On Wed, 7 Oct 2026, Muhammad Bilal wrote:

> The store handlers copy the input with kstrdup(), which stops at the
> first NUL, but pass the full write size to
> hp_enforce_single_line_input(). With an embedded NUL the copy is
> shorter than count, so the helper reads, and can write one byte, past
> the allocation.
> 
> Writing "A\0" followed by 4093 bytes of "B" to current_password makes
> memchr() scan 4093 bytes past a 2-byte copy.

Shouldn't that input just return -EINVAL ? Because that's what it is, 
invalid input from user.

> On an HP EliteBook 840 G2
> running Linux 7.2.7 all 100 such writes fail with -EINVAL although the
> input has no newline, so memchr() matched one in the heap. A userspace
> replica of the helper under ASan reports a 4095 byte read, 0 bytes
> after the 2-byte region, and is clean with this change.
> 
> The input is a string, so only scan up to its first NUL.
> 
> Fixes: a34fc329b189 ("platform/x86: hp-bioscfg: bioscfg")
> Cc: stable@vger.kernel.org
> Suggested-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
> Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
> ---
> Changes in v5:
>  drivers/platform/x86/hp/hp-bioscfg/bioscfg.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c b/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c
> index 754ab03bfd7b..84d75926d768 100644
> --- a/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c
> +++ b/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c
> @@ -166,6 +166,8 @@ int hp_enforce_single_line_input(char *buf, size_t count)
>  {
>  	char *p;
>  
> +	/* buf is a string, ignore anything after its first NUL */
> +	count = strnlen(buf, count);
>  	p = memchr(buf, '\n', count);
>  
>  	if (p == buf + count - 1)
> 

-- 
 i.