* [PATCH v2 1/5] kconfig: promote invalid numeric reference from warning to error
2026-09-15 21:15 [PATCH v2 0/5] kconfig: improve input validation for numeric options Julian Braha
@ 2026-09-15 21:15 ` Julian Braha
2026-09-17 10:54 ` Nicolas Schier
2026-09-15 21:15 ` [PATCH v2 2/5] kconfig: check for out-of-bounds numeric constants Julian Braha
` (4 subsequent siblings)
5 siblings, 1 reply; 12+ messages in thread
From: Julian Braha @ 2026-09-15 21:15 UTC (permalink / raw)
To: nathan, nsc
Cc: nico, rdunlap, grahamr, kees, pengpeng, vegard.nossum,
linux-kernel, linux-kbuild, Julian Braha
The Kconfig interpreter already warns if a numeric option attempts to use
a non-numeric option (bool, tristate, or string) to set its value (for
example, with a 'default' or 'range').
Since there is nowhere in the tree that attempts this, we can safely
promote this check from warning to error.
Assisted-by: LLM
Signed-off-by: Julian Braha <julianbraha@gmail.com>
---
scripts/kconfig/lkc.h | 2 +-
| 39 ++++++----
scripts/kconfig/parser.y | 2 +-
.../tests/err_num_non_numeric_ref/Kconfig | 75 +++++++++++++++++++
.../tests/err_num_non_numeric_ref/__init__.py | 9 +++
.../err_num_non_numeric_ref/expected_stderr | 14 ++++
6 files changed, 126 insertions(+), 15 deletions(-)
create mode 100644 scripts/kconfig/tests/err_num_non_numeric_ref/Kconfig
create mode 100644 scripts/kconfig/tests/err_num_non_numeric_ref/__init__.py
create mode 100644 scripts/kconfig/tests/err_num_non_numeric_ref/expected_stderr
diff --git a/scripts/kconfig/lkc.h b/scripts/kconfig/lkc.h
index 7e6f6ca299cf..bbc99f75b416 100644
--- a/scripts/kconfig/lkc.h
+++ b/scripts/kconfig/lkc.h
@@ -89,7 +89,7 @@ struct property *menu_add_prompt(enum prop_type type, const char *prompt,
struct expr *dep);
void menu_add_expr(enum prop_type type, struct expr *expr, struct expr *dep);
void menu_add_symbol(enum prop_type type, struct symbol *sym, struct expr *dep);
-void menu_finalize(void);
+int menu_finalize(void);
void menu_set_type(int type);
extern struct menu rootmenu;
--git a/scripts/kconfig/menu.c b/scripts/kconfig/menu.c
index 9c079e92a9ed..99a57ce0fdc9 100644
--- a/scripts/kconfig/menu.c
+++ b/scripts/kconfig/menu.c
@@ -240,11 +240,12 @@ static int menu_validate_number(struct symbol *sym, struct symbol *sym2)
(sym2->type == S_UNKNOWN && sym_string_valid(sym, sym2->name));
}
-static void sym_check_prop(struct symbol *sym)
+static int sym_check_prop(struct symbol *sym)
{
struct property *prop;
struct symbol *sym2;
char *use;
+ int errors = 0;
for (prop = sym->prop; prop; prop = prop->next) {
switch (prop->type) {
@@ -258,10 +259,13 @@ static void sym_check_prop(struct symbol *sym)
break;
sym2 = prop_get_symbol(prop);
if (sym->type == S_HEX || sym->type == S_INT) {
- if (!menu_validate_number(sym, sym2))
- prop_warn(prop,
- "'%s': number is invalid",
- sym->name);
+ if (!menu_validate_number(sym, sym2)) {
+ fprintf(stderr,
+ "%s:%d: error: '%s': number is invalid\n",
+ prop->filename, prop->lineno,
+ sym->name);
+ errors++;
+ }
}
if (sym_is_choice(sym)) {
struct menu *choice = sym_get_choice_menu(sym2);
@@ -293,21 +297,28 @@ static void sym_check_prop(struct symbol *sym)
prop_warn(prop, "range is only allowed "
"for int or hex symbols");
if (!menu_validate_number(sym, prop->expr->left.sym) ||
- !menu_validate_number(sym, prop->expr->right.sym))
- prop_warn(prop, "range is invalid");
+ !menu_validate_number(sym, prop->expr->right.sym)) {
+ fprintf(stderr,
+ "%s:%d: error: range is invalid\n",
+ prop->filename, prop->lineno);
+ errors++;
+ }
break;
default:
;
}
}
+
+ return errors;
}
-static void _menu_finalize(struct menu *parent, bool inside_choice)
+static int _menu_finalize(struct menu *parent, bool inside_choice)
{
struct menu *menu, *last_menu;
struct symbol *sym;
struct property *prop;
struct expr *basedep, *dep, *dep2;
+ int errors = 0;
sym = parent->sym;
if (parent->list) {
@@ -393,7 +404,7 @@ static void _menu_finalize(struct menu *parent, bool inside_choice)
* moving on
*/
for (menu = parent->list; menu; menu = menu->next)
- _menu_finalize(menu, sym && sym_is_choice(sym));
+ errors += _menu_finalize(menu, sym && sym_is_choice(sym));
} else if (!inside_choice && sym) {
/*
* Automatic submenu creation. If sym is a symbol and A, B, C,
@@ -461,7 +472,7 @@ static void _menu_finalize(struct menu *parent, bool inside_choice)
}
/* Superset, put in submenu */
next:
- _menu_finalize(menu, false);
+ errors += _menu_finalize(menu, false);
menu->parent = parent;
last_menu = menu;
}
@@ -519,14 +530,16 @@ static void _menu_finalize(struct menu *parent, bool inside_choice)
