From: Leizhen Zhang <lzsx618@gmail.com>
To: nathan@kernel.org, nsc@kernel.org
Cc: rostedt@goodmis.org, linux-kbuild@vger.kernel.org,
linux-kernel@vger.kernel.org
Subject: [PATCH v2 6/8] modpost: fix pointer arithmetic on NULL in parse_source_files()
Date: Thu, 8 Oct 2026 11:40:33 -0500 [thread overview]
Message-ID: <20261008164035.3668885-7-lzsx618@gmail.com> (raw)
In-Reply-To: <20261008164035.3668885-1-lzsx618@gmail.com>
parse_source_files() checks whether a dependency is in the same directory
as the object file with
(strstr(line, dir) + strlen(dir) - 1) == strrchr(line, '/')
When the dependency is not below dir, strstr() returns NULL and the
pointer arithmetic on NULL is undefined behaviour. This happens for
every module with dependencies outside its own directory, and UBSan
reports:
scripts/mod/sumversion.c: runtime error: applying non-zero offset
to null pointer
Check the result of strstr() before using it.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Assisted-by: Claude:claude-opus-5-5 UBSan
Signed-off-by: Leizhen Zhang <lzsx618@gmail.com>
---
v2:
- Use my real name in the From and Signed-off-by lines. No code
changes.
v1: https://lore.kernel.org/r/20261005104050.1786222-8-lzsx618@gmail.com
scripts/mod/sumversion.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/scripts/mod/sumversion.c b/scripts/mod/sumversion.c
index 3dd28b4d00..4c59e7cfbc 100644
--- a/scripts/mod/sumversion.c
+++ b/scripts/mod/sumversion.c
@@ -364,7 +364,8 @@ static int parse_source_files(const char *objfile, struct md4_ctx *md)
}
/* Check if this file is in same dir as objfile */
- if ((strstr(line, dir)+strlen(dir)-1) == strrchr(line, '/')) {
+ p = strstr(line, dir);
+ if (p && p + dirlen - 1 == strrchr(line, '/')) {
if (!parse_file(line, md)) {
warn("could not open %s: %s\n",
line, strerror(errno));
--
2.34.1
next prev parent reply other threads:[~2026-10-08 16:40 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-08 16:40 [PATCH v2 0/8] kbuild: fix memory safety and UB bugs in host tools found by fuzzing Leizhen Zhang
2026-10-08 16:40 ` [PATCH v2 1/8] genksyms: fix infinite loop on declarations with parameter lists Leizhen Zhang
2026-10-08 16:40 ` [PATCH v2 2/8] fixdep: fix out-of-bounds read on a comment ending with a backslash Leizhen Zhang
2026-10-08 16:40 ` [PATCH v2 3/8] kallsyms: do not call qsort() with a NULL table Leizhen Zhang
2026-10-08 16:40 ` [PATCH v2 4/8] modpost: fix stack out-of-bounds read for unterminated PNP ids Leizhen Zhang
2026-10-08 16:40 ` [PATCH v2 5/8] modpost: fix handling of short reads in read_text_file() Leizhen Zhang
2026-10-08 16:40 ` Leizhen Zhang [this message]
2026-10-08 16:40 ` [PATCH v2 7/8] sorttable: avoid pointer arithmetic overflow when locating sort_needed Leizhen Zhang
2026-10-08 16:40 ` [PATCH v2 8/8] tools/include: fix signed shift overflow in 32-bit unaligned accessors Leizhen Zhang
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261008164035.3668885-7-lzsx618@gmail.com \
--to=lzsx618@gmail.com \
--cc=linux-kbuild@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=nathan@kernel.org \
--cc=nsc@kernel.org \
--cc=rostedt@goodmis.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®