Re: [PATCH v2] kconfig: fix potential NULL pointer dereference in conf_askvalue()

[Nathan Chancellor]

On Sun, Mar 01, 2026 at 05:30:35AM +0000, Xingjing Deng wrote:
> In conf_askvalue(), the 'def' argument (retrieved via sym_get_string_value)
> can be NULL. While current call sites ensure that 'def' is valid,
> calling printf("%s\n", def) is technically undefined behavior and could
> lead to a segmentation fault on certain libc implementations if the
> function were called with a NULL pointer in the future.
> 
> Improve the robustness of conf_askvalue() by providing an empty string
> as a fallback.
> 
> Additionally, remove the redundant re-initialization of the 'line'
> buffer inside the !sym_is_changeable(sym) block, as it is already
> properly initialized at the function entry.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Signed-off-by: Xingjing Deng <micro6947@xxxxxxxxx>
> ---
> 
> v2:
> - Change commit message and use fewer characters in modify.
> - Link to v1: https://lore.kernel.org/all/20260225072246.3475275-1-micro6947@xxxxxxxxx/
> 
>  scripts/kconfig/conf.c | 6 ++----
>  1 file changed, 2 insertions(+), 4 deletions(-)
> 
> diff --git a/scripts/kconfig/conf.c b/scripts/kconfig/conf.c
> index a7b44cd8a..0d32183c5 100644
> --- a/scripts/kconfig/conf.c
> +++ b/scripts/kconfig/conf.c
> @@ -297,9 +297,7 @@ static int conf_askvalue(struct symbol *sym, const char *def)
>  	line[1] = 0;
>  
>  	if (!sym_is_changeable(sym)) {
> -		printf("%s\n", def);
> -		line[0] = '\n';
> -		line[1] = 0;
> +		printf("%s\n", def :? "");

As the kernel test robot pointed out, this should be ?:, not :?. Please
ensure you always test build your changes before sending them out,
especially scripts/kconfig since it runs so early in the build.

When sending a corrected v3, you can include:

Reviewed-by: Nathan Chancellor <nathan@xxxxxxxxxx>

>  		return 0;
>  	}
>  
> @@ -307,7 +305,7 @@ static int conf_askvalue(struct symbol *sym, const char *def)
>  	case oldconfig:
>  	case syncconfig:
>  		if (sym_has_value(sym)) {
> -			printf("%s\n", def);
> +			printf("%s\n", def :? "");
>  			return 0;
>  		}
>  		/* fall through */
> -- 
> 2.25.1
>