menu_warn(parent, "config symbol defined without type");
/* Check properties connected to this symbol */
- sym_check_prop(sym);
+ errors += sym_check_prop(sym);
sym->flags |= SYMBOL_WARNED;
}
+
+ return errors;
}
-void menu_finalize(void)
+int menu_finalize(void)
{
- _menu_finalize(&rootmenu, false);
+ return _menu_finalize(&rootmenu, false);
}
bool menu_has_prompt(const struct menu *menu)
diff --git a/scripts/kconfig/parser.y b/scripts/kconfig/parser.y
index 5fb6f07b6ad2..40ceb9908c6f 100644
--- a/scripts/kconfig/parser.y
+++ b/scripts/kconfig/parser.y
@@ -587,7 +587,7 @@ void conf_parse(const char *name)
menu_add_prompt(P_MENU, "Main menu", NULL);
}
- menu_finalize();
+ yynerrs += menu_finalize();
menu_for_each_entry(menu) {
struct menu *child;
diff --git a/scripts/kconfig/tests/err_num_non_numeric_ref/Kconfig b/scripts/kconfig/tests/err_num_non_numeric_ref/Kconfig
new file mode 100644
index 000000000000..0ca7a4a460f6
--- /dev/null
+++ b/scripts/kconfig/tests/err_num_non_numeric_ref/Kconfig
@@ -0,0 +1,75 @@
+# SPDX-License-Identifier: GPL-2.0
+# Test non-numeric symbol references from numeric symbols
+
+config BOOL_SOURCE
+ bool
+
+config TRISTATE_SOURCE
+ tristate
+
+config STRING_SOURCE
+ string
+
+# Invalid int defaults
+
+config INT_DEFAULT_BOOL
+ int
+ default BOOL_SOURCE
+
+config INT_DEFAULT_TRISTATE
+ int
+ default TRISTATE_SOURCE
+
+config INT_DEFAULT_STRING
+ int
+ default STRING_SOURCE
+
+# Invalid hex defaults
+
+config HEX_DEFAULT_BOOL
+ hex
+ default BOOL_SOURCE
+
+config HEX_DEFAULT_TRISTATE
+ hex
+ default TRISTATE_SOURCE
+
+config HEX_DEFAULT_STRING
+ hex
+ default STRING_SOURCE
+
+# Invalid int ranges
+
+config INT_RANGE_BOOL
+ int
+ range BOOL_SOURCE 1
+
+config INT_RANGE_TRISTATE
+ int
+ range TRISTATE_SOURCE 1
+
+config INT_RANGE_STRING
+ int
+ range STRING_SOURCE 1
+
+config INT_RANGE_MULTIPLE
+ int
+ range BOOL_SOURCE TRISTATE_SOURCE
+
+# Invalid hex ranges
+
+config HEX_RANGE_BOOL
+ hex
+ range BOOL_SOURCE 0x1
+
+config HEX_RANGE_TRISTATE
+ hex
+ range TRISTATE_SOURCE 0x1
+
+config HEX_RANGE_STRING
+ hex
+ range STRING_SOURCE 0x1
+
+config HEX_RANGE_MULTIPLE
+ hex
+ range BOOL_SOURCE TRISTATE_SOURCE
diff --git a/scripts/kconfig/tests/err_num_non_numeric_ref/__init__.py b/scripts/kconfig/tests/err_num_non_numeric_ref/__init__.py
new file mode 100644
index 000000000000..9632907abead
--- /dev/null
+++ b/scripts/kconfig/tests/err_num_non_numeric_ref/__init__.py
@@ -0,0 +1,9 @@
+# SPDX-License-Identifier: GPL-2.0
+"""
+Reject nonnumeric symbol references from int and hex properties.
+"""
+
+
+def test(conf):
+ assert conf.olddefconfig() == 1
+ assert conf.stderr_matches('expected_stderr')
diff --git a/scripts/kconfig/tests/err_num_non_numeric_ref/expected_stderr b/scripts/kconfig/tests/err_num_non_numeric_ref/expected_stderr
new file mode 100644
index 000000000000..4974ba2fcd9c
--- /dev/null
+++ b/scripts/kconfig/tests/err_num_non_numeric_ref/expected_stderr
@@ -0,0 +1,14 @@
+Kconfig:17: error: 'INT_DEFAULT_BOOL': number is invalid
+Kconfig:21: error: 'INT_DEFAULT_TRISTATE': number is invalid
+Kconfig:25: error: 'INT_DEFAULT_STRING': number is invalid
+Kconfig:31: error: 'HEX_DEFAULT_BOOL': number is invalid
+Kconfig:35: error: 'HEX_DEFAULT_TRISTATE': number is invalid
+Kconfig:39: error: 'HEX_DEFAULT_STRING': number is invalid
+Kconfig:45: error: range is invalid
+Kconfig:49: error: range is invalid
+Kconfig:53: error: range is invalid
+Kconfig:57: error: range is invalid
+Kconfig:63: error: range is invalid
+Kconfig:67: error: range is invalid
+Kconfig:71: error: range is invalid
+Kconfig:75: error: range is invalid
--
2.55.0
^ permalink raw reply [flat|nested] 12+ messages in thread* Re: [PATCH v2 1/5] kconfig: promote invalid numeric reference from warning to error
2026-09-15 21:15 ` [PATCH v2 1/5] kconfig: promote invalid numeric reference from warning to error Julian Braha
@ 2026-09-17 10:54 ` Nicolas Schier
0 siblings, 0 replies; 12+ messages in thread
From: Nicolas Schier @ 2026-09-17 10:54 UTC (permalink / raw)
To: Julian Braha
Cc: nathan, nico, rdunlap, grahamr, kees, pengpeng, vegard.nossum,
linux-kernel, linux-kbuild
On Tue, Sep 15, 2026 at 10:15:04PM +0100, Julian Braha wrote:
> The Kconfig interpreter already warns if a numeric option attempts to use
> a non-numeric option (bool, tristate, or string) to set its value (for
> example, with a 'default' or 'range').
>
> Since there is nowhere in the tree that attempts this, we can safely
> promote this check from warning to error.
