cert_thumbprint() already returns the accumulated output length, but
certificate_thumbprint_show() adds that value to count again, making the
next line use the wrong offset. Errors returned by cert_thumbprint() are
also ignored and their negative values added to count.

Assign the total length to count instead and propagate errors correctly.

Fixes: b49f72e7f96d ("platform/x86: think-lmi: Certificate authentication support")
Cc: stable@vger.kernel.org
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
---
 drivers/platform/x86/lenovo/think-lmi.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/platform/x86/lenovo/think-lmi.c b/drivers/platform/x86/lenovo/think-lmi.c
index e215e86e3db7..441fca37b523 100644
--- a/drivers/platform/x86/lenovo/think-lmi.c
+++ b/drivers/platform/x86/lenovo/think-lmi.c
@@ -745,6 +745,8 @@ static ssize_t certificate_thumbprint_show(struct kobject *kobj, struct kobj_att
 		return -EOPNOTSUPP;
 
 	for (i = 0; i < ARRAY_SIZE(thumbtypes); i++) {
+		ssize_t ret;
+
 		if (tlmi_priv.pwdcfg.core.password_mode >= TLMI_PWDCFG_MODE_MULTICERT) {
 			/* Format: 'SVC | SMC, Thumbtype' */
 			wmistr = kasprintf(GFP_KERNEL, "%s,%s",
@@ -756,8 +758,12 @@ static ssize_t certificate_thumbprint_show(struct kobject *kobj, struct kobj_att
 		}
 		if (!wmistr)
 			return -ENOMEM;
-		count += cert_thumbprint(buf, wmistr, count);
+
+		ret = cert_thumbprint(buf, wmistr, count);
 		kfree(wmistr);
+		if (ret < 0)
+			return ret;
+		count = ret;
 	}
 
 	return count;

On Mon, 10 Aug 2026 14:05:57 +0200, Thorsten Blum wrote:

> cert_thumbprint() already returns the accumulated output length, but
> certificate_thumbprint_show() adds that value to count again, making the
> next line use the wrong offset. Errors returned by cert_thumbprint() are
> also ignored and their negative values added to count.
> 
> Assign the total length to count instead and propagate errors correctly.
> 
> [...]

Thank you for your contribution, it has been applied to my local
review-ilpo-next branch. Note it will show up in the public
platform-drivers-x86/review-ilpo-next branch only once I've pushed my
local branch there, which might take a while.

FYI [if applicable to your patch], as per Linus' policy change, also
fixes are mostly routed through for-next unless the fix is for a
commit introduced in the most recent cycle or is clearly a regression
fix.

The list of commits applied:
[1/1] platform/x86: think-lmi: Fix certificate thumbprint sysfs output
      commit: 38443e5748496086940a2033fd2102b702109287

--
 i.

Thanks Thorsten,

On Mon, Aug 10, 2026, at 8:05 AM, Thorsten Blum wrote:
> cert_thumbprint() already returns the accumulated output length, but
> certificate_thumbprint_show() adds that value to count again, making the
> next line use the wrong offset. Errors returned by cert_thumbprint() are
> also ignored and their negative values added to count.
>
> Assign the total length to count instead and propagate errors correctly.
>
> Fixes: b49f72e7f96d ("platform/x86: think-lmi: Certificate 
> authentication support")
> Cc: stable@vger.kernel.org
> Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
> ---
>  drivers/platform/x86/lenovo/think-lmi.c | 8 +++++++-
>  1 file changed, 7 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/platform/x86/lenovo/think-lmi.c 
> b/drivers/platform/x86/lenovo/think-lmi.c
> index e215e86e3db7..441fca37b523 100644
> --- a/drivers/platform/x86/lenovo/think-lmi.c
> +++ b/drivers/platform/x86/lenovo/think-lmi.c
> @@ -745,6 +745,8 @@ static ssize_t certificate_thumbprint_show(struct 
> kobject *kobj, struct kobj_att
>  		return -EOPNOTSUPP;
> 
>  	for (i = 0; i < ARRAY_SIZE(thumbtypes); i++) {
> +		ssize_t ret;
> +
>  		if (tlmi_priv.pwdcfg.core.password_mode >= 
> TLMI_PWDCFG_MODE_MULTICERT) {
>  			/* Format: 'SVC | SMC, Thumbtype' */
>  			wmistr = kasprintf(GFP_KERNEL, "%s,%s",
> @@ -756,8 +758,12 @@ static ssize_t certificate_thumbprint_show(struct 
> kobject *kobj, struct kobj_att
>  		}
>  		if (!wmistr)
>  			return -ENOMEM;
> -		count += cert_thumbprint(buf, wmistr, count);
> +
> +		ret = cert_thumbprint(buf, wmistr, count);
>  		kfree(wmistr);
> +		if (ret < 0)
> +			return ret;
> +		count = ret;
>  	}
> 
>  	return count;
Looks good to me. Thanks for the fix.
Reviewed-by: Mark Pearson <mpearson-lenovo@squebb.ca>

Mark