2013-05-07 02:41:46

by Zefan Li

[permalink] [raw]
Subject: [PATCH] menuconfig: fix NULL pointer dereference when searching a symbol

Searching PPC_EFIKA results segmentation fault, and it's because
get_symbol_prop() returns NULL.

In this case CONFIG_PPC_EFIKA is defined in arch/powerpc/platforms/
52xx/Kconfig, so it won't be parsed if ARCH!=PPC, but menuconfig
knows this symbol when it parses sound/soc/fsl/Kconfig:

config SND_MPC52xx_SOC_EFIKA
tristate "SoC AC97 Audio support for bbplan Efika and STAC9766"
depends on PPC_EFIKA

This bug was introduced by commit bcdedcc1afd6 ("menuconfig: print more
info for symbol without prompts").

Reported-by: Borislav Petkov <[email protected]>
Signed-off-by: Li Zefan <[email protected]>
---
scripts/kconfig/menu.c | 16 ++++++++++------
1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/scripts/kconfig/menu.c b/scripts/kconfig/menu.c
index 826da66..b5c7d90 100644
--- a/scripts/kconfig/menu.c
+++ b/scripts/kconfig/menu.c
@@ -600,14 +600,18 @@ void get_symbol_str(struct gstr *r, struct symbol *sym,
}
for_all_prompts(sym, prop)
get_prompt_str(r, prop, head);
+
prop = get_symbol_prop(sym);
- str_printf(r, _(" Defined at %s:%d\n"), prop->menu->file->name,
- prop->menu->lineno);
- if (!expr_is_yes(prop->visible.expr)) {
- str_append(r, _(" Depends on: "));
- expr_gstr_print(prop->visible.expr, r);
- str_append(r, "\n");
+ if (prop) {
+ str_printf(r, _(" Defined at %s:%d\n"), prop->menu->file->name,
+ prop->menu->lineno);
+ if (!expr_is_yes(prop->visible.expr)) {
+ str_append(r, _(" Depends on: "));
+ expr_gstr_print(prop->visible.expr, r);
+ str_append(r, "\n");
+ }
}
+
hit = false;
for_all_properties(sym, prop, P_SELECT) {
if (!hit) {
--
1.8.0.2


2013-05-07 02:49:39

by Libo Chen

[permalink] [raw]
Subject: Re: [PATCH] menuconfig: fix NULL pointer dereference when searching a symbol

On 2013/5/7 10:40, Li Zefan wrote:
> Searching PPC_EFIKA results segmentation fault, and it's because
> get_symbol_prop() returns NULL.
>
> In this case CONFIG_PPC_EFIKA is defined in arch/powerpc/platforms/
> 52xx/Kconfig, so it won't be parsed if ARCH!=PPC, but menuconfig
> knows this symbol when it parses sound/soc/fsl/Kconfig:
>
> config SND_MPC52xx_SOC_EFIKA
> tristate "SoC AC97 Audio support for bbplan Efika and STAC9766"
> depends on PPC_EFIKA
>
> This bug was introduced by commit bcdedcc1afd6 ("menuconfig: print more
> info for symbol without prompts").


It works!