>
> Assisted-by: LLM
> Signed-off-by: Julian Braha <julianbraha@gmail.com>
> ---
> scripts/kconfig/lkc.h | 2 +-
> scripts/kconfig/menu.c | 39 ++++++----
> scripts/kconfig/parser.y | 2 +-
> .../tests/err_num_non_numeric_ref/Kconfig | 75 +++++++++++++++++++
> .../tests/err_num_non_numeric_ref/__init__.py | 9 +++
> .../err_num_non_numeric_ref/expected_stderr | 14 ++++
> 6 files changed, 126 insertions(+), 15 deletions(-)
> create mode 100644 scripts/kconfig/tests/err_num_non_numeric_ref/Kconfig
> create mode 100644 scripts/kconfig/tests/err_num_non_numeric_ref/__init__.py
> create mode 100644 scripts/kconfig/tests/err_num_non_numeric_ref/expected_stderr
>
> diff --git a/scripts/kconfig/lkc.h b/scripts/kconfig/lkc.h
> index 7e6f6ca299cf..bbc99f75b416 100644
> --- a/scripts/kconfig/lkc.h
> +++ b/scripts/kconfig/lkc.h
> @@ -89,7 +89,7 @@ struct property *menu_add_prompt(enum prop_type type, const char *prompt,
> struct expr *dep);
> void menu_add_expr(enum prop_type type, struct expr *expr, struct expr *dep);
> void menu_add_symbol(enum prop_type type, struct symbol *sym, struct expr *dep);
> -void menu_finalize(void);
> +int menu_finalize(void);
> void menu_set_type(int type);
>
> extern struct menu rootmenu;
> diff --git a/scripts/kconfig/menu.c b/scripts/kconfig/menu.c
> index 9c079e92a9ed..99a57ce0fdc9 100644
> --- a/scripts/kconfig/menu.c
> +++ b/scripts/kconfig/menu.c
> @@ -240,11 +240,12 @@ static int menu_validate_number(struct symbol *sym, struct symbol *sym2)
> (sym2->type == S_UNKNOWN && sym_string_valid(sym, sym2->name));
> }
>
> -static void sym_check_prop(struct symbol *sym)
> +static int sym_check_prop(struct symbol *sym)
> {
> struct property *prop;
> struct symbol *sym2;
> char *use;
> + int errors = 0;
>
> for (prop = sym->prop; prop; prop = prop->next) {
> switch (prop->type) {
> @@ -258,10 +259,13 @@ static void sym_check_prop(struct symbol *sym)
> break;
> sym2 = prop_get_symbol(prop);
> if (sym->type == S_HEX || sym->type == S_INT) {
> - if (!menu_validate_number(sym, sym2))
> - prop_warn(prop,
> - "'%s': number is invalid",
> - sym->name);
> + if (!menu_validate_number(sym, sym2)) {
> + fprintf(stderr,
> + "%s:%d: error: '%s': number is invalid\n",
> + prop->filename, prop->lineno,
> + sym->name);
I think it would be reasonable to add a prop_err() function for that.
But that's a possible follow-up.
Reviewed-by: Nicolas Schier <n.schier@fritz.com>
--
Nicolas
^ permalink raw reply [flat|nested] 12+ messages in thread
* [PATCH v2 2/5] kconfig: check for out-of-bounds numeric constants
2026-09-15 21:15 [PATCH v2 0/5] kconfig: improve input validation for numeric options Julian Braha
2026-09-15 21:15 ` [PATCH v2 1/5] kconfig: promote invalid numeric reference from warning to error Julian Braha
@ 2026-09-15 21:15 ` Julian Braha
2026-09-17 15:13 ` Nicolas Schier
2026-09-15 21:15 ` [PATCH v2 3/5] kconfig: check for hex and int mismatches Julian Braha
` (3 subsequent siblings)
5 siblings, 1 reply; 12+ messages in thread
From: Julian Braha @ 2026-09-15 21:15 UTC (permalink / raw)
To: nathan, nsc
Cc: nico, rdunlap, grahamr, kees, pengpeng, vegard.nossum,
linux-kernel, linux-kbuild, Julian Braha
The Kconfig interpreter internally represents constants as strings, then
attempts to parse them as 64-bit signed integers for 'int' options, and
64-bit unsigned integers for 'hex' options.
However, there is currently no check that the conversion succeeds, leading
to failures when the values are actually used. For example:
config LARGE_INT
int
default 10000000000000000000
config BUGGED_INT_COMPARISON
bool
default y if LARGE_INT < 2
Obviously 10000000000000000000 is larger than 2, but the Kconfig
interpreter will fallback to comparing the two values with strcmp() after
the numeric conversion fails, causing the first character, '1', to be
compared with '2', and giving the wrong result.
Since none of these out-of-bounds values are used as constants anywhere in
the tree, we can already make these error out.
Assisted-by: LLM
Signed-off-by: Julian Braha <julianbraha@gmail.com>
---
| 60 ++++++++++----
scripts/kconfig/tests/err_num_bounds/Kconfig | 79 +++++++++++++++++++
.../kconfig/tests/err_num_bounds/__init__.py | 12 +++
.../tests/err_num_bounds/expected_stderr | 10 +++
.../err_num_non_numeric_ref/expected_stderr | 30 +++----
5 files changed, 160 insertions(+), 31 deletions(-)
create mode 100644 scripts/kconfig/tests/err_num_bounds/Kconfig
create mode 100644 scripts/kconfig/tests/err_num_bounds/__init__.py
create mode 100644 scripts/kconfig/tests/err_num_bounds/expected_stderr
--git a/scripts/kconfig/menu.c b/scripts/kconfig/menu.c
