Re: [PATCH v4 7/9] platform/x86: hp-bioscfg: validate SPM state returned by firmware

["Ilpo Järvinen" <ilpo.jarvinen@linux.intel.com>]

On Sat, 3 Oct 2026, Muhammad Bilal wrote:

> status_show() and update_spm_state() use the state byte from firmware
> to index 3-entry string arrays without a range check. A value above 2
> indexes past the arrays, and the result is printed with %s by the
> world-readable status and key_mechanism files.
> 
> For example, a state of 3 makes status treat whatever follows
> spm_state_types[] as a string pointer.
> 
> Return -EIO for an out of range state.
> 
> Compile tested only.
> 
> Fixes: b2715aa2e135 ("platform/x86: hp-bioscfg: spmobj-attributes")
> Cc: stable@vger.kernel.org
> Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
> ---
> Changes in v4:
>  - New patch
> 
>  drivers/platform/x86/hp/hp-bioscfg/spmobj-attributes.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/drivers/platform/x86/hp/hp-bioscfg/spmobj-attributes.c b/drivers/platform/x86/hp/hp-bioscfg/spmobj-attributes.c
> index 4d94e48c1..f0eb5c445 100644
> --- a/drivers/platform/x86/hp/hp-bioscfg/spmobj-attributes.c
> +++ b/drivers/platform/x86/hp/hp-bioscfg/spmobj-attributes.c
> @@ -118,6 +118,9 @@ static ssize_t update_spm_state(void)
>  	if (ret < 0)
>  		return ret;
>  
> +	if (data.state >= ARRAY_SIZE(spm_mechanism_types))

Please add the include for this (to the .c file, I know it includes 
bioscfg.h as is but common include handing all includes for a multi-file 
driver is undesirable practice).

> +		return -EIO;
> +
>  	bioscfg_drv.spm_data.mechanism = data.state;
>  	if (bioscfg_drv.spm_data.mechanism)
>  		bioscfg_drv.spm_data.is_enabled = 1;
> @@ -153,6 +156,9 @@ static ssize_t status_show(struct kobject *kobj, struct kobj_attribute
>  	if (ret < 0)
>  		return ret;
>  
> +	if (data.state >= ARRAY_SIZE(spm_state_types))
> +		return -EIO;
> +
>  	/*
>  	 * 'status' is a read-only file that returns ASCII text in
>  	 * JSON format reporting the status information.
> 

-- 
 i.