Re: [PATCH v7] platform/x86: hp-bioscfg: fix heap OOB in hp_enforce_single_line_input()

[Muhammad Bilal]

Hi,

Thanks for the review.

Link v8: https://lore.kernel.org/all/20261026051740.88791-1-meatuni001@xxxxxxxxx/

Thanks
Muhammad

On Mon, Oct 26, 2026 at 10:16 AM Muhammad Bilal <meatuni001@xxxxxxxxx> wrote:
>
> Hi Andy,
>
> No particular reason. I removed them while trimming the diff, but
> you're right that both comments are still useful. I'll restore them in
> the next revision.
>
> Thanks,
> Muhammad
>
> On Mon, Oct 26, 2026 at 12:52 AM Andy Shevchenko
> <andriy.shevchenko@xxxxxxxxxxxxxxx> wrote:
> >
> > On Sat, Oct 24, 2026 at 10:26:41PM +0500, Muhammad Bilal wrote:
> > > The input is copied with kstrdup(), which stops at the first NUL, but
> > > the full write size is passed to hp_enforce_single_line_input(). With
> > > an embedded NUL the helper reads, and can write one byte, past the
> > > copy. Use strnchrnul() so the scan stops at the first NUL, and return
> > > -EINVAL for a NUL or newline before the last byte.
> > >
> > > Tested on HP EliteBook 840 G2 (Fedora 44, Linux 7.2.8): writing "A\0"
> > > followed by 4093 bytes of "B" to current_password 100 times returns
> > > -EINVAL every time, without reading into the heap.
> >
> > ...
> >
> > >  - Drop the trailing comments
> >
> > Why? At least The first one has the same meaning as before, what's wrong with
> > the second one?
> >
> > --
> > With Best Regards,
> > Andy Shevchenko
> >
> >