Re: [PATCH v2] kconfig: fix use-after-free when a variable refers to itself

[Julian Braha]

On 10/8/26 17:45, Leizhen Zhang wrote:
> For a simply expanded variable, variable_add() frees the old value of an
> existing variable (or allocates a new variable with an uninitialized
> value) before expanding the right-hand side. If the right-hand side
> refers to the variable itself, which is a common idiom in Makefiles,
> e.g.
> 
>   X := 1
>   X := $(X) 2
> 
> the expansion reads the freed (or uninitialized) value. With ASan this
> is reported as a heap-use-after-free, or a SEGV if X was undefined.
> Without ASan, X silently ends up as " 2" instead of "1 2".
> 
> Expand the right-hand side before updating the variable, initialize the
> value of a newly created variable, and only free the old value when it
> is actually replaced. Add a test case for this.
> 
> Found by fuzzing Kconfig input with ASan/UBSan.
> 
> Fixes: 1175c02506ff ("kconfig: support simply expanded variable")
> Assisted-by: Claude:claude-opus-5-5 ASan UBSan libFuzzer
> Signed-off-by: Leizhen Zhang <lzsx618@xxxxxxxxx>
Tested-by: Julian Braha <julianbraha@xxxxxxxxx>
Reviewed-by: Julian Braha <julianbraha@xxxxxxxxx>