The input is copied with kstrdup(), which stops at the first NUL, but the full write size is passed to hp_enforce_single_line_input(). With an embedded NUL the helper reads, and can write one byte, past the copy. Use strnchrnul() so the scan stops at the first NUL, and return -EINVAL for a NUL or newline before the last byte. Tested on HP EliteBook 840 G2 (Fedora 44, Linux 7.2.8): writing "A\0" followed by 4093 bytes of "B" to current_password 100 times returns -EINVAL every time, without reading into the heap. Fixes: a34fc329b189 ("platform/x86: hp-bioscfg: bioscfg") Cc: stable@vger.kernel.org Suggested-by: Ilpo Järvinen Suggested-by: Andy Shevchenko Signed-off-by: Muhammad Bilal --- Changes in v8: - Restore the comments dropped in v7 (Andy) Changes in v7: - Use strnchrnul() instead of a separate NUL check (Andy) - Drop the trailing comments Changes in v6: - Return -EINVAL on embedded NUL instead of limiting the scan (Ilpo) Changes in v5: - Limit the scan to the string instead of copying the input past its first NUL (Ilpo) v7: https://lore.kernel.org/all/20261024172641.19424-1-meatuni001@gmail.com/ v6: https://lore.kernel.org/all/20261016025352.230535-1-meatuni001@gmail.com/ v5: https://lore.kernel.org/all/20261007134711.473857-1-meatuni001@gmail.com/ drivers/platform/x86/hp/hp-bioscfg/bioscfg.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c b/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c index 876fc35d035b..435639e19c59 100644 --- a/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c +++ b/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c @@ -162,11 +162,11 @@ int hp_enforce_single_line_input(char *buf, size_t count) { char *p; - p = memchr(buf, '\n', count); + p = strnchrnul(buf, count, '\n'); if (p == buf + count - 1) *p = '\0'; /* strip trailing newline */ - else if (p) + else if (p < buf + count - 1) return -EINVAL; /* enforce single line input */ return 0; base-commit: 8667bd30fd033295b3038ce374c551d1059538ba -- 2.56.0