linux-kernel - Re: [PATCH] kconfig: fix segmentation fault in menuconfig search

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 31 Oct 2022 18:31:20 +0100
From:   Johannes Zink <j.zink@...gutronix.de>
To:     Masahiro Yamada <masahiroy@...nel.org>,
        linux-kbuild@...r.kernel.org
Cc:     Ariel Marcovitch <arielmarcovitch@...il.com>,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] kconfig: fix segmentation fault in menuconfig search

Hi Masahiro,

On Mon, 2022-10-24 at 04:10 +0900, Masahiro Yamada wrote:
> Since commit d05377e184fc ("kconfig: Create links to main menu items
> in search"), menuconfig shows a jump key next to "Main menu" if the
> nearest visible parent is the rootmenu. If you press that jump key,
> menuconfig crashes with a segmentation fault.
> 
> For example, do this:
> 
>   $ make ARCH=arm64 allnoconfig menuconfig
> 
> Press '/' to search for the string "ACPI". Press '1' to choose
> "(1) Main menu". Then, menuconfig crashed with a segmentation fault.
> 
> The following code in search_conf()
> 
>     conf(targets[i]->parent, targets[i]);
> 
> results in NULL pointer dereference because targets[i] is the
> rootmenu,
> which does not have a parent.
> 
> Commit d05377e184fc tried to fix the issue of top-level items not
> having
> a jump key, but adding the "Main menu" was not the right fix.
> 
> The correct fix is to show the searched item itself. This fixes
> another
> weird behavior described in the comment block.
> 
> Fixes: d05377e184fc ("kconfig: Create links to main menu items in
> search")
> Reported-by: Johannes Zink <j.zink@...gutronix.de>
> Signed-off-by: Masahiro Yamada <masahiroy@...nel.org>

Sorry for the delay, I eventually found time to test your patch, and it
fixes the issue I reported. Thank you for helping out, feel free to add
my

Tested-by: Johannes Zink <j.zink@...gutronix.de>

> ---
> 
>  scripts/kconfig/menu.c | 23 ++++-------------------
>  1 file changed, 4 insertions(+), 19 deletions(-)
> 
> diff --git a/scripts/kconfig/menu.c b/scripts/kconfig/menu.c
> index 62b6313f51c8..109325f31bef 100644
> --- a/scripts/kconfig/menu.c
> +++ b/scripts/kconfig/menu.c
> @@ -722,8 +722,8 @@ static void get_prompt_str(struct gstr *r, struct
> property *prop,
>         if (!expr_eq(prop->menu->dep, prop->visible.expr))
>                 get_dep_str(r, prop->visible.expr, "  Visible if: ");
>  
> -       menu = prop->menu->parent;
> -       for (i = 0; menu && i < 8; menu = menu->parent) {
> +       menu = prop->menu;
> +       for (i = 0; menu != &rootmenu && i < 8; menu = menu->parent)
> {
>                 bool accessible = menu_is_visible(menu);
>  
>                 submenu[i++] = menu;
> @@ -733,16 +733,7 @@ static void get_prompt_str(struct gstr *r,
> struct property *prop,
>         if (head && location) {
>                 jump = xmalloc(sizeof(struct jump_key));
>  
> -               if (menu_is_visible(prop->menu)) {
> -                       /*
> -                        * There is not enough room to put the hint
> at the
> -                        * beginning of the "Prompt" line. Put the
> hint on the
> -                        * last "Location" line even when it would
> belong on
> -                        * the former.
> -                        */
> -                       jump->target = prop->menu;
> -               } else
> -                       jump->target = location;
> +               jump->target = location;
>  
>                 if (list_empty(head))
>                         jump->index = 0;
> @@ -758,13 +749,7 @@ static void get_prompt_str(struct gstr *r,
> struct property *prop,
>                 menu = submenu[i];
>                 if (jump && menu == location)
>                         jump->offset = strlen(r->s);
> -
> -               if (menu == &rootmenu)
> -                       /* The real rootmenu prompt is ugly */
> -                       str_printf(r, "%*cMain menu", j, ' ');
> -               else
> -                       str_printf(r, "%*c-> %s", j, ' ',
> menu_get_prompt(menu));
> -
> +               str_printf(r, "%*c-> %s", j, ' ',
> menu_get_prompt(menu));
>                 if (menu->sym) {
>                         str_printf(r, " (%s [=%s])", menu->sym->name
> ?
>                                 menu->sym->name : "<choice>",

-- 
Pengutronix e.K.                | Johannes Zink                  |
Steuerwalder Str. 21            | https://www.pengutronix.de/    |
31137 Hildesheim, Germany       | Phone: +49-5121-206917-0       |
Amtsgericht Hildesheim, HRA 2686| Fax:   +49-5121-206917-5555    |