two bytes per
five-byte input chunk, plus the terminator, instead of the raw input
length.

Fixes: a34fc329b189 ("platform/x86: hp-bioscfg: bioscfg")
Cc: stable@vger.kernel.org
Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
---
 drivers/platform/x86/hp/hp-bioscfg/bioscfg.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c b/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c
--- a/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c
+++ b/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c
@@ -442,7 +442,7 @@ int hp_convert_hexstr_to_str(const char *input, u32 input_len, char **str, int *len)
 	*len = 0;
 	*str = NULL;
 
-	new_str = kmalloc(input_len, GFP_KERNEL);
+	new_str = kmalloc(2 * DIV_ROUND_UP(input_len, 5) + 1, GFP_KERNEL);
 	if (!new_str)
 		return -ENOMEM;
 

Re: [PATCH] platform/x86: hp-bioscfg: fix slab-out-of-bounds write in hp_convert_hexstr_to_str

[Ilpo Järvinen]

On Sun, 2 Aug 2026, Muhammad Bilal wrote:

> hp_convert_hexstr_to_str() sizes its output buffer using the raw
> hex-encoded input length, but the decoded string written into it can
> need up to two bytes of output per five bytes of input when escaping
> '\\', '\r', '\n', or '\t', plus one more byte for the NUL terminator
> written unconditionally after the decode loop. For a short encoded
> value the decoded length plus terminator can reach or exceed the
> allocated size, causing an out-of-bounds slab write.

Please try to improve the wording so that I don't have to figure the 
input and output formats from the code.

Does the input format contain leading 0x "0x09 0x.." which is decoded to 
"\t..." as that is the only way I can make the 5 -> 2 relation make sense?

I suppose you could add an example input and the resulting output. ...That 
might be enough.

> KASAN caught a one-byte overflow during BIOS attribute enumeration
> on boot, triggered by a one-byte encoded input value:
> 
> BUG: KASAN: slab-out-of-bounds in hp_convert_hexstr_to_str+0x6d8/0x710 [hp_bioscfg]
> Write of size 1 at addr ffff8881032e5d81 by task (udev-worker)/520
> The buggy address is located 0 bytes to the right of
> allocated 1-byte region [ffff8881032e5d80, ffff8881032e5d81)
> 
> Size the allocation to the worst-case decoded length, two bytes per
> five-byte input chunk, plus the terminator, instead of the raw input
> length.
> 
> Fixes: a34fc329b189 ("platform/x86: hp-bioscfg: bioscfg")
> Cc: stable@vger.kernel.org
> Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
> ---
>  drivers/platform/x86/hp/hp-bioscfg/bioscfg.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c b/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c
> --- a/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c
> +++ b/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c
> @@ -442,7 +442,7 @@ int hp_convert_hexstr_to_str(const char *input, u32 input_len, char **str, int *len)
>  	*len = 0;
>  	*str = NULL;
>  
> -	new_str = kmalloc(input_len, GFP_KERNEL);
> +	new_str = kmalloc(2 * DIV_ROUND_UP(input_len, 5) + 1, GFP_KERNEL);
>  	if (!new_str)
>  		return -ENOMEM;
>  
> 

-- 
 i.