Re: [PATCH v2] kconfig: fix infinite loop in conf_choice() when no choice value is visible

[Julian Braha <julianbraha@gmail.com>]

On 10/8/26 17:45, Leizhen Zhang wrote:
> If a choice is visible but none of its choice values is, conf_choice()
> counts cnt == 0 visible values and finds no default. When the choice has
> to be asked, e.g. because a new symbol was added to the same menu
> (oldconfig, syncconfig) or because stdin is at EOF (oldaskconfig), the
> loop that maps the answer to a menu entry never finds one and the
> while (1) loop repeats forever, printing "choice[1-0?]: 0" each time.
> 
> This happens in the tree for s390 when the compiler supports none of the
> -march=z* options (e.g. a non-s390 host compiler), so that all values of
> the "Processor type" choice are invisible:
> 
>   $ make ARCH=s390 defconfig
>   $ sed -i '/^CONFIG_NR_CPUS=/d' .config
>   $ make ARCH=s390 oldconfig     # hangs
> 
> Before the removal of tristate choice support, conf_choice() returned
> early in this case. Do the same when there is no visible choice value.
> 
> Found by fuzzing Kconfig input with ASan/UBSan.
> 
> Fixes: fde192511bdb ("kconfig: remove tristate choice support")
> Assisted-by: Claude:claude-opus-5-5 libFuzzer
> Signed-off-by: Leizhen Zhang <lzsx618@gmail.com>

Reviewed-by: Julian Braha <julianbraha@gmail.com>
Tested-by: Julian Braha <julianbraha@gmail.com>