Tested-by: Libo Chen <[email protected]>

>
> Reported-by: Borislav Petkov <[email protected]>
> Signed-off-by: Li Zefan <[email protected]>
> ---
> scripts/kconfig/menu.c | 16 ++++++++++------
> 1 file changed, 10 insertions(+), 6 deletions(-)
>
> diff --git a/scripts/kconfig/menu.c b/scripts/kconfig/menu.c
> index 826da66..b5c7d90 100644
> --- a/scripts/kconfig/menu.c
> +++ b/scripts/kconfig/menu.c
> @@ -600,14 +600,18 @@ void get_symbol_str(struct gstr *r, struct symbol *sym,
> }
> for_all_prompts(sym, prop)
> get_prompt_str(r, prop, head);
> +
> prop = get_symbol_prop(sym);
> - str_printf(r, _(" Defined at %s:%d\n"), prop->menu->file->name,
> - prop->menu->lineno);
> - if (!expr_is_yes(prop->visible.expr)) {
> - str_append(r, _(" Depends on: "));
> - expr_gstr_print(prop->visible.expr, r);
> - str_append(r, "\n");
> + if (prop) {
> + str_printf(r, _(" Defined at %s:%d\n"), prop->menu->file->name,
> + prop->menu->lineno);
> + if (!expr_is_yes(prop->visible.expr)) {
> + str_append(r, _(" Depends on: "));
> + expr_gstr_print(prop->visible.expr, r);
> + str_append(r, "\n");
> + }
> }
> +
> hit = false;
> for_all_properties(sym, prop, P_SELECT) {
> if (!hit) {
>

2013-05-07 10:43:07

by Borislav Petkov

[permalink] [raw]
Subject: Re: [PATCH] menuconfig: fix NULL pointer dereference when searching a symbol

On Tue, May 07, 2013 at 10:40:59AM +0800, Li Zefan wrote:
> Searching PPC_EFIKA results segmentation fault, and it's because
> get_symbol_prop() returns NULL.
>
> In this case CONFIG_PPC_EFIKA is defined in arch/powerpc/platforms/
> 52xx/Kconfig, so it won't be parsed if ARCH!=PPC, but menuconfig
> knows this symbol when it parses sound/soc/fsl/Kconfig:
>
> config SND_MPC52xx_SOC_EFIKA
> tristate "SoC AC97 Audio support for bbplan Efika and STAC9766"
> depends on PPC_EFIKA
>
> This bug was introduced by commit bcdedcc1afd6 ("menuconfig: print more
> info for symbol without prompts").

Yep, it works.

> Reported-by: Borislav Petkov <[email protected]>

..-and-tested-by: ...

Thanks.

--
Regards/Gruss,
Boris.

Sent from a fat crate under my desk. Formatting is fine.
--

2013-05-07 13:22:08

by Yann E. MORIN

[permalink] [raw]
Subject: Re: [PATCH] menuconfig: fix NULL pointer dereference when searching a symbol

Li, All,

On Tue, May 07, 2013 at 10:40:59AM +0800, Li Zefan wrote:
> Searching PPC_EFIKA results segmentation fault, and it's because
> get_symbol_prop() returns NULL.
>
> In this case CONFIG_PPC_EFIKA is defined in arch/powerpc/platforms/
> 52xx/Kconfig, so it won't be parsed if ARCH!=PPC, but menuconfig
> knows this symbol when it parses sound/soc/fsl/Kconfig:
>
> config SND_MPC52xx_SOC_EFIKA
> tristate "SoC AC97 Audio support for bbplan Efika and STAC9766"
> depends on PPC_EFIKA
>
> This bug was introduced by commit bcdedcc1afd6 ("menuconfig: print more
> info for symbol without prompts").
>
> Reported-by: Borislav Petkov <[email protected]>
> Signed-off-by: Li Zefan <[email protected]>

Reviewed-by: "Yann E. MORIN" <[email protected]>

Michal, I'll get this in my tree, and will send a pull-request to you
later (I may have a few other smallish fixes shortly).

Regards,
Yann E. MORIN.

--
.-----------------.--------------------.------------------.--------------------.
| Yann E. MORIN | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software Designer | \ / CAMPAIGN | ___ |
| +33 223 225 172 `------------.-------: X AGAINST | \e/ There is no |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL | v conspiracy. |
'------------------------------^-------^------------------^--------------------'

2013-05-07 13:47:25

by Michal Marek

[permalink] [raw]
Subject: Re: [PATCH] menuconfig: fix NULL pointer dereference when searching a symbol

