From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794064885; b=PkhlE6POVI5e//LUeAMexlV3CorN2nAHjtMcelxBHDI7ETX0S50IhrjXxzFchCNAMYoO tt3jNa4gmnKPs4q/6H9WV5m2+XJcKortlyvQoIxUlscxgc4n44OyQVZQO+N8YOnujudLH CH+mBWZvL/NBO43l6a9aLOznQG2SdSCAWQ1pquhrHGiIWNd1puQyFeFDcsJ/FugOC7Bkd eu1QLeN0EduA9fWhZESBA6XXEHelRtY7QjliK+BC5WltECkd4Ms9nrxY+EY4xu226nf3k YzX8OyqKB3mHYzr/TTi73q9m6AlOsV0z7VzrAQTxh3GsdL2Kr7hszGbqlAck1k6hvJg== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794064885; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Type:Content-Transfer-Encoding; bh=FqgmvNJ+qH/V//Qaq9QeJvzUdTVd0PyAAc48zspryn4=; b=pqYs/ExlHLnmoZwlUzB1vXGCY1/7kQv02rHElZ+xdvAldUmvUOTXcRmi4dxdwdPIx41p WoXPgGnuRynLFYzmDVxZRCpbMnzGK4UQy4sDrMzl36dTvCaouMl05IZVv8mQ5G4vKzVaP pXHRr6SYi3VfS/mc9oeb75hMU9FiLRK8wJnjJL0Ny4D9OezEw8+8+ZpZ7oyDsWXX3+mtO ZIOZdYF46HuOUiaCweseBUxNNRsZ9t+BiyyA6BpieYlDlCYjrsE9MAciWNYi77GmnmxXi vFAE3tKneK0uI+UFnDpuZZhun2GZmfsr7I1oR6bT5H1XlJUMmljlGBHwZ1hBXuDFHjA== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=jPfrVWhZ; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 65CAA606C000; Sat, 7 Nov 2026 15:21:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=jPfrVWhZ Received: by smtp.kernel.org (Postfix) with ESMTPSA id 007321F0089F; Sat, 7 Nov 2026 15:21:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1794064885; bh=FqgmvNJ+qH/V//Qaq9QeJvzUdTVd0PyAAc48zspryn4=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=jPfrVWhZgogdA8aROhjIsYGT8gKsvnr1CTjkjMX+zKmEspwzAnwdXAMFib4YdnKbI 0nJao8XEU9JVLY29UnelRtFeHc+tjGqMotDPZEanQQI2ZGdn6QdChuv3ERFO19gEEZ r0OSU3fpCDaTnR9tPJinYCQxwFuzYmeTo/anTxUI= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, =?UTF-8?q?Ilpo=20J=C3=A4rvinen?= , Muhammad Bilal , Sasha Levin Subject: [PATCH 7.3 0748/1257] platform/x86: hp-bioscfg: fix non-ASCII truncation in hp_get_string_from_buffer() Date: Sat, 7 Nov 2026 08:50:44 -0500 Message-ID: <20261107134959.949983134@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261107134939.434104957@linuxfoundation.org> References: <20261107134939.434104957@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 7.3-stable review patch. If anyone has any objections, please let me know. ------------------ From: Muhammad Bilal [ Upstream commit 6b8d2374b32c35efa2a431b3cd2fe346f8917dcc ] utf16s_to_utf8s() writes into dst, but the loop that follows overwrites dst from the raw UTF-16 code units with truncating casts, so any character above U+007F is mangled. For example, U+00E9 is stored as 0xe9 instead of 0xc3 0xa9. Convert into a scratch buffer first, then escape '\\', '\r', '\n' and '\t' into dst with string_escape_mem(). Quotes are not escaped, so the existing strreplace() still handles them. Tested on HP EliteBook 840 G2 (Fedora 44, Linux 7.2.7). Fixes: a34fc329b189 ("platform/x86: hp-bioscfg: bioscfg") Cc: stable@vger.kernel.org Suggested-by: Ilpo Järvinen Signed-off-by: Muhammad Bilal Link: https://lore.kernel.org/all/20261007134711.473857-1-meatuni001@gmail.com/ Link: https://patch.msgid.link/20261007134711.473857-3-meatuni001@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen Signed-off-by: Sasha Levin --- drivers/platform/x86/hp/hp-bioscfg/bioscfg.c | 62 +++++--------------- 1 file changed, 14 insertions(+), 48 deletions(-) diff --git a/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c b/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c index 6b48faec2cea3..8ffdc737af4d2 100644 --- a/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c +++ b/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c @@ -11,7 +11,7 @@ #include #include #include -#include +#include #include #include "bioscfg.h" #include "../../firmware_attributes_class.h" @@ -53,12 +53,12 @@ int hp_get_integer_from_buffer(u8 **buffer, u32 *buffer_size, u32 *integer) int hp_get_string_from_buffer(u8 **buffer, u32 *buffer_size, char *dst, u32 dst_size) { + char utf8_buf[MAX_BUFF_SIZE]; u16 *src = (u16 *)*buffer; + int escaped_len; u16 orig_size; u16 src_size; - u16 size; - int i; - int conv_dst_size; + int utf8_len; if (*buffer_size < sizeof(u16)) return -EINVAL; @@ -75,56 +75,22 @@ int hp_get_string_from_buffer(u8 **buffer, u32 *buffer_size, char *dst, u32 dst_ src++; /* size value in u16 chars */ orig_size = src_size / sizeof(u16); - size = orig_size; - - for (i = 0; i < orig_size; i++) - if (src[i] == '\\' || - src[i] == '\r' || - src[i] == '\n' || - src[i] == '\t') - size++; - /* - * Conversion is limited to destination string max number of - * bytes. - */ - conv_dst_size = size; - if (size >= dst_size) - conv_dst_size = dst_size - 1; + utf8_len = utf16s_to_utf8s(src, orig_size, UTF16_HOST_ENDIAN, + utf8_buf, sizeof(utf8_buf)); - /* - * convert from UTF-16 unicode to ASCII - */ - utf16s_to_utf8s(src, orig_size, UTF16_HOST_ENDIAN, dst, conv_dst_size); - dst[conv_dst_size] = 0; - - for (i = 0; i < conv_dst_size; i++) { - if (*src == '\\' || - *src == '\r' || - *src == '\n' || - *src == '\t') { - dst[i++] = '\\'; - if (i == conv_dst_size) - break; - } - - if (*src == '\r') - dst[i] = 'r'; - else if (*src == '\n') - dst[i] = 'n'; - else if (*src == '\t') - dst[i] = 't'; - else if (*src == '"') - dst[i] = '\''; - else - dst[i] = *src; - src++; - } + escaped_len = string_escape_mem(utf8_buf, utf8_len, dst, dst_size - 1, + ESCAPE_SPACE | ESCAPE_SPECIAL, + "\\\r\n\t"); + if (escaped_len > dst_size - 1) + escaped_len = dst_size - 1; + dst[escaped_len] = '\0'; + strreplace(dst, '"', '\''); *buffer += sizeof(u16) + src_size; *buffer_size -= sizeof(u16) + src_size; - return size; + return escaped_len; } int hp_get_common_data_from_buffer(u8 **buffer_ptr, u32 *buffer_size, -- 2.53.0