index 99a57ce0fdc9..ede791a2fe1b 100644
--- a/scripts/kconfig/menu.c
+++ b/scripts/kconfig/menu.c
@@ -4,6 +4,7 @@
*/
#include <ctype.h>
+#include <errno.h>
#include <stdarg.h>
#include <stdlib.h>
#include <string.h>
@@ -234,10 +235,46 @@ void menu_add_symbol(enum prop_type type, struct symbol *sym, struct expr *dep)
menu_add_prop(type, expr_alloc_symbol(sym), dep);
}
-static int menu_validate_number(struct symbol *sym, struct symbol *sym2)
+/* Validate the sym2 value for numeric sym. */
+static int menu_validate_number(struct symbol *sym, struct symbol *sym2,
+ const struct property *prop)
{
- return sym2->type == S_INT || sym2->type == S_HEX ||
- (sym2->type == S_UNKNOWN && sym_string_valid(sym, sym2->name));
+ const char *type_bounds;
+
+ if (sym->type != S_INT && sym->type != S_HEX)
+ return 0;
+
+ if (sym2->type == S_INT || sym2->type == S_HEX)
+ return 0;
+
+ if (sym2->type != S_UNKNOWN ||
+ !sym_string_valid(sym, sym2->name)) {
+ fprintf(stderr, "%s:%d: error: '%s' is an invalid value for '%s'\n",
+ prop->filename, prop->lineno, sym2->name,
+ sym_type_name(sym->type));
+ return 1;
+ }
+
+ errno = 0;
+ if (sym->type == S_INT) {
+ type_bounds = "64-bit signed integer";
+ strtoll(sym2->name, NULL, 10);
+ } else {
+ /* hex */
+ type_bounds = "64-bit unsigned integer";
+ strtoull(sym2->name, NULL, 16);
+ }
+
+ if (errno == ERANGE) {
+ fprintf(stderr,
+ "%s:%d: error: %s constant '%s' is outside the %s bounds\n",
+ prop->filename, prop->lineno, sym_type_name(sym->type),
+ sym2->name, type_bounds);
+
+ return 1;
+ }
+
+ return 0;
}
static int sym_check_prop(struct symbol *sym)
@@ -259,13 +296,7 @@ static int sym_check_prop(struct symbol *sym)
break;
sym2 = prop_get_symbol(prop);
if (sym->type == S_HEX || sym->type == S_INT) {
- if (!menu_validate_number(sym, sym2)) {
- fprintf(stderr,
- "%s:%d: error: '%s': number is invalid\n",
- prop->filename, prop->lineno,
- sym->name);
- errors++;
- }
+ errors += menu_validate_number(sym, sym2, prop);
}
if (sym_is_choice(sym)) {
struct menu *choice = sym_get_choice_menu(sym2);
@@ -296,13 +327,8 @@ static int sym_check_prop(struct symbol *sym)
if (sym->type != S_INT && sym->type != S_HEX)
prop_warn(prop, "range is only allowed "
"for int or hex symbols");
- if (!menu_validate_number(sym, prop->expr->left.sym) ||
- !menu_validate_number(sym, prop->expr->right.sym)) {
- fprintf(stderr,
- "%s:%d: error: range is invalid\n",
- prop->filename, prop->lineno);
- errors++;
- }
+ errors += menu_validate_number(sym, prop->expr->left.sym, prop);
+ errors += menu_validate_number(sym, prop->expr->right.sym, prop);
break;
default:
;
diff --git a/scripts/kconfig/tests/err_num_bounds/Kconfig b/scripts/kconfig/tests/err_num_bounds/Kconfig
new file mode 100644
index 000000000000..c439366c03b6
--- /dev/null
+++ b/scripts/kconfig/tests/err_num_bounds/Kconfig
@@ -0,0 +1,79 @@
+# SPDX-License-Identifier: GPL-2.0
+# Test bounds checks for 'int' and 'hex' constants
+
+config INT_SOURCE
+ int
+
+config HEX_SOURCE
+ hex
+
+config BOOL_SOURCE
+ bool
+
+# Valid values at the limits of the type
+
+config INT_MIN
+ int
+ default -9223372036854775808
+
+config INT_MAX
+ int
+ default 9223372036854775807
+
+config HEX_MIN
+ hex
+ default 0x0
+
+config HEX_MAX
+ hex
+ default 0xffffffffffffffff
+
+config INT_RANGE_LIMITS
+ int
+ range -9223372036854775808 9223372036854775807
+
+config HEX_RANGE_LIMITS
+ hex
+ range 0 0xffffffffffffffff
+
+config INT_FROM_INT
+ int
+ default INT_SOURCE
+
+config HEX_FROM_HEX
+ hex
+ default HEX_SOURCE
+
+# Constants outside the bounds
+
+config INT_DEFAULT_TOO_HIGH
+ int
+ default 10000000000000000000
+
+config INT_DEFAULT_TOO_LOW
+ int
+ default -9223372036854775809
+
+config INT_RANGE_TOO_HIGH
+ int
+ range 0 10000000000000000000
+
+config INT_RANGE_TOO_LOW
+ int
+ range -10000000000000000000 0
+
+config INT_RANGE_BOTH_OUTSIDE
+ int
+ range -9223372036854775809 10000000000000000000
+
+config HEX_DEFAULT_TOO_HIGH
+ hex
+ default 0x10000000000000000
+
+config HEX_RANGE_TOO_HIGH
+ hex
+ range 0 0x10000000000000000
+
+config HEX_RANGE_BOTH_TOO_HIGH
+ hex
+ range 0x10000000000000000 0x20000000000000000
diff --git a/scripts/kconfig/tests/err_num_bounds/__init__.py b/scripts/kconfig/tests/err_num_bounds/__init__.py
new file mode 100644
index 000000000000..72ac6aa24491
--- /dev/null
+++ b/scripts/kconfig/tests/err_num_bounds/__init__.py
@@ -0,0 +1,12 @@
+# SPDX-License-Identifier: GPL-2.0
+"""
+Detect constants outside the 'int' and 'hex' bounds.
+
+An int constant must fit in a signed 64-bit integer, and a hex constant must
+fit in an unsigned 64-bit integer.
