Re: [PATCH v2] kconfig: fix use-after-free when a variable refers to itself

[Nathan Chancellor]

> For a simply expanded variable, variable_add() frees the old value of an
> existing variable (or allocates a new variable with an uninitialized
> value) before expanding the right-hand side. If the right-hand side
> refers to the variable itself, which is a common idiom in Makefiles,
> e.g.
> 
>   X := 1
>   X := $(X) 2
> 
> the expansion reads the freed (or uninitialized) value. With ASan this
> is reported as a heap-use-after-free, or a SEGV if X was undefined.
> Without ASan, X silently ends up as " 2" instead of "1 2".
> 
> Expand the right-hand side before updating the variable, initialize the
> value of a newly created variable, and only free the old value when it
> is actually replaced. Add a test case for this.
> 
> Found by fuzzing Kconfig input with ASan/UBSan.
> 
> Fixes: 1175c02506ff ("kconfig: support simply expanded variable")
> Assisted-by: Claude:claude-opus-5-5 ASan UBSan libFuzzer
> Signed-off-by: Leizhen Zhang <lzsx618@xxxxxxxxx>

Reviewed-by: Nathan Chancellor <nathan@xxxxxxxxxx>

Just for the future, you can omit Assisted-by per

  1e035297ffda ("docs: remove Assisted-by references")

although I would still like to see how AI was used in the creation of a
patch below the fold '---' like the v2 text.

-- 
Cheers,
Nathan