[PATCH 0/9] kbuild: fix memory safety and UB bugs in host tools found by fuzzing

From: lzhan011

Date: Mon Oct 05 2026 - 06:45:18 EST


From: lzhan011 <zhangleizhen645@xxxxxxxxx>

This series fixes bugs in kbuild host programs found by building them
with AddressSanitizer and UndefinedBehaviorSanitizer and fuzzing their
inputs. Most patches include a reproducer.

Patches 1 and 2 fix bugs that also trigger without sanitizers:

- kconfig: a string/int/hex symbol whose default is a choice member
gets a NULL value and crashes conf (since v6.11).
- genksyms: a declaration such as "int a, f(int);" makes genksyms loop
forever while allocating memory (since v6.14; earlier versions
silently recorded wrong types for such declarations).

Patches 3-9 fix out-of-bounds reads (fixdep, modpost) and undefined
behaviour reported by UBSan (kallsyms, modpost, sorttable,
tools/include byteshift helpers), several of which trigger on every
normal x86_64 build when the host tools are built with UBSan.

The series is based on next-20261002. With it applied, a defconfig +
MODULES + MODVERSIONS x86_64 build succeeds; for kconfig, the generated
.config files for the def/allyes/allno/allmod/rand configs on seven
architectures are unchanged, and for genksyms, the symtypes/CRCs of 149
preprocessed kernel sources are unchanged.

lzhan011 (9):
kconfig: fix NULL pointer dereference for defaults taken from choice
members
genksyms: fix infinite loop on declarations with parameter lists
fixdep: fix out-of-bounds read on a comment ending with a backslash
kallsyms: do not call qsort() with a NULL table
modpost: fix stack out-of-bounds read for unterminated PNP ids
modpost: fix handling of short reads in read_text_file()
modpost: fix pointer arithmetic on NULL in parse_source_files()
sorttable: avoid pointer arithmetic overflow when locating sort_needed
tools/include: fix signed shift overflow in 32-bit unaligned accessors

scripts/basic/fixdep.c | 2 +-
scripts/genksyms/parse.y | 23 +++++++++++++++++++----
scripts/kallsyms.c | 6 ++++--
scripts/kconfig/symbol.c | 4 ++--
scripts/mod/file2alias.c | 10 ++++++----
scripts/mod/modpost.c | 6 +++++-
scripts/mod/sumversion.c | 3 ++-
scripts/sorttable.c | 2 +-
tools/include/tools/be_byteshift.h | 2 +-
tools/include/tools/le_byteshift.h | 2 +-
10 files changed, 42 insertions(+), 18 deletions(-)

--
2.34.1