mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
From: Leizhen Zhang <lzsx618@gmail.com>
To: nathan@kernel.org, nsc@kernel.org
Cc: rostedt@goodmis.org, linux-kbuild@vger.kernel.org,
	linux-kernel@vger.kernel.org
Subject: [PATCH v2 6/8] modpost: fix pointer arithmetic on NULL in parse_source_files()
Date: Thu,  8 Oct 2026 11:40:33 -0500	[thread overview]
Message-ID: <20261008164035.3668885-7-lzsx618@gmail.com> (raw)
In-Reply-To: <20261008164035.3668885-1-lzsx618@gmail.com>

parse_source_files() checks whether a dependency is in the same directory
as the object file with

  (strstr(line, dir) + strlen(dir) - 1) == strrchr(line, '/')

When the dependency is not below dir, strstr() returns NULL and the
pointer arithmetic on NULL is undefined behaviour. This happens for
every module with dependencies outside its own directory, and UBSan
reports:

  scripts/mod/sumversion.c: runtime error: applying non-zero offset
  to null pointer

Check the result of strstr() before using it.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Assisted-by: Claude:claude-opus-5-5 UBSan
Signed-off-by: Leizhen Zhang <lzsx618@gmail.com>
---
v2:
 - Use my real name in the From and Signed-off-by lines. No code
   changes.

v1: https://lore.kernel.org/r/20261005104050.1786222-8-lzsx618@gmail.com

 scripts/mod/sumversion.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/scripts/mod/sumversion.c b/scripts/mod/sumversion.c
index 3dd28b4d00..4c59e7cfbc 100644
--- a/scripts/mod/sumversion.c
+++ b/scripts/mod/sumversion.c
@@ -364,7 +364,8 @@ static int parse_source_files(const char *objfile, struct md4_ctx *md)
 		}
 
 		/* Check if this file is in same dir as objfile */
-		if ((strstr(line, dir)+strlen(dir)-1) == strrchr(line, '/')) {
+		p = strstr(line, dir);
+		if (p && p + dirlen - 1 == strrchr(line, '/')) {
 			if (!parse_file(line, md)) {
 				warn("could not open %s: %s\n",
 				     line, strerror(errno));
-- 
2.34.1


  parent reply	other threads:[~2026-10-08 16:40 UTC|newest]

Thread overview: 9+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-10-08 16:40 [PATCH v2 0/8] kbuild: fix memory safety and UB bugs in host tools found by fuzzing Leizhen Zhang
2026-10-08 16:40 ` [PATCH v2 1/8] genksyms: fix infinite loop on declarations with parameter lists Leizhen Zhang
2026-10-08 16:40 ` [PATCH v2 2/8] fixdep: fix out-of-bounds read on a comment ending with a backslash Leizhen Zhang
2026-10-08 16:40 ` [PATCH v2 3/8] kallsyms: do not call qsort() with a NULL table Leizhen Zhang
2026-10-08 16:40 ` [PATCH v2 4/8] modpost: fix stack out-of-bounds read for unterminated PNP ids Leizhen Zhang
2026-10-08 16:40 ` [PATCH v2 5/8] modpost: fix handling of short reads in read_text_file() Leizhen Zhang
2026-10-08 16:40 ` Leizhen Zhang [this message]
2026-10-08 16:40 ` [PATCH v2 7/8] sorttable: avoid pointer arithmetic overflow when locating sort_needed Leizhen Zhang
2026-10-08 16:40 ` [PATCH v2 8/8] tools/include: fix signed shift overflow in 32-bit unaligned accessors Leizhen Zhang

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20261008164035.3668885-7-lzsx618@gmail.com \
    --to=lzsx618@gmail.com \
    --cc=linux-kbuild@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=nathan@kernel.org \
    --cc=nsc@kernel.org \
    --cc=rostedt@goodmis.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox

all inboxes | Powered by JetHome®