menuconfig: fix NULL pointer dereference when searching a symbol

PATCH In review Li Zefan 5 participants 7 messages May 7, 2013

Subsystems (2)

Kbuild Kconfig

lore

Share & tools

lore

Li Zefan

author

2013-05-07 02:41 UTC #0 lore raw

PATCH 1/1 menuconfig: fix NULL pointer dereference when searching a symbol

Searching PPC_EFIKA results segmentation fault, and it's because get_symbol_prop() returns NULL.

In this case CONFIG_PPC_EFIKA is defined in arch/powerpc/platforms/ 52xx/Kconfig, so it won't be parsed if ARCH!=PPC, but menuconfig knows this symbol when it parses sound/soc/fsl/Kconfig:

config SND_MPC52xx_SOC_EFIKA
tristate "SoC AC97 Audio support for bbplan Efika and STAC9766" depends on PPC_EFIKA

This bug was introduced by commit bcdedcc1afd6 ("menuconfig: print more info for symbol without prompts").

Reported-by Borislav Petkov <[email protected]>

Signed-off-by Li Zefan <[email protected]>

---
 scripts/kconfig/menu.c | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

scripts/kconfig/menu.c +10 -6

index 826da66..b5c7d90 100644
@@ -600,14 +600,18 @@ void get_symbol_str(struct gstr *r, struct symbol *sym,
 	}
 	for_all_prompts(sym, prop)
 		get_prompt_str(r, prop, head);
+
 	prop = get_symbol_prop(sym);
-	str_printf(r, _("  Defined at %s:%d\n"), prop->menu->file->name,
-		prop->menu->lineno);
-	if (!expr_is_yes(prop->visible.expr)) {
-		str_append(r, _("  Depends on: "));
-		expr_gstr_print(prop->visible.expr, r);
-		str_append(r, "\n");
+	if (prop) {
+		str_printf(r, _("  Defined at %s:%d\n"), prop->menu->file->name,
+			prop->menu->lineno);
+		if (!expr_is_yes(prop->visible.expr)) {
+			str_append(r, _("  Depends on: "));
+			expr_gstr_print(prop->visible.expr, r);
+			str_append(r, "\n");
+		}
 	}
+
 	hit = false;
 	for_all_properties(sym, prop, P_SELECT) {
 		if (!hit) {

Signature · 1 line

1.8.0.2

Libo Chen

Tested-by on v1 1/1

2013-05-07 02:49 UTC #1 lore raw

Quoted 7 lines · Li Zefan

Searching PPC_EFIKA results segmentation fault, and it's because get_symbol_prop() returns NULL.
In this case CONFIG_PPC_EFIKA is defined in arch/powerpc/platforms/ 52xx/Kconfig, so it won't be parsed if ARCH!=PPC, but menuconfig knows this symbol when it parses sound/soc/fsl/Kconfig:

Quoted 6 lines

config SND_MPC52xx_SOC_EFIKA
tristate "SoC AC97 Audio support for bbplan Efika and STAC9766" depends on PPC_EFIKA
This bug was introduced by commit bcdedcc1afd6 ("menuconfig: print more info for symbol without prompts").

It works!

Tested-by Libo Chen <[email protected]>

Quoted 37 lines

Reported-by Borislav Petkov <[email protected]>

Signed-off-by Li Zefan <[email protected]>

---
 scripts/kconfig/menu.c | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

scripts/kconfig/menu.c +10 -6

index 826da66..b5c7d90 100644
@@ -600,14 +600,18 @@ void get_symbol_str(struct gstr *r, struct symbol *sym,
 	}
 	for_all_prompts(sym, prop)
 		get_prompt_str(r, prop, head);
+
 	prop = get_symbol_prop(sym);
-	str_printf(r, _("  Defined at %s:%d\n"), prop->menu->file->name,
-		prop->menu->lineno);
-	if (!expr_is_yes(prop->visible.expr)) {
-		str_append(r, _("  Depends on: "));
-		expr_gstr_print(prop->visible.expr, r);
-		str_append(r, "\n");
+	if (prop) {
+		str_printf(r, _("  Defined at %s:%d\n"), prop->menu->file->name,
+			prop->menu->lineno);
+		if (!expr_is_yes(prop->visible.expr)) {
+			str_append(r, _("  Depends on: "));
+			expr_gstr_print(prop->visible.expr, r);
+			str_append(r, "\n");
+		}
 	}
+
 	hit = false;
 	for_all_properties(sym, prop, P_SELECT) {
 		if (!hit) {

Borislav Petkov

2013-05-07 10:43 UTC #2 lore raw

In reply to Li Zefan

Quoted 7 lines · Li Zefan

Searching PPC_EFIKA results segmentation fault, and it's because get_symbol_prop() returns NULL.
In this case CONFIG_PPC_EFIKA is defined in arch/powerpc/platforms/ 52xx/Kconfig, so it won't be parsed if ARCH!=PPC, but menuconfig knows this symbol when it parses sound/soc/fsl/Kconfig:

Quoted 6 lines

config SND_MPC52xx_SOC_EFIKA
tristate "SoC AC97 Audio support for bbplan Efika and STAC9766" depends on PPC_EFIKA
This bug was introduced by commit bcdedcc1afd6 ("menuconfig: print more info for symbol without prompts").

Yep, it works.

