Re: [PATCH v2] kconfig: fix dangling check_top after an unexpected recursive dependency

[Julian Braha]

On 10/8/26 17:45, Leizhen Zhang wrote:
> If the last symbol of a recursive dependency is a choice value,
> sym_check_print_recursive() pushes the on-stack cv_stack onto the
> dependency stack. If the choice is then not found on the stack, the
> function prints "unexpected recursive dependency error" and returns
> without removing cv_stack again. check_top is left pointing into the
> stack frame of the returned function, and the next dep_stack_remove()
> dereferences it:
> 
>   AddressSanitizer: stack-use-after-return ... in dep_stack_remove
> 
> This can be triggered by an (invalid) Kconfig file in which a symbol is
> a choice value of two choices and the second choice depends on it:
> 
>   choice
>   	prompt "c1"
>   config A
>   	bool "a"
>   endchoice
> 
>   choice
>   	prompt "c2"
>   	depends on A
>   config A
>   	bool "a"
>   endchoice
> 
> Jump to the existing cleanup at the end of the function instead of
> returning directly.
> 
> Found by fuzzing Kconfig input with ASan/UBSan.
> 
> Fixes: d595cea62403 ("kconfig: print more info when we see a recursive dependency")
> Assisted-by: Claude:claude-opus-5-5 ASan UBSan libFuzzer
> Signed-off-by: Leizhen Zhang <lzsx618@xxxxxxxxx>

Reviewed-by: Julian Braha <julianbraha@xxxxxxxxx>