From: Julian Braha <julianbraha@gmail.com>
To: Ruslan Semchenko <uncleruc2075@gmail.com>, linux-kbuild@vger.kernel.org
Cc: nathan@kernel.org, nsc@kernel.org, masahiroy@kernel.org,
linux-kernel@vger.kernel.org
Subject: Re: [PATCH] kconfig: preprocess: fix UAF and SEGV on self-referencing variables
Date: Mon, 2 Nov 2026 13:08:46 +0000 [thread overview]
Message-ID: <1c3ec0f6-6c6b-4731-9c9f-809a047aa2c0@gmail.com> (raw)
In-Reply-To: <20261102090500.54575-1-uncleruc2075@gmail.com>
Hi Ruslan,
On 11/2/26 09:05, Ruslan Semchenko wrote:
> In variable_add(), when updating an existing simply expanded variable (:=),
> v->value was freed before calling expand_string(value). If the value
> referred to the variable itself (e.g. A := $(A)b), variable_expand()
> accessed the already freed memory, causing a heap-use-after-free.
>
> Furthermore, for a new variable definition, an uninitialized variable
> struct was inserted into variable_list before expanding value. If value
> referred to the variable itself (e.g. B := $(B)x), variable_lookup()
> found the incomplete variable and dereferenced uninitialized v->value,
> causing a segmentation fault.
>
> Fix both issues by computing the new value before modifying the existing
> variable or inserting a new one into variable_list.
Thanks for your time & effort, but this was already caught some time ago:
https://lore.kernel.org/all/20261008164504.3683811-1-lzsx618@gmail.com/
- Julian Braha
prev parent reply other threads:[~2026-11-02 13:08 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-11-02 9:05 Ruslan Semchenko
2026-11-02 13:08 ` Julian Braha [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1c3ec0f6-6c6b-4731-9c9f-809a047aa2c0@gmail.com \
--to=julianbraha@gmail.com \
--cc=linux-kbuild@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=masahiroy@kernel.org \
--cc=nathan@kernel.org \
--cc=nsc@kernel.org \
--cc=uncleruc2075@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®