Quoted 1 line

Reported-by Borislav Petkov <[email protected]>

	..-and-tested-by: ...

Thanks.

Signature · 5 lines

Regards/Gruss,
    Boris.

Sent from a fat crate under my desk. Formatting is fine.
--

Yann E. MORIN

Reviewed-by on v1 1/1

2013-05-07 13:22 UTC #3 lore raw

In reply to Li Zefan

Li, All,

Quoted 11 lines · Li Zefan

Searching PPC_EFIKA results segmentation fault, and it's because get_symbol_prop() returns NULL.
In this case CONFIG_PPC_EFIKA is defined in arch/powerpc/platforms/ 52xx/Kconfig, so it won't be parsed if ARCH!=PPC, but menuconfig knows this symbol when it parses sound/soc/fsl/Kconfig:
config SND_MPC52xx_SOC_EFIKA
tristate "SoC AC97 Audio support for bbplan Efika and STAC9766" depends on PPC_EFIKA

Quoted 5 lines

This bug was introduced by commit bcdedcc1afd6 ("menuconfig: print more info for symbol without prompts").
Reported-by Borislav Petkov <[email protected]>
Signed-off-by Li Zefan <[email protected]>

Reviewed-by "Yann E. MORIN" <[email protected]>

Michal, I'll get this in my tree, and will send a pull-request to you later (I may have a few other smallish fixes shortly).

Regards,
Yann E. MORIN.

Signature · 6 lines

.-----------------.--------------------.------------------.--------------------.
|  Yann E. MORIN  | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software  Designer | \ / CAMPAIGN     |  ___               |
| +33 223 225 172 `------------.-------:  X  AGAINST      |  \e/  There is no  |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL    |   v   conspiracy.  |
'------------------------------^-------^------------------^--------------------'

Michal Marek

2013-05-07 13:47 UTC #4 lore raw

Quoted 17 lines · Yann E. MORIN

Li, All,
Quoted 14 lines · Li Zefan
Searching PPC_EFIKA results segmentation fault, and it's because get_symbol_prop() returns NULL.
In this case CONFIG_PPC_EFIKA is defined in arch/powerpc/platforms/ 52xx/Kconfig, so it won't be parsed if ARCH!=PPC, but menuconfig knows this symbol when it parses sound/soc/fsl/Kconfig:
config SND_MPC52xx_SOC_EFIKA
tristate "SoC AC97 Audio support for bbplan Efika and STAC9766" depends on PPC_EFIKA
This bug was introduced by commit bcdedcc1afd6 ("menuconfig: print more info for symbol without prompts").

Quoted 7 lines

Quoted 2 lines
Reported-by Borislav Petkov <[email protected]>
Signed-off-by Li Zefan <[email protected]>
Reviewed-by "Yann E. MORIN" <[email protected]>
Michal, I'll get this in my tree, and will send a pull-request to you later (I may have a few other smallish fixes shortly).

It's difficult to apply this to kbuild.git#kconfig, because the bug that it is fixing is not there. I will send it to Linus by mail.

Michal

Yann E. MORIN

2013-05-07 14:06 UTC #5 lore raw

Michal, All,

Quoted 21 lines · Michal Marek

Quoted 20 lines · Yann E. MORIN
Li, All,
Quoted 16 lines · Li Zefan
Searching PPC_EFIKA results segmentation fault, and it's because get_symbol_prop() returns NULL.
In this case CONFIG_PPC_EFIKA is defined in arch/powerpc/platforms/ 52xx/Kconfig, so it won't be parsed if ARCH!=PPC, but menuconfig knows this symbol when it parses sound/soc/fsl/Kconfig:
config SND_MPC52xx_SOC_EFIKA
tristate "SoC AC97 Audio support for bbplan Efika and STAC9766" depends on PPC_EFIKA
This bug was introduced by commit bcdedcc1afd6 ("menuconfig: print more info for symbol without prompts").
Reported-by Borislav Petkov <[email protected]>
Signed-off-by Li Zefan <[email protected]>

Quoted 7 lines

Quoted 4 lines
Reviewed-by "Yann E. MORIN" <[email protected]>
Michal, I'll get this in my tree, and will send a pull-request to you later (I may have a few other smallish fixes shortly).
It's difficult to apply this to kbuild.git#kconfig, because the bug that it is fixing is not there. I will send it to Linus by mail.

Indeed. Thank you.

It's strange that a kconfig-related change did not land in your tree before getting mainline...

[For the records, it got in via akpm's (Andrew MORTON) branch in
5f56886 ;-) ]

Regards,
Yann E. MORIN.

Signature · 6 lines

.-----------------.--------------------.------------------.--------------------.
|  Yann E. MORIN  | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software  Designer | \ / CAMPAIGN     |  ___               |
| +33 223 225 172 `------------.-------:  X  AGAINST      |  \e/  There is no  |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL    |   v   conspiracy.  |
'------------------------------^-------^------------------^--------------------'

Michal Marek

2013-05-07 14:13 UTC #6 lore raw

Dne 7.5.2013 16:06, Yann E. MORIN napsal(a):

Quoted 2 lines

It's strange that a kconfig-related change did not land in your tree before getting mainline...

It's quite simple. I wanted to look at the patch, but Andrew beat me to it. I am not saying that I would have spotted the null pointer deref myself :-).

Michal