+"""
+
+
+def test(conf):
+ assert conf.olddefconfig() == 1
+ assert conf.stderr_matches('expected_stderr')
diff --git a/scripts/kconfig/tests/err_num_bounds/expected_stderr b/scripts/kconfig/tests/err_num_bounds/expected_stderr
new file mode 100644
index 000000000000..3f06e13359ef
--- /dev/null
+++ b/scripts/kconfig/tests/err_num_bounds/expected_stderr
@@ -0,0 +1,10 @@
+Kconfig:51: error: integer constant '10000000000000000000' is outside the 64-bit signed integer bounds
+Kconfig:55: error: integer constant '-9223372036854775809' is outside the 64-bit signed integer bounds
+Kconfig:59: error: integer constant '10000000000000000000' is outside the 64-bit signed integer bounds
+Kconfig:63: error: integer constant '-10000000000000000000' is outside the 64-bit signed integer bounds
+Kconfig:67: error: integer constant '-9223372036854775809' is outside the 64-bit signed integer bounds
+Kconfig:67: error: integer constant '10000000000000000000' is outside the 64-bit signed integer bounds
+Kconfig:71: error: hex constant '0x10000000000000000' is outside the 64-bit unsigned integer bounds
+Kconfig:75: error: hex constant '0x10000000000000000' is outside the 64-bit unsigned integer bounds
+Kconfig:79: error: hex constant '0x10000000000000000' is outside the 64-bit unsigned integer bounds
+Kconfig:79: error: hex constant '0x20000000000000000' is outside the 64-bit unsigned integer bounds
diff --git a/scripts/kconfig/tests/err_num_non_numeric_ref/expected_stderr b/scripts/kconfig/tests/err_num_non_numeric_ref/expected_stderr
index 4974ba2fcd9c..005f855ecbdd 100644
--- a/scripts/kconfig/tests/err_num_non_numeric_ref/expected_stderr
+++ b/scripts/kconfig/tests/err_num_non_numeric_ref/expected_stderr
@@ -1,14 +1,16 @@
-Kconfig:17: error: 'INT_DEFAULT_BOOL': number is invalid
-Kconfig:21: error: 'INT_DEFAULT_TRISTATE': number is invalid
-Kconfig:25: error: 'INT_DEFAULT_STRING': number is invalid
-Kconfig:31: error: 'HEX_DEFAULT_BOOL': number is invalid
-Kconfig:35: error: 'HEX_DEFAULT_TRISTATE': number is invalid
-Kconfig:39: error: 'HEX_DEFAULT_STRING': number is invalid
-Kconfig:45: error: range is invalid
-Kconfig:49: error: range is invalid
-Kconfig:53: error: range is invalid
-Kconfig:57: error: range is invalid
-Kconfig:63: error: range is invalid
-Kconfig:67: error: range is invalid
-Kconfig:71: error: range is invalid
-Kconfig:75: error: range is invalid
+Kconfig:17: error: 'BOOL_SOURCE' is an invalid value for 'integer'
+Kconfig:21: error: 'TRISTATE_SOURCE' is an invalid value for 'integer'
+Kconfig:25: error: 'STRING_SOURCE' is an invalid value for 'integer'
+Kconfig:31: error: 'BOOL_SOURCE' is an invalid value for 'hex'
+Kconfig:35: error: 'TRISTATE_SOURCE' is an invalid value for 'hex'
+Kconfig:39: error: 'STRING_SOURCE' is an invalid value for 'hex'
+Kconfig:45: error: 'BOOL_SOURCE' is an invalid value for 'integer'
+Kconfig:49: error: 'TRISTATE_SOURCE' is an invalid value for 'integer'
+Kconfig:53: error: 'STRING_SOURCE' is an invalid value for 'integer'
+Kconfig:57: error: 'BOOL_SOURCE' is an invalid value for 'integer'
+Kconfig:57: error: 'TRISTATE_SOURCE' is an invalid value for 'integer'
+Kconfig:63: error: 'BOOL_SOURCE' is an invalid value for 'hex'
+Kconfig:67: error: 'TRISTATE_SOURCE' is an invalid value for 'hex'
+Kconfig:71: error: 'STRING_SOURCE' is an invalid value for 'hex'
+Kconfig:75: error: 'BOOL_SOURCE' is an invalid value for 'hex'
+Kconfig:75: error: 'TRISTATE_SOURCE' is an invalid value for 'hex'
--
2.55.0
^ permalink raw reply [flat|nested] 12+ messages in thread* Re: [PATCH v2 2/5] kconfig: check for out-of-bounds numeric constants
2026-09-15 21:15 ` [PATCH v2 2/5] kconfig: check for out-of-bounds numeric constants Julian Braha
@ 2026-09-17 15:13 ` Nicolas Schier
0 siblings, 0 replies; 12+ messages in thread
From: Nicolas Schier @ 2026-09-17 15:13 UTC (permalink / raw)
To: Julian Braha
Cc: nathan, nico, rdunlap, grahamr, kees, pengpeng, vegard.nossum,
linux-kernel, linux-kbuild
On Tue, Sep 15, 2026 at 10:15:05PM +0100, Julian Braha wrote:
> The Kconfig interpreter internally represents constants as strings, then
> attempts to parse them as 64-bit signed integers for 'int' options, and
> 64-bit unsigned integers for 'hex' options.
>
> However, there is currently no check that the conversion succeeds, leading
> to failures when the values are actually used. For example:
>
> config LARGE_INT
> int
> default 10000000000000000000
>
> config BUGGED_INT_COMPARISON
> bool
> default y if LARGE_INT < 2
>
> Obviously 10000000000000000000 is larger than 2, but the Kconfig
> interpreter will fallback to comparing the two values with strcmp() after
> the numeric conversion fails, causing the first character, '1', to be
> compared with '2', and giving the wrong result.
>
> Since none of these out-of-bounds values are used as constants anywhere in
> the tree, we can already make these error out.
>
> Assisted-by: LLM
> Signed-off-by: Julian Braha <julianbraha@gmail.com>
> ---
> scripts/kconfig/menu.c | 60 ++++++++++----
> scripts/kconfig/tests/err_num_bounds/Kconfig | 79 +++++++++++++++++++
> .../kconfig/tests/err_num_bounds/__init__.py | 12 +++
> .../tests/err_num_bounds/expected_stderr | 10 +++
> .../err_num_non_numeric_ref/expected_stderr | 30 +++----
> 5 files changed, 160 insertions(+), 31 deletions(-)
> create mode 100644 scripts/kconfig/tests/err_num_bounds/Kconfig
> create mode 100644 scripts/kconfig/tests/err_num_bounds/__init__.py
> create mode 100644 scripts/kconfig/tests/err_num_bounds/expected_stderr
>
Reviewed-by: Nicolas Schier <n.schier@fritz.com>
--
Nicolas
^ permalink raw reply [flat|nested] 12+ messages in thread
* [PATCH v2 3/5] kconfig: check for hex and int mismatches
2026-09-15 21:15 [PATCH v2 0/5] kconfig: improve input validation for numeric options Julian Braha
2026-09-15 21:15 ` [PATCH v2 1/5] kconfig: promote invalid numeric reference from warning to error Julian Braha
2026-09-15 21:15 ` [PATCH v2 2/5] kconfig: check for out-of-bounds numeric constants Julian Braha
@ 2026-09-15 21:15 ` Julian Braha
2026-09-17 15:57 ` Nicolas Schier
2026-09-15 21:15 ` [PATCH v2 4/5] kconfig: prevent out-of-bounds user input for numeric options Julian Braha
` (2 subsequent siblings)
5 siblings, 1 reply; 12+ messages in thread
From: Julian Braha @ 2026-09-15 21:15 UTC (permalink / raw)
To: nathan, nsc
Cc: nico, rdunlap, grahamr, kees, pengpeng, vegard.nossum,
linux-kernel, linux-kbuild, Julian Braha
Using a numeric option of one type (e.g. 'int') to determine the value of
a different numeric type (e.g. 'hex') currently fails silently in various
ways if attempted, because the underlying string representation is naively
reused.
Example 1:
config I
int
default -1
config HEX_DEFAULT_INT
hex
default I
Here, HEX_DEFAULT_INT actually gets set to '0x-1', which is of course not
a valid hex value.
