[PATCH v2] kconfig: fix infinite loop in conf_choice() when no choice value is visible

[PATCH v2] kconfig: fix infinite loop in conf_choice() when no choice value is visible

[Leizhen Zhang]

If a choice is visible but none of its choice values is, conf_choice()
counts cnt == 0 visible values and finds no default. When the choice has
to be asked, e.g. because a new symbol was added to the same menu
(oldconfig, syncconfig) or because stdin is at EOF (oldaskconfig), the
loop that maps the answer to a menu entry never finds one and the
while (1) loop repeats forever, printing "choice[1-0?]: 0" each time.

This happens in the tree for s390 when the compiler supports none of the
-march=z* options (e.g. a non-s390 host compiler), so that all values of
the "Processor type" choice are invisible:

  $ make ARCH=s390 defconfig
  $ sed -i '/^CONFIG_NR_CPUS=/d' .config
  $ make ARCH=s390 oldconfig     # hangs

Before the removal of tristate choice support, conf_choice() returned
early in this case. Do the same when there is no visible choice value.

Found by fuzzing Kconfig input with ASan/UBSan.

Fixes: fde192511bdb ("kconfig: remove tristate choice support")
Assisted-by: Claude:claude-opus-5-5 libFuzzer
Signed-off-by: Leizhen Zhang <lzsx618@gmail.com>
---
v2:
 - Use my real name in the From and Signed-off-by lines. No code
   changes.

v1: https://lore.kernel.org/r/20261005202451.3461265-1-lzsx618@gmail.com

 scripts/kconfig/conf.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/scripts/kconfig/conf.c b/scripts/kconfig/conf.c
index ca6d9d7359..31c6fd25e6 100644
--- a/scripts/kconfig/conf.c
+++ b/scripts/kconfig/conf.c
@@ -483,6 +483,9 @@ static void conf_choice(struct menu *menu)
 			}
 			printf("\n");
 		}
+		/* Nothing to ask if none of the choice values is visible. */
+		if (!cnt)
+			return;
 		printf("%*schoice", indent - 1, "");
 		if (cnt == 1) {
 			printf("[1]: 1\n");
-- 
2.34.1

Re: [PATCH v2] kconfig: fix infinite loop in conf_choice() when no choice value is visible

[Julian Braha]

On 10/8/26 17:45, Leizhen Zhang wrote:
> If a choice is visible but none of its choice values is, conf_choice()
> counts cnt == 0 visible values and finds no default. When the choice has
> to be asked, e.g. because a new symbol was added to the same menu
> (oldconfig, syncconfig) or because stdin is at EOF (oldaskconfig), the
> loop that maps the answer to a menu entry never finds one and the
> while (1) loop repeats forever, printing "choice[1-0?]: 0" each time.
> 
> This happens in the tree for s390 when the compiler supports none of the
> -march=z* options (e.g. a non-s390 host compiler), so that all values of
> the "Processor type" choice are invisible:
> 
>   $ make ARCH=s390 defconfig
>   $ sed -i '/^CONFIG_NR_CPUS=/d' .config
>   $ make ARCH=s390 oldconfig     # hangs
> 
> Before the removal of tristate choice support, conf_choice() returned
> early in this case. Do the same when there is no visible choice value.
> 
> Found by fuzzing Kconfig input with ASan/UBSan.
> 
> Fixes: fde192511bdb ("kconfig: remove tristate choice support")
> Assisted-by: Claude:claude-opus-5-5 libFuzzer
> Signed-off-by: Leizhen Zhang <lzsx618@gmail.com>

Reviewed-by: Julian Braha <julianbraha@gmail.com>
Tested-by: Julian Braha <julianbraha@gmail.com>