HP BIOS config driver gets heap overflow and OOB fixes

A nine-part series from Muhammad Bilal fixes multiple heap out-of-bounds reads and writes, off-by-one errors, and ACPI parsing failures in the Linux hp-bioscfg driver, the platform/x86 code that exposes HP BIOS settings and password controls through sysfs. The changes are marked for stable kernels.

The most severe path is a 16-byte heap buffer overflow when building the security buffer for an empty authentication token. That is the default until an admin or setup password is configured, so ordinary writes to writable BIOS attributes on a stock system could hit it. Other memory bugs include an off-by-one NUL write past fixed string buffers, a one-byte-past-end read when sysfs key material ends in a newline (the usual shell case), an under-run read on empty password writes, an off-by-one write past a page-sized audit log buffer if firmware reports too many entries, and a missing bounds check when walking password encoding elements from ACPI.

Two logic bugs compound the reliability damage. Writes intended for the new-password field were routed into the current-password field instead, so the new value was never stored. Ordered-list attributes could silently end up with empty element lists because a stale null pointer was passed into string conversion and the failure path returned success.

A shared indexing mistake in all five attribute-type parsers (enum, integer, string, ordered-list, and password) meant multi-element ACPI arrays advanced the outer loop by only one slot. The next property was then read from leftover array data and rejected with -EIO. On Bilal's HP EliteBook 840 G2 test machine that produced a boot-time type mismatch and an "Invalid command value" error from the driver on every start. With the index advance corrected, those parsers stay aligned with the package layout.

Together the fixes close several KASAN-visible memory safety holes on common sysfs write paths and restore attribute parsing that was failing on real HP firmware.