Example 2:
config H
hex
default A
config INT_DEFAULT_HEX
int
default H
Here, INT_DEFAULT_HEX actually gets set to 'A', without even converting
into the base-10 equivalent of 10. This value, 'A', is otherwise a
rejected int value if entered in the frontend, or read in from an existing
.config file.
These int-hex mismatches currently do not appear anywhere in the tree, so
it is already safe to make these error out.
Assisted-by: LLM
Signed-off-by: Julian Braha <julianbraha@gmail.com>
---
| 2 +-
.../kconfig/tests/err_num_mismatch/Kconfig | 38 +++++++++++++++++++
.../tests/err_num_mismatch/__init__.py | 9 +++++
.../tests/err_num_mismatch/expected_stderr | 4 ++
4 files changed, 52 insertions(+), 1 deletion(-)
create mode 100644 scripts/kconfig/tests/err_num_mismatch/Kconfig
create mode 100644 scripts/kconfig/tests/err_num_mismatch/__init__.py
create mode 100644 scripts/kconfig/tests/err_num_mismatch/expected_stderr
--git a/scripts/kconfig/menu.c b/scripts/kconfig/menu.c
index ede791a2fe1b..2d8b0c65ce1e 100644
--- a/scripts/kconfig/menu.c
+++ b/scripts/kconfig/menu.c
@@ -244,7 +244,7 @@ static int menu_validate_number(struct symbol *sym, struct symbol *sym2,
if (sym->type != S_INT && sym->type != S_HEX)
return 0;
- if (sym2->type == S_INT || sym2->type == S_HEX)
+ if (sym2->type == sym->type)
return 0;
if (sym2->type != S_UNKNOWN ||
diff --git a/scripts/kconfig/tests/err_num_mismatch/Kconfig b/scripts/kconfig/tests/err_num_mismatch/Kconfig
new file mode 100644
index 000000000000..8406f3bb6419
--- /dev/null
+++ b/scripts/kconfig/tests/err_num_mismatch/Kconfig
@@ -0,0 +1,38 @@
+# SPDX-License-Identifier: GPL-2.0
+# Test 'int' and 'hex' symbols that reference each other
+
+config INT_SOURCE
+ int
+
+config HEX_SOURCE
+ hex
+
+# 'hex' reference from 'int'
+
+config INT_DEFAULT_HEX
+ int
+ default HEX_SOURCE
+
+config INT_RANGE_HEX
+ int
+ range HEX_SOURCE 1
+
+# A hex symbol must not reference an int symbol
+
+config HEX_DEFAULT_INT
+ hex
+ default INT_SOURCE
+
+config HEX_RANGE_INT
+ hex
+ range INT_SOURCE 0x1
+
+# Referencing the same type is valid
+
+config INT_FROM_INT
+ int
+ default INT_SOURCE
+
+config HEX_FROM_HEX
+ hex
+ range 0 HEX_SOURCE
diff --git a/scripts/kconfig/tests/err_num_mismatch/__init__.py b/scripts/kconfig/tests/err_num_mismatch/__init__.py
new file mode 100644
index 000000000000..275f2a6e9a5b
--- /dev/null
+++ b/scripts/kconfig/tests/err_num_mismatch/__init__.py
@@ -0,0 +1,9 @@
+# SPDX-License-Identifier: GPL-2.0
+"""
+Reject direct references ('default' or 'range') between int and hex options.
+"""
+
+
+def test(conf):
+ assert conf.olddefconfig() == 1
+ assert conf.stderr_matches('expected_stderr')
diff --git a/scripts/kconfig/tests/err_num_mismatch/expected_stderr b/scripts/kconfig/tests/err_num_mismatch/expected_stderr
new file mode 100644
index 000000000000..587c34467ae6
--- /dev/null
+++ b/scripts/kconfig/tests/err_num_mismatch/expected_stderr
@@ -0,0 +1,4 @@
+Kconfig:14: error: 'HEX_SOURCE' is an invalid value for 'integer'
+Kconfig:18: error: 'HEX_SOURCE' is an invalid value for 'integer'
+Kconfig:24: error: 'INT_SOURCE' is an invalid value for 'hex'
+Kconfig:28: error: 'INT_SOURCE' is an invalid value for 'hex'
--
2.55.0
^ permalink raw reply [flat|nested] 12+ messages in thread* Re: [PATCH v2 3/5] kconfig: check for hex and int mismatches
2026-09-15 21:15 ` [PATCH v2 3/5] kconfig: check for hex and int mismatches Julian Braha
@ 2026-09-17 15:57 ` Nicolas Schier
0 siblings, 0 replies; 12+ messages in thread
From: Nicolas Schier @ 2026-09-17 15:57 UTC (permalink / raw)
To: Julian Braha
Cc: nathan, nico, rdunlap, grahamr, kees, pengpeng, vegard.nossum,
linux-kernel, linux-kbuild
On Tue, Sep 15, 2026 at 10:15:06PM +0100, Julian Braha wrote:
> Using a numeric option of one type (e.g. 'int') to determine the value of
> a different numeric type (e.g. 'hex') currently fails silently in various
> ways if attempted, because the underlying string representation is naively
> reused.
>
> Example 1:
>
> config I
> int
> default -1
>
> config HEX_DEFAULT_INT
> hex
> default I
>
> Here, HEX_DEFAULT_INT actually gets set to '0x-1', which is of course not
> a valid hex value.
>
> Example 2:
>
> config H
> hex
> default A
>
> config INT_DEFAULT_HEX
> int
> default H
>
> Here, INT_DEFAULT_HEX actually gets set to 'A', without even converting
> into the base-10 equivalent of 10. This value, 'A', is otherwise a
> rejected int value if entered in the frontend, or read in from an existing
> .config file.
>
> These int-hex mismatches currently do not appear anywhere in the tree, so
> it is already safe to make these error out.
>
> Assisted-by: LLM
> Signed-off-by: Julian Braha <julianbraha@gmail.com>
> ---
> scripts/kconfig/menu.c | 2 +-
> .../kconfig/tests/err_num_mismatch/Kconfig | 38 +++++++++++++++++++
> .../tests/err_num_mismatch/__init__.py | 9 +++++
> .../tests/err_num_mismatch/expected_stderr | 4 ++
> 4 files changed, 52 insertions(+), 1 deletion(-)
> create mode 100644 scripts/kconfig/tests/err_num_mismatch/Kconfig
> create mode 100644 scripts/kconfig/tests/err_num_mismatch/__init__.py
> create mode 100644 scripts/kconfig/tests/err_num_mismatch/expected_stderr
>
Thanks, error-out is really a good thing for now. Actually, I am one of
those who'd expect that Kconfig auto-converts hex ←→ int; so, thanks for
enforcing clarity.
