hp_convert_hexstr_to_str() allocates its output buffer for the
worst-case decoded length, then fills in only as many bytes as the
input actually decodes to before shrinking the allocation down to
that length with krealloc(). Well-formed input can decode to
noticeably fewer bytes than the worst case, so the buffer is
frequently only partially written by the time it is realloc'd and
returned to the caller.

Use kzalloc() instead of kmalloc() for the initial allocation, so
any unused capacity starts out zeroed instead of holding leftover
heap contents, rather than relying on every current and future
caller and code path to fill the buffer exactly.

Suggested-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
---
Applies on top of "platform/x86: hp-bioscfg: fix slab-out-of-bounds
write in hp_convert_hexstr_to_str" (the DIV_ROUND_UP sizing fix),
which Ilpo has applied to review-ilpo-next but is not yet in
mainline. Sent as its own patch rather than a v3 of that one, since
the sizing fix itself was applied as-is; this is the separate change
requested on top of it.
---
 drivers/platform/x86/hp/hp-bioscfg/bioscfg.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c b/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c
index ff28db7..2dab9c0 100644
--- a/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c
+++ b/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c
@@ -442,7 +442,7 @@ int hp_convert_hexstr_to_str(const char *input, u32 input_len, char **str, int *
 	*len = 0;
 	*str = NULL;
 
-	new_str = kmalloc(2 * DIV_ROUND_UP(input_len, 5) + 1, GFP_KERNEL);
+	new_str = kzalloc(2 * DIV_ROUND_UP(input_len, 5) + 1, GFP_KERNEL);
 	if (!new_str)
 		return -ENOMEM;
 
-- 
2.43.0

On Wed, 16 Sep 2026, Muhammad Bilal wrote:

> hp_convert_hexstr_to_str() allocates its output buffer for the
> worst-case decoded length, then fills in only as many bytes as the
> input actually decodes to before shrinking the allocation down to
> that length with krealloc(). Well-formed input can decode to
> noticeably fewer bytes than the worst case, so the buffer is
> frequently only partially written by the time it is realloc'd and
> returned to the caller.
> 
> Use kzalloc() instead of kmalloc() for the initial allocation, so
> any unused capacity starts out zeroed instead of holding leftover
> heap contents, rather than relying on every current and future
> caller and code path to fill the buffer exactly.
> 
> Suggested-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
> Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
> ---
> Applies on top of "platform/x86: hp-bioscfg: fix slab-out-of-bounds
> write in hp_convert_hexstr_to_str" (the DIV_ROUND_UP sizing fix),
> which Ilpo has applied to review-ilpo-next but is not yet in
> mainline. Sent as its own patch rather than a v3 of that one, since
> the sizing fix itself was applied as-is; this is the separate change
> requested on top of it.

Thanks, applied to review-ilpo-next.

In future, please try to add parenthesis into function names in the 
shortlog (on Subject line) as well so I don't need to manually add them 
myself.

--
 i.

> ---
>  drivers/platform/x86/hp/hp-bioscfg/bioscfg.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c b/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c
> index ff28db7..2dab9c0 100644
> --- a/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c
> +++ b/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c
> @@ -442,7 +442,7 @@ int hp_convert_hexstr_to_str(const char *input, u32 input_len, char **str, int *
>  	*len = 0;
>  	*str = NULL;
>  
> -	new_str = kmalloc(2 * DIV_ROUND_UP(input_len, 5) + 1, GFP_KERNEL);
> +	new_str = kzalloc(2 * DIV_ROUND_UP(input_len, 5) + 1, GFP_KERNEL);
>  	if (!new_str)
>  		return -ENOMEM;
>  
> 

Thanks, Ilpo.

Noted. I'll include the parentheses in function names in the Subject
line for future patches.

Thanks for the review and for applying the patch.

--
Muhammad


On Wed, Sep 16, 2026 at 3:29 PM Ilpo Järvinen
<ilpo.jarvinen@linux.intel.com> wrote:
>
> On Wed, 16 Sep 2026, Muhammad Bilal wrote:
>
> > hp_convert_hexstr_to_str() allocates its output buffer for the
> > worst-case decoded length, then fills in only as many bytes as the
> > input actually decodes to before shrinking the allocation down to
> > that length with krealloc(). Well-formed input can decode to
> > noticeably fewer bytes than the worst case, so the buffer is
> > frequently only partially written by the time it is realloc'd and
> > returned to the caller.
> >
> > Use kzalloc() instead of kmalloc() for the initial allocation, so
> > any unused capacity starts out zeroed instead of holding leftover
> > heap contents, rather than relying on every current and future
> > caller and code path to fill the buffer exactly.
> >
> > Suggested-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
> > Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
> > ---
> > Applies on top of "platform/x86: hp-bioscfg: fix slab-out-of-bounds
> > write in hp_convert_hexstr_to_str" (the DIV_ROUND_UP sizing fix),
> > which Ilpo has applied to review-ilpo-next but is not yet in
> > mainline. Sent as its own patch rather than a v3 of that one, since
> > the sizing fix itself was applied as-is; this is the separate change
> > requested on top of it.
>
> Thanks, applied to review-ilpo-next.
>
> In future, please try to add parenthesis into function names in the
> shortlog (on Subject line) as well so I don't need to manually add them
> myself.
>
> --
>  i.
>
> > ---
> >  drivers/platform/x86/hp/hp-bioscfg/bioscfg.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c b/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c
> > index ff28db7..2dab9c0 100644
> > --- a/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c
> > +++ b/drivers/platform/x86/hp/hp-bioscfg/bioscfg.c
> > @@ -442,7 +442,7 @@ int hp_convert_hexstr_to_str(const char *input, u32 input_len, char **str, int *
> >       *len = 0;
> >       *str = NULL;
> >
> > -     new_str = kmalloc(2 * DIV_ROUND_UP(input_len, 5) + 1, GFP_KERNEL);
> > +     new_str = kzalloc(2 * DIV_ROUND_UP(input_len, 5) + 1, GFP_KERNEL);
> >       if (!new_str)
> >               return -ENOMEM;
> >
> >