[PATCH] platform/x86: think-lmi: Fix current password length check

[PATCH] platform/x86: think-lmi: Fix current password length check

[Thorsten Blum]

current_password_store() checks the password length before removing the
trailing newline, which can reject valid passwords that are exactly
->maxlen bytes long.

It also passes ->maxlen to strscpy(), which truncates passwords without
a newline.

Use strchrnul() to measure the password length up to the newline, then
copy that many bytes and add a trailing NUL terminator.

Fixes: a40cd7ef22fb ("platform/x86: think-lmi: Add WMI interface support on Lenovo platforms")
Cc: stable@vger.kernel.org
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
---
 drivers/platform/x86/lenovo/think-lmi.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/drivers/platform/x86/lenovo/think-lmi.c b/drivers/platform/x86/lenovo/think-lmi.c
index e215e86e3db7..860224dc8c21 100644
--- a/drivers/platform/x86/lenovo/think-lmi.c
+++ b/drivers/platform/x86/lenovo/think-lmi.c
@@ -436,16 +436,14 @@ static ssize_t current_password_store(struct kobject *kobj,
 				      const char *buf, size_t count)
 {
 	struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
-	size_t pwdlen;
+	size_t pwdlen = strchrnul(buf, '\n') - buf;
 
-	pwdlen = strlen(buf);
 	/* pwdlen == 0 is allowed to clear the password */
 	if (pwdlen && ((pwdlen < setting->minlen) || (pwdlen > setting->maxlen)))
 		return -EINVAL;
 
-	strscpy(setting->password, buf, setting->maxlen);
-	/* Strip out CR if one is present, setting password won't work if it is present */
-	strreplace(setting->password, '\n', '\0');
+	memcpy(setting->password, buf, pwdlen);
+	setting->password[pwdlen] = '\0';
 	return count;
 }
 

Re: [PATCH] platform/x86: think-lmi: Fix current password length check

[Mark Pearson]

On Mon, Aug 10, 2026, at 9:20 AM, Thorsten Blum wrote:
> current_password_store() checks the password length before removing the
> trailing newline, which can reject valid passwords that are exactly
> ->maxlen bytes long.
>
> It also passes ->maxlen to strscpy(), which truncates passwords without
> a newline.
>
> Use strchrnul() to measure the password length up to the newline, then
> copy that many bytes and add a trailing NUL terminator.
>
> Fixes: a40cd7ef22fb ("platform/x86: think-lmi: Add WMI interface 
> support on Lenovo platforms")
> Cc: stable@vger.kernel.org
> Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
> ---
>  drivers/platform/x86/lenovo/think-lmi.c | 8 +++-----
>  1 file changed, 3 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/platform/x86/lenovo/think-lmi.c 
> b/drivers/platform/x86/lenovo/think-lmi.c
> index e215e86e3db7..860224dc8c21 100644
> --- a/drivers/platform/x86/lenovo/think-lmi.c
> +++ b/drivers/platform/x86/lenovo/think-lmi.c
> @@ -436,16 +436,14 @@ static ssize_t current_password_store(struct 
> kobject *kobj,
>  				      const char *buf, size_t count)
>  {
>  	struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
> -	size_t pwdlen;
> +	size_t pwdlen = strchrnul(buf, '\n') - buf;
> 
> -	pwdlen = strlen(buf);
>  	/* pwdlen == 0 is allowed to clear the password */
>  	if (pwdlen && ((pwdlen < setting->minlen) || (pwdlen > setting->maxlen)))
>  		return -EINVAL;
> 
> -	strscpy(setting->password, buf, setting->maxlen);
> -	/* Strip out CR if one is present, setting password won't work if it 
> is present */
> -	strreplace(setting->password, '\n', '\0');
> +	memcpy(setting->password, buf, pwdlen);
> +	setting->password[pwdlen] = '\0';
>  	return count;
>  }

Change is good.
Only minor note is that I hate to lose the comment explaining why we're losing the CR. Can we put that back in above the strchrnul operation?

Mark

Re: [PATCH] platform/x86: think-lmi: Fix current password length check

[Thorsten Blum]

