Description
In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro The GET_INSTANCE_ID macro that caused a kernel panic when accessing sysfs attributes: 1. Off-by-one error: The loop condition used '<=' instead of '<', causing access beyond array bounds. Since array indices are 0-based and go from 0 to instances_count-1, the loop should use '<'. 2. Missing NULL check: The code dereferenced attr_name_kobj->name without checking if attr_name_kobj was NULL, causing a null pointer dereference in min_length_show() and other attribute show functions. The panic occurred when fwupd tried to read BIOS configuration attributes: Oops: general protection fault [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:min_length_show+0xcf/0x1d0 [hp_bioscfg] Add a NULL check for attr_name_kobj before dereferencing and corrects the loop boundary to match the pattern used elsewhere in the driver.
Product status
5f94f181ca25d8c5b77beb2da0cb466ddb6ece29 (git) before eb5ff1025c92117d5d1cc728bcfa294abe484da1
5f94f181ca25d8c5b77beb2da0cb466ddb6ece29 (git) before eba49c1dee9c5e514ca18e52c545bba524e8a045
5f94f181ca25d8c5b77beb2da0cb466ddb6ece29 (git) before 193922a23d7294085a47d7719fdb7d66ad0a236f
5f94f181ca25d8c5b77beb2da0cb466ddb6ece29 (git) before 25150715e0b049b99df664daf05dab12f41c3e13
6.6
Any version before 6.6
6.6.122 (semver)
6.12.68 (semver)
6.18.8 (semver)
6.19 (original_commit_for_fix)
References
git.kernel.org/...c/eb5ff1025c92117d5d1cc728bcfa294abe484da1
git.kernel.org/...c/eba49c1dee9c5e514ca18e52c545bba524e8a045
git.kernel.org/...c/193922a23d7294085a47d7719fdb7d66ad0a236f
git.kernel.org/...c/25150715e0b049b99df664daf05dab12f41c3e13