On 7.5.2013 15:21, Yann E. MORIN wrote:
> Li, All,
>
> On Tue, May 07, 2013 at 10:40:59AM +0800, Li Zefan wrote:
>> Searching PPC_EFIKA results segmentation fault, and it's because
>> get_symbol_prop() returns NULL.
>>
>> In this case CONFIG_PPC_EFIKA is defined in arch/powerpc/platforms/
>> 52xx/Kconfig, so it won't be parsed if ARCH!=PPC, but menuconfig
>> knows this symbol when it parses sound/soc/fsl/Kconfig:
>>
>> config SND_MPC52xx_SOC_EFIKA
>> tristate "SoC AC97 Audio support for bbplan Efika and STAC9766"
>> depends on PPC_EFIKA
>>
>> This bug was introduced by commit bcdedcc1afd6 ("menuconfig: print more
>> info for symbol without prompts").
>>
>> Reported-by: Borislav Petkov <[email protected]>
>> Signed-off-by: Li Zefan <[email protected]>
>
> Reviewed-by: "Yann E. MORIN" <[email protected]>
>
> Michal, I'll get this in my tree, and will send a pull-request to you
> later (I may have a few other smallish fixes shortly).

It's difficult to apply this to kbuild.git#kconfig, because the bug that
it is fixing is not there. I will send it to Linus by mail.

Michal

2013-05-07 14:06:50

by Yann E. MORIN

[permalink] [raw]
Subject: Re: [PATCH] menuconfig: fix NULL pointer dereference when searching a symbol

Michal, All,

On Tue, May 07, 2013 at 03:47:18PM +0200, Michal Marek wrote:
> On 7.5.2013 15:21, Yann E. MORIN wrote:
> > Li, All,
> >
> > On Tue, May 07, 2013 at 10:40:59AM +0800, Li Zefan wrote:
> >> Searching PPC_EFIKA results segmentation fault, and it's because
> >> get_symbol_prop() returns NULL.
> >>
> >> In this case CONFIG_PPC_EFIKA is defined in arch/powerpc/platforms/
> >> 52xx/Kconfig, so it won't be parsed if ARCH!=PPC, but menuconfig
> >> knows this symbol when it parses sound/soc/fsl/Kconfig:
> >>
> >> config SND_MPC52xx_SOC_EFIKA
> >> tristate "SoC AC97 Audio support for bbplan Efika and STAC9766"
> >> depends on PPC_EFIKA
> >>
> >> This bug was introduced by commit bcdedcc1afd6 ("menuconfig: print more
> >> info for symbol without prompts").
> >>
> >> Reported-by: Borislav Petkov <[email protected]>
> >> Signed-off-by: Li Zefan <[email protected]>
> >
> > Reviewed-by: "Yann E. MORIN" <[email protected]>
> >
> > Michal, I'll get this in my tree, and will send a pull-request to you
> > later (I may have a few other smallish fixes shortly).
>
> It's difficult to apply this to kbuild.git#kconfig, because the bug that
> it is fixing is not there. I will send it to Linus by mail.

Indeed. Thank you.

It's strange that a kconfig-related change did not land in your tree
before getting mainline...

[For the records, it got in via akpm's (Andrew MORTON) branch in
5f56886 ;-) ]

Regards,
Yann E. MORIN.

--
.-----------------.--------------------.------------------.--------------------.
| Yann E. MORIN | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software Designer | \ / CAMPAIGN | ___ |
| +33 223 225 172 `------------.-------: X AGAINST | \e/ There is no |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL | v conspiracy. |
'------------------------------^-------^------------------^--------------------'

2013-05-07 14:13:45

by Michal Marek

[permalink] [raw]
Subject: Re: [PATCH] menuconfig: fix NULL pointer dereference when searching a symbol

Dne 7.5.2013 16:06, Yann E. MORIN napsal(a):
> It's strange that a kconfig-related change did not land in your tree
> before getting mainline...

It's quite simple. I wanted to look at the patch, but Andrew beat me to
it. I am not saying that I would have spotted the null pointer deref
myself :-).

Michal