On Tue, Aug 11, 2026 at 03:29:28PM -0400, Mark Pearson wrote:
> On Mon, Aug 10, 2026, at 9:20 AM, Thorsten Blum wrote:
> > current_password_store() checks the password length before removing the
> > trailing newline, which can reject valid passwords that are exactly
> > ->maxlen bytes long.
> >
> > It also passes ->maxlen to strscpy(), which truncates passwords without
> > a newline.
> >
> > Use strchrnul() to measure the password length up to the newline, then
> > copy that many bytes and add a trailing NUL terminator.
> >
> > Fixes: a40cd7ef22fb ("platform/x86: think-lmi: Add WMI interface 
> > support on Lenovo platforms")
> > Cc: stable@vger.kernel.org
> > Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
> > ---
> >  drivers/platform/x86/lenovo/think-lmi.c | 8 +++-----
> >  1 file changed, 3 insertions(+), 5 deletions(-)
> >
> > diff --git a/drivers/platform/x86/lenovo/think-lmi.c 
> > b/drivers/platform/x86/lenovo/think-lmi.c
> > index e215e86e3db7..860224dc8c21 100644
> > --- a/drivers/platform/x86/lenovo/think-lmi.c
> > +++ b/drivers/platform/x86/lenovo/think-lmi.c
> > @@ -436,16 +436,14 @@ static ssize_t current_password_store(struct 
> > kobject *kobj,
> >  				      const char *buf, size_t count)
> >  {
> >  	struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
> > -	size_t pwdlen;
> > +	size_t pwdlen = strchrnul(buf, '\n') - buf;
> > 
> > -	pwdlen = strlen(buf);
> >  	/* pwdlen == 0 is allowed to clear the password */
> >  	if (pwdlen && ((pwdlen < setting->minlen) || (pwdlen > setting->maxlen)))
> >  		return -EINVAL;
> > 
> > -	strscpy(setting->password, buf, setting->maxlen);
> > -	/* Strip out CR if one is present, setting password won't work if it 
> > is present */
> > -	strreplace(setting->password, '\n', '\0');
> > +	memcpy(setting->password, buf, pwdlen);
> > +	setting->password[pwdlen] = '\0';
> >  	return count;
> >  }
> 
> Change is good.
> Only minor note is that I hate to lose the comment explaining why
> we're losing the CR. Can we put that back in above the strchrnul
> operation?

I removed the comment because '\r' is CR and '\n' is LF. Happy to add it
back if needed, but maybe a better version would be:

/* Strip newline; setting password won't work if one is present. */

Re: [PATCH] platform/x86: think-lmi: Fix current password length check

[Mark Pearson]

On Tue, Aug 11, 2026, at 4:29 PM, Thorsten Blum wrote:
> On Tue, Aug 11, 2026 at 03:29:28PM -0400, Mark Pearson wrote:
>> On Mon, Aug 10, 2026, at 9:20 AM, Thorsten Blum wrote:
>> > current_password_store() checks the password length before removing the
>> > trailing newline, which can reject valid passwords that are exactly
>> > ->maxlen bytes long.
>> >
>> > It also passes ->maxlen to strscpy(), which truncates passwords without
>> > a newline.
>> >
>> > Use strchrnul() to measure the password length up to the newline, then
>> > copy that many bytes and add a trailing NUL terminator.
>> >
>> > Fixes: a40cd7ef22fb ("platform/x86: think-lmi: Add WMI interface 
>> > support on Lenovo platforms")
>> > Cc: stable@vger.kernel.org
>> > Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
>> > ---
>> >  drivers/platform/x86/lenovo/think-lmi.c | 8 +++-----
>> >  1 file changed, 3 insertions(+), 5 deletions(-)
>> >
>> > diff --git a/drivers/platform/x86/lenovo/think-lmi.c 
>> > b/drivers/platform/x86/lenovo/think-lmi.c
>> > index e215e86e3db7..860224dc8c21 100644
>> > --- a/drivers/platform/x86/lenovo/think-lmi.c
>> > +++ b/drivers/platform/x86/lenovo/think-lmi.c
>> > @@ -436,16 +436,14 @@ static ssize_t current_password_store(struct 
>> > kobject *kobj,
>> >  				      const char *buf, size_t count)
>> >  {
>> >  	struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
>> > -	size_t pwdlen;
>> > +	size_t pwdlen = strchrnul(buf, '\n') - buf;
>> > 
>> > -	pwdlen = strlen(buf);
>> >  	/* pwdlen == 0 is allowed to clear the password */
>> >  	if (pwdlen && ((pwdlen < setting->minlen) || (pwdlen > setting->maxlen)))
>> >  		return -EINVAL;
>> > 
>> > -	strscpy(setting->password, buf, setting->maxlen);
>> > -	/* Strip out CR if one is present, setting password won't work if it 
>> > is present */
>> > -	strreplace(setting->password, '\n', '\0');
>> > +	memcpy(setting->password, buf, pwdlen);
>> > +	setting->password[pwdlen] = '\0';
>> >  	return count;
>> >  }
>> 
>> Change is good.
>> Only minor note is that I hate to lose the comment explaining why
>> we're losing the CR. Can we put that back in above the strchrnul
>> operation?
>
> I removed the comment because '\r' is CR and '\n' is LF. Happy to add it
> back if needed, but maybe a better version would be:
>
> /* Strip newline; setting password won't work if one is present. */

Good point. Yes please.

Mark