Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <6ce9877bdf4ac5822786f8ae1ffe3c05aa76aea6.camel@pengutronix.de>
Subject: Re: PROBLEM: Segfault in kconfig
From:   Johannes Zink <j.zink@pengutronix.de>
To:     Masahiro Yamada <masahiroy@kernel.org>
Cc:     linux-kbuild@vger.kernel.org, linux-kernel@vger.kernel.org,
        kernel@pengutronix.de
Date:   Tue, 25 Oct 2022 10:52:07 +0200
In-Reply-To: <CAK7LNAThoCP3FWidnMt0h5y16VrNKKBum2NP3a=RgmaAAAdQGQ@mail.gmail.com>
References: <33059074b78110d4717efe09b887dd28ac77fe7f.camel@pengutronix.de>
         <ba6223f9fcae7d27de439e75f93b3a1352a30890.camel@pengutronix.de>
         <CAK7LNAThoCP3FWidnMt0h5y16VrNKKBum2NP3a=RgmaAAAdQGQ@mail.gmail.com>
Content-Type: text/plain; charset="UTF-8"
User-Agent: Evolution 3.38.3-1 
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Precedence: bulk

Hi Masahiro, 

thank you for looking into the issue. I will check out your patch as
soon as I return from netdevconf next week and test it.

Best regards
Johannes

On Mon, 2022-10-24 at 04:23 +0900, Masahiro Yamada wrote:
> Hi Johannes,
> 
> 
> Sorry for the delay.
> 
> I took a closer look at this.
> 
> 
> I submitted a patch, which I think is a more correct fix.
> 
> https://patchwork.kernel.org/project/linux-kbuild/patch/20221023191055.85098-1-masahiroy@kernel.org/
> 
> 
> 
> Thanks.
> 
> 
> On Thu, Oct 6, 2022 at 10:15 PM Johannes Zink <j.zink@pengutronix.de>
> wrote:
> > 
> > Hi everyone,
> > 
> > On Thu, 2022-09-22 at 18:01 +0200, Johannes Zink wrote:
> > > Hi everyone,
> > > 
> > > [1.] One line summary of the problem:
> > >      kconfig crashes with segfault under rare circumstances
> > > [2.] Full description of the problem/report:
> > >      Under certain circumstances jump keys are displayed on the
> > > search
> > >      results even if a symbol is deactivated by one of its
> > >      dependencies. Using the jump keys then triggers a
> > > segmentation
> > >      fault due to a NULL dereference. Perform the following steps
> > > to
> > >      trigger the issue
> > > 
> > >      1.: ARCH=arm64 make defconfig
> > >      2.: ARCH=arm64 make menuconfig
> > > 
> > >      3.: press '/' key to search for the string "EFI". Use jump
> > > key
> > >          (1) to jump to search result. Press 'n' key to
> > > deactivate
> > > the
> > >          entry.
> > >      4.: press '/' to seach for the string "ACPI". Use the jump
> > > key
> > >          (1) to jump to the search result.
> > > 
> > >      Menuconfig then crashes with a segfault.
> > > 
> > > [3.] Keywords (i.e., modules, networking, kernel):
> > >      kconfig, mconf
> > > [4.] Kernel information
> > > [4.1.] Kernel version (from /proc/version):
> > >        v6.0.0-rc6
> > > [4.2.] Kernel .config file:
> > >        arm64 default defconfig
> > > [5.] Most recent kernel version which did not have the bug:
> > >      v5.15
> > > [6.] Output of Oops.. message (if applicable) with symbolic
> > > information
> > >      resolved (see Documentation/admin-guide/bug-hunting.rst):
> > >      not applicable
> > > [7.] A small shell script or example program which triggers the
> > >      problem (if possible):
> > >      not applicable, please see description in [2.]
> > > [8.] Environment
> > > [8.1.] Software (add the output of the ver_linux script here):
> > >        not applicable
> > > [8.2.] Processor information (from /proc/cpuinfo):
> > >        not applicable
> > > [8.3.] Module information (from /proc/modules):
> > >        not applicable
> > > [8.4.] Loaded driver and hardware information (/proc/ioports,
> > > /proc/iomem):
> > >        not applicable
> > > [8.5.] PCI information ('lspci -vvv' as root):
> > >        not applicable
> > > [8.6.] SCSI information (from /proc/scsi/scsi):
> > >        not applicable
> > > [8.7.] Other information that might be relevant to the problem
> > >        (please look in /proc and include all information that you
> > >        think to be relevant):
> > >        not applicable
> > > [X.] Other notes, patches, fixes, workarounds:
> > > 
> > >      I found that the attached patch is a very hacky workaround
> > > to
> > >      keep menuconfig from crashing, but I am pretty sure the jump
> > >      keys should not have be activated for unaccessable entries
> > > in
> > > the
> > >      first place. I found it quite hard to find the corresponding
> > > part
> > >      in mconf, which is why I decided to send this bugreport
> > > instead
> > >      of sending a patch. Maybe someone on this list either knows
> > > mconf
> > >      really well and can just fix it, or guide me to where I can
> > > dig
> > >      around (though in that case I could really use some help on
> > > how
> > >      to debug menuconfig, since I found it challenging to get it
> > >      working with gdb)
> > > 
> > > Best regards
> > > Johannes
> > > 
> > > ---
> > > scripts/kconfig/mconf.c | 3 ++-
> > >  1 file changed, 2 insertions(+), 1 deletion(-)
> > > 
> > > diff --git a/scripts/kconfig/mconf.c b/scripts/kconfig/mconf.c
> > > index 9d3cf510562f..60a82f701bd3 100644
> > > --- a/scripts/kconfig/mconf.c
> > > +++ b/scripts/kconfig/mconf.c
> > > @@ -447,7 +447,8 @@ static void search_conf(void)
> > >                 again = false;
> > >                 for (i = 0; i < JUMP_NB && keys[i]; i++)
> > >                         if (dres == keys[i]) {
> > > -                               conf(targets[i]->parent,
> > > targets[i]);
> > > +                               if (targets[i]->parent)
> > > +                                       conf(targets[i]->parent,
> > > targets[i]);
> > >                                 again = true;
> > >                         }
> > >                 str_free(&res);
> > > 
> > 
> > Just a gentle ping and TL;DR on this issue:
> > 
> > Menuconfig crashes with a segfault if performing the steps
> > 
> > 1.: ARCH=arm64 make defconfig
> > 2.: ARCH=arm64 make menuconfig
> > 3.: press '/' key to search for the string "EFI". Use jump key
> >     (1) to jump to search result. Press 'n' key to deactivate
> >     the entry.
> > 4.: press '/' to seach for the string "ACPI". Use the jump key
> >     (1) to jump to the search result.
> > 
> > For more details please see the detailed report in the original
> > message.
> > 
> > Has anyone any input on this?
> > 
> > Best regards
> > 
> > --
> > Pengutronix e.K.                | Johannes Zink                  |
> > Steuerwalder Str. 21            | https://www.pengutronix.de/    |
> > 31137 Hildesheim, Germany       | Phone: +49-5121-206917-0       |
> > Amtsgericht Hildesheim, HRA 2686| Fax:   +49-5121-206917-5555    |
> > 
> 
> 

-- 
Pengutronix e.K.                | Johannes Zink                  |
Steuerwalder Str. 21            | https://www.pengutronix.de/    |
31137 Hildesheim, Germany       | Phone: +49-5121-206917-0       |
Amtsgericht Hildesheim, HRA 2686| Fax:   +49-5121-206917-5555    |