mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
From: lzhan011 <lzsx618@gmail.com>
To: nathan@kernel.org, nsc@kernel.org
Cc: rostedt@goodmis.org, linux-kbuild@vger.kernel.org,
	linux-kernel@vger.kernel.org
Subject: [PATCH 7/9] modpost: fix pointer arithmetic on NULL in parse_source_files()
Date: Mon,  5 Oct 2026 05:40:48 -0500	[thread overview]
Message-ID: <20261005104050.1786222-8-lzsx618@gmail.com> (raw)
In-Reply-To: <20261005104050.1786222-1-lzsx618@gmail.com>

From: lzhan011 <zhangleizhen645@gmail.com>

parse_source_files() checks whether a dependency is in the same directory
as the object file with

  (strstr(line, dir) + strlen(dir) - 1) == strrchr(line, '/')

When the dependency is not below dir, strstr() returns NULL and the
pointer arithmetic on NULL is undefined behaviour. This happens for
every module with dependencies outside its own directory, and UBSan
reports:

  scripts/mod/sumversion.c: runtime error: applying non-zero offset
  to null pointer

Check the result of strstr() before using it.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Assisted-by: Claude:claude-opus-5-5 UBSan
Signed-off-by: lzhan011 <zhangleizhen645@gmail.com>
---
 scripts/mod/sumversion.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/scripts/mod/sumversion.c b/scripts/mod/sumversion.c
index 3dd28b4d0..4c59e7cfb 100644
--- a/scripts/mod/sumversion.c
+++ b/scripts/mod/sumversion.c
@@ -364,7 +364,8 @@ static int parse_source_files(const char *objfile, struct md4_ctx *md)
 		}
 
 		/* Check if this file is in same dir as objfile */
-		if ((strstr(line, dir)+strlen(dir)-1) == strrchr(line, '/')) {
+		p = strstr(line, dir);
+		if (p && p + dirlen - 1 == strrchr(line, '/')) {
 			if (!parse_file(line, md)) {
 				warn("could not open %s: %s\n",
 				     line, strerror(errno));
-- 
2.34.1


  parent reply	other threads:[~2026-10-05 10:41 UTC|newest]

Thread overview: 11+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-10-05 10:40 [PATCH 0/9] kbuild: fix memory safety and UB bugs in host tools found by fuzzing lzhan011
2026-10-05 10:40 ` [PATCH 1/9] kconfig: fix NULL pointer dereference for defaults taken from choice members lzhan011
2026-10-08 16:04   ` Julian Braha
2026-10-05 10:40 ` [PATCH 2/9] genksyms: fix infinite loop on declarations with parameter lists lzhan011
2026-10-05 10:40 ` [PATCH 3/9] fixdep: fix out-of-bounds read on a comment ending with a backslash lzhan011
2026-10-05 10:40 ` [PATCH 4/9] kallsyms: do not call qsort() with a NULL table lzhan011
2026-10-05 10:40 ` [PATCH 5/9] modpost: fix stack out-of-bounds read for unterminated PNP ids lzhan011
2026-10-05 10:40 ` [PATCH 6/9] modpost: fix handling of short reads in read_text_file() lzhan011
2026-10-05 10:40 ` lzhan011 [this message]
2026-10-05 10:40 ` [PATCH 8/9] sorttable: avoid pointer arithmetic overflow when locating sort_needed lzhan011
2026-10-05 10:40 ` [PATCH 9/9] tools/include: fix signed shift overflow in 32-bit unaligned accessors lzhan011

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20261005104050.1786222-8-lzsx618@gmail.com \
    --to=lzsx618@gmail.com \
    --cc=linux-kbuild@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=nathan@kernel.org \
    --cc=nsc@kernel.org \
    --cc=rostedt@goodmis.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox

all inboxes | Powered by JetHome®