Reviewed-by: Nicolas Schier <n.schier@fritz.com>
--
Nicolas
^ permalink raw reply [flat|nested] 12+ messages in thread
* [PATCH v2 4/5] kconfig: prevent out-of-bounds user input for numeric options
2026-09-15 21:15 [PATCH v2 0/5] kconfig: improve input validation for numeric options Julian Braha
` (2 preceding siblings ...)
2026-09-15 21:15 ` [PATCH v2 3/5] kconfig: check for hex and int mismatches Julian Braha
@ 2026-09-15 21:15 ` Julian Braha
2026-09-17 16:13 ` Nicolas Schier
2026-09-15 21:15 ` [PATCH v2 5/5] kconfig: use unsigned integers for hex range checks Julian Braha
2026-09-17 23:48 ` [PATCH v2 0/5] kconfig: improve input validation for numeric options Nathan Chancellor
5 siblings, 1 reply; 12+ messages in thread
From: Julian Braha @ 2026-09-15 21:15 UTC (permalink / raw)
To: nathan, nsc
Cc: nico, rdunlap, grahamr, kees, pengpeng, vegard.nossum,
linux-kernel, linux-kbuild, Julian Braha
Currently, user input of out-of-bounds values for 'int' and 'hex' options
is possible, leading to later silent failures in Kconfig if that value is
used in a comparison, or a warning by GCC or error by Clang if used in the
C code.
Let's factor out the out-of-bounds check on constants, so that it can be
reused for checking user input.
The frontend will now reject an attempted user input of an out-of-bounds
numeric value, similarly to how a value outside the active 'range' already
does.
For migration of existing configurations, a .config file with an
out-of-bounds numeric value will be allowed for now, but will warn the
user when read in by confdata.c
Assisted-by: LLM
Signed-off-by: Julian Braha <julianbraha@gmail.com>
---
scripts/kconfig/confdata.c | 6 +++++
scripts/kconfig/lkc_proto.h | 1 +
| 19 +++-----------
scripts/kconfig/symbol.c | 20 +++++++++++++++
.../tests/err_num_bounds/expected_stderr | 20 +++++++--------
scripts/kconfig/tests/warn_num_bounds/Kconfig | 24 ++++++++++++++++++
.../kconfig/tests/warn_num_bounds/__init__.py | 25 +++++++++++++++++++
scripts/kconfig/tests/warn_num_bounds/config | 7 ++++++
.../tests/warn_num_bounds/expected_config | 11 ++++++++
.../warn_num_bounds/expected_config_stderr | 3 +++
.../warn_num_bounds/expected_frontend_config | 11 ++++++++
.../warn_num_bounds/expected_frontend_stderr | 0
12 files changed, 121 insertions(+), 26 deletions(-)
create mode 100644 scripts/kconfig/tests/warn_num_bounds/Kconfig
create mode 100644 scripts/kconfig/tests/warn_num_bounds/__init__.py
create mode 100644 scripts/kconfig/tests/warn_num_bounds/config
create mode 100644 scripts/kconfig/tests/warn_num_bounds/expected_config
create mode 100644 scripts/kconfig/tests/warn_num_bounds/expected_config_stderr
create mode 100644 scripts/kconfig/tests/warn_num_bounds/expected_frontend_config
create mode 100644 scripts/kconfig/tests/warn_num_bounds/expected_frontend_stderr
diff --git a/scripts/kconfig/confdata.c b/scripts/kconfig/confdata.c
index 4234a51d16fd..2227d89d6328 100644
--- a/scripts/kconfig/confdata.c
+++ b/scripts/kconfig/confdata.c
@@ -354,6 +354,12 @@ static int conf_set_sym_val(struct symbol *sym, int def, int def_flags, char *p)
case S_INT:
case S_HEX:
if (sym_string_valid(sym, p)) {
+ if (def != S_DEF_AUTO &&
+ !sym_string_check_bounds(sym, p))
+ /* hex uses 64-bit unsigned integer */
+ conf_warning("value '%s' for %s is outside the 64-bit %s integer bounds",
+ p, sym->name,
+ sym->type == S_INT ? "signed" : "unsigned");
sym->def[def].val = xstrdup(p);
sym->flags |= def_flags;
} else {
diff --git a/scripts/kconfig/lkc_proto.h b/scripts/kconfig/lkc_proto.h
index 8914b4e8f2a8..8b436c87ba4a 100644
--- a/scripts/kconfig/lkc_proto.h
+++ b/scripts/kconfig/lkc_proto.h
@@ -31,6 +31,7 @@ bool sym_set_tristate_value(struct symbol *sym,tristate tri);
void choice_set_value(struct menu *choice, struct symbol *sym);
tristate sym_toggle_tristate_value(struct symbol *sym);
bool sym_string_valid(struct symbol *sym, const char *newval);
+bool sym_string_check_bounds(struct symbol *sym, const char *str);
bool sym_string_within_range(struct symbol *sym, const char *str);
bool sym_set_string_value(struct symbol *sym, const char *newval);
bool sym_is_changeable(const struct symbol *sym);
--git a/scripts/kconfig/menu.c b/scripts/kconfig/menu.c
index 2d8b0c65ce1e..6b9ef738ee71 100644
--- a/scripts/kconfig/menu.c
+++ b/scripts/kconfig/menu.c
@@ -4,7 +4,6 @@
*/
#include <ctype.h>
-#include <errno.h>
#include <stdarg.h>
#include <stdlib.h>
#include <string.h>
@@ -239,8 +238,6 @@ void menu_add_symbol(enum prop_type type, struct symbol *sym, struct expr *dep)
static int menu_validate_number(struct symbol *sym, struct symbol *sym2,
const struct property *prop)
{
- const char *type_bounds;
-
if (sym->type != S_INT && sym->type != S_HEX)
return 0;
@@ -255,21 +252,11 @@ static int menu_validate_number(struct symbol *sym, struct symbol *sym2,
return 1;
}
- errno = 0;
- if (sym->type == S_INT) {
- type_bounds = "64-bit signed integer";
- strtoll(sym2->name, NULL, 10);
- } else {
- /* hex */
- type_bounds = "64-bit unsigned integer";
- strtoull(sym2->name, NULL, 16);
