Re: [PATCH v8] platform/x86: hp-bioscfg: fix heap OOB in hp_enforce_single_line_input()

[Armin Wolf]

Am 09.11.26 um 20:39 schrieb Ilpo Järvinen:
> On Mon, 26 Oct 2026 10:17:40 +0500, Muhammad Bilal wrote:
>
> > The input is copied with kstrdup(), which stops at the first NUL, but
> > the full write size is passed to hp_enforce_single_line_input(). With
> > an embedded NUL the helper reads, and can write one byte, past the
> > copy. Use strnchrnul() so the scan stops at the first NUL, and return
> > -EINVAL for a NUL or newline before the last byte.
> >
> > Tested on HP EliteBook 840 G2 (Fedora 44, Linux 7.2.8): writing "A\0"
> > followed by 4093 bytes of "B" to current_password 100 times returns
> > -EINVAL every time, without reading into the heap.
> >
> > [...]
>
> Thank you for your contribution, it has been applied to my local
> review-ilpo-next branch. Note it will show up in the public
> platform-drivers-x86/review-ilpo-next branch only once I've pushed my
> local branch there, which might take a while.

This commit now causes build errors on for-next because strnchrnul() is 
not exported using EXPORT_SYMBOL().

Thanks,
Armin Wolf

> FYI [if applicable to your patch], as per Linus' policy change, also
> fixes are mostly routed through for-next unless the fix is for a
> commit introduced in the most recent cycle or is clearly a regression
> fix.
>
> The list of commits applied:
> [1/1] platform/x86: hp-bioscfg: fix heap OOB in hp_enforce_single_line_input()
>        commit: e7cf4282a8694f14eb44a2f110c7628a161e9692
>
> --
>   i.