diff mbox

kconfig: Avoid buffer underrun in choice input

Message ID 1303580576.4815.3.camel@localhost (mailing list archive)
State New, archived
Headers show

Commit Message

Ben Hutchings April 23, 2011, 5:42 p.m. UTC
commit 40aee729b350672c2550640622416a855e27938f ('kconfig: fix default
value for choice input') fixed some cases where kconfig would select
the wrong option from a choice with a single valid option and thus
enter an infinite loop.

However, this broke the test for user input of the form 'N?', because
when kconfig selects the single valid option the input is zero-length
and the test will read the byte before the input buffer.  If this
happens to contain '?' (as it will in a mips build on Debian unstable
today) then kconfig again enters an infinite loop.

Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: stable@kernel.org [2.6.17+]
---
Roman has failed to respond to this after 5 weeks and one reminder, so
please take it directly.

Ben.

 scripts/kconfig/conf.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

Comments

Sam Ravnborg April 23, 2011, 6:04 p.m. UTC | #1
On Sat, Apr 23, 2011 at 06:42:56PM +0100, Ben Hutchings wrote:
> commit 40aee729b350672c2550640622416a855e27938f ('kconfig: fix default
> value for choice input') fixed some cases where kconfig would select
> the wrong option from a choice with a single valid option and thus
> enter an infinite loop.
> 
> However, this broke the test for user input of the form 'N?', because
> when kconfig selects the single valid option the input is zero-length
> and the test will read the byte before the input buffer.  If this
> happens to contain '?' (as it will in a mips build on Debian unstable
> today) then kconfig again enters an infinite loop.
> 
> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
> Cc: stable@kernel.org [2.6.17+]
> ---
> Roman has failed to respond to this after 5 weeks and one reminder, so
> please take it directly.

No-one has heard from Roman Zippel in several years.
I have suggested Michal Marek to take over the maintainer
role - as he in practice is the kconfig maintainer.

	Sam
--
To unsubscribe from this list: send the line "unsubscribe linux-kbuild" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Michal Marek April 27, 2011, 11:19 a.m. UTC | #2
On 23.4.2011 19:42, Ben Hutchings wrote:
> commit 40aee729b350672c2550640622416a855e27938f ('kconfig: fix default
> value for choice input') fixed some cases where kconfig would select
> the wrong option from a choice with a single valid option and thus
> enter an infinite loop.
>
> However, this broke the test for user input of the form 'N?', because
> when kconfig selects the single valid option the input is zero-length
> and the test will read the byte before the input buffer.  If this
> happens to contain '?' (as it will in a mips build on Debian unstable
> today) then kconfig again enters an infinite loop.
>
> Signed-off-by: Ben Hutchings<ben@decadent.org.uk>
> Cc: stable@kernel.org [2.6.17+]
> ---
> Roman has failed to respond to this after 5 weeks and one reminder, so
> please take it directly.

I applied this on 8th April, see
http://www.spinics.net/lists/linux-kbuild/msg04431.html. Please check 
linux-next before reposting patches next time, now I either have to 
rewind the kconfig branch or let Linus merge it with a duplicate commit :-(.

Michal
--
To unsubscribe from this list: send the line "unsubscribe linux-kbuild" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Ben Hutchings April 27, 2011, 1:12 p.m. UTC | #3
On Wed, 2011-04-27 at 13:19 +0200, Michal Marek wrote:
> On 23.4.2011 19:42, Ben Hutchings wrote:
> > commit 40aee729b350672c2550640622416a855e27938f ('kconfig: fix default
> > value for choice input') fixed some cases where kconfig would select
> > the wrong option from a choice with a single valid option and thus
> > enter an infinite loop.
> >
> > However, this broke the test for user input of the form 'N?', because
> > when kconfig selects the single valid option the input is zero-length
> > and the test will read the byte before the input buffer.  If this
> > happens to contain '?' (as it will in a mips build on Debian unstable
> > today) then kconfig again enters an infinite loop.
> >
> > Signed-off-by: Ben Hutchings<ben@decadent.org.uk>
> > Cc: stable@kernel.org [2.6.17+]
> > ---
> > Roman has failed to respond to this after 5 weeks and one reminder, so
> > please take it directly.
> 
> I applied this on 8th April, see
> http://www.spinics.net/lists/linux-kbuild/msg04431.html.

Sorry, I forgot that.

> Please check 
> linux-next before reposting patches next time, now I either have to 
> rewind the kconfig branch or let Linus merge it with a duplicate commit :-(.

But the fix belongs in this release (2.6.39), not the next.  So I looked
in Linus' tree.

Ben.
Linus Torvalds April 27, 2011, 5:35 p.m. UTC | #4
On Wed, Apr 27, 2011 at 4:19 AM, Michal Marek <mmarek@suse.cz> wrote:
>
> I applied this on 8th April, see
> http://www.spinics.net/lists/linux-kbuild/msg04431.html. Please check
> linux-next before reposting patches next time, now I either have to rewind
> the kconfig branch or let Linus merge it with a duplicate commit :-(.

Merging the occasional duplicate is normal flow, don't worry about it.
I'd much rather see the occasional smaller diffstat due to a diff that
got applied in both sides than I'd see people rebasing just to avoid
some silly duplicate.

It's if two branches consistently have many duplicates that I react,
because it tends to be some systematic error (often excessive
rebasing, but it could be some "ownership" argument too)

The "occasionally the same fix made it through two different trees" is
not just normal, it's _expected_ in distributed development. If it
never happens, that's a sign that people are serializing overmuch.

                                   Linus
--
To unsubscribe from this list: send the line "unsubscribe linux-kbuild" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/scripts/kconfig/conf.c b/scripts/kconfig/conf.c
index 659326c..006ad81 100644
--- a/scripts/kconfig/conf.c
+++ b/scripts/kconfig/conf.c
@@ -332,7 +332,7 @@  static int conf_choice(struct menu *menu)
 		}
 		if (!child)
 			continue;
-		if (line[strlen(line) - 1] == '?') {
+		if (line[0] && line[strlen(line) - 1] == '?') {
 			print_help(child);
 			continue;
 		}