- }
-
- if (errno == ERANGE) {
+ if (!sym_string_check_bounds(sym, sym2->name)) {
fprintf(stderr,
- "%s:%d: error: %s constant '%s' is outside the %s bounds\n",
+ "%s:%d: error: %s constant '%s' is outside the 64-bit %s bounds\n",
prop->filename, prop->lineno, sym_type_name(sym->type),
- sym2->name, type_bounds);
+ sym2->name, sym->type == S_INT ? "signed" : "unsigned");
return 1;
}
diff --git a/scripts/kconfig/symbol.c b/scripts/kconfig/symbol.c
index e82f330fb8ee..0b3d19af269f 100644
--- a/scripts/kconfig/symbol.c
+++ b/scripts/kconfig/symbol.c
@@ -5,6 +5,7 @@
#include <sys/types.h>
#include <ctype.h>
+#include <errno.h>
#include <stdlib.h>
#include <string.h>
#include <regex.h>
@@ -711,6 +712,21 @@ bool sym_string_valid(struct symbol *sym, const char *str)
}
}
+bool sym_string_check_bounds(struct symbol *sym, const char *str)
+{
+ errno = 0;
+
+ if (sym->type == S_INT)
+ strtoll(str, NULL, 10);
+ else if (sym->type == S_HEX)
+ strtoull(str, NULL, 16);
+ else
+ /* string */
+ return true;
+
+ return errno != ERANGE;
+}
+
bool sym_string_within_range(struct symbol *sym, const char *str)
{
struct property *prop;
@@ -722,6 +738,8 @@ bool sym_string_within_range(struct symbol *sym, const char *str)
case S_INT:
if (!sym_string_valid(sym, str))
return false;
+ if (!sym_string_check_bounds(sym, str))
+ return false;
prop = sym_get_range_prop(sym);
if (!prop)
return true;
@@ -731,6 +749,8 @@ bool sym_string_within_range(struct symbol *sym, const char *str)
case S_HEX:
if (!sym_string_valid(sym, str))
return false;
+ if (!sym_string_check_bounds(sym, str))
+ return false;
prop = sym_get_range_prop(sym);
if (!prop)
return true;
diff --git a/scripts/kconfig/tests/err_num_bounds/expected_stderr b/scripts/kconfig/tests/err_num_bounds/expected_stderr
index 3f06e13359ef..5f89cf4afff8 100644
--- a/scripts/kconfig/tests/err_num_bounds/expected_stderr
+++ b/scripts/kconfig/tests/err_num_bounds/expected_stderr
@@ -1,10 +1,10 @@
-Kconfig:51: error: integer constant '10000000000000000000' is outside the 64-bit signed integer bounds
-Kconfig:55: error: integer constant '-9223372036854775809' is outside the 64-bit signed integer bounds
-Kconfig:59: error: integer constant '10000000000000000000' is outside the 64-bit signed integer bounds
-Kconfig:63: error: integer constant '-10000000000000000000' is outside the 64-bit signed integer bounds
-Kconfig:67: error: integer constant '-9223372036854775809' is outside the 64-bit signed integer bounds
-Kconfig:67: error: integer constant '10000000000000000000' is outside the 64-bit signed integer bounds
-Kconfig:71: error: hex constant '0x10000000000000000' is outside the 64-bit unsigned integer bounds
-Kconfig:75: error: hex constant '0x10000000000000000' is outside the 64-bit unsigned integer bounds
-Kconfig:79: error: hex constant '0x10000000000000000' is outside the 64-bit unsigned integer bounds
-Kconfig:79: error: hex constant '0x20000000000000000' is outside the 64-bit unsigned integer bounds
+Kconfig:51: error: integer constant '10000000000000000000' is outside the 64-bit signed bounds
+Kconfig:55: error: integer constant '-9223372036854775809' is outside the 64-bit signed bounds
+Kconfig:59: error: integer constant '10000000000000000000' is outside the 64-bit signed bounds
+Kconfig:63: error: integer constant '-10000000000000000000' is outside the 64-bit signed bounds
+Kconfig:67: error: integer constant '-9223372036854775809' is outside the 64-bit signed bounds
+Kconfig:67: error: integer constant '10000000000000000000' is outside the 64-bit signed bounds
+Kconfig:71: error: hex constant '0x10000000000000000' is outside the 64-bit unsigned bounds
+Kconfig:75: error: hex constant '0x10000000000000000' is outside the 64-bit unsigned bounds
+Kconfig:79: error: hex constant '0x10000000000000000' is outside the 64-bit unsigned bounds
+Kconfig:79: error: hex constant '0x20000000000000000' is outside the 64-bit unsigned bounds
diff --git a/scripts/kconfig/tests/warn_num_bounds/Kconfig b/scripts/kconfig/tests/warn_num_bounds/Kconfig
new file mode 100644
index 000000000000..a810225a58a3
--- /dev/null
+++ b/scripts/kconfig/tests/warn_num_bounds/Kconfig
@@ -0,0 +1,24 @@
+# SPDX-License-Identifier: GPL-2.0
+
+mainmenu "Numeric bounds test"
+
+config INT_TOO_LOW
+ int "Integer below its type bounds"
+
+config INT_TOO_HIGH
+ int "Integer above its type bounds"
+
+config HEX_TOO_HIGH
+ hex "Hex value above its type bounds"
+
+config INT_MIN
+ int "Minimum valid integer"
+
+config INT_MAX
+ int "Maximum valid integer"
+
+config HEX_MIN
+ hex "Minimum valid hex value"
+
+config HEX_MAX
+ hex "Maximum valid hex value"
diff --git a/scripts/kconfig/tests/warn_num_bounds/__init__.py b/scripts/kconfig/tests/warn_num_bounds/__init__.py
new file mode 100644
index 000000000000..db7518258217
--- /dev/null
+++ b/scripts/kconfig/tests/warn_num_bounds/__init__.py
@@ -0,0 +1,25 @@
+# SPDX-License-Identifier: GPL-2.0
+"""Test user values outside the numeric type bounds."""
+
+
+def test(conf):
+ in_keys = (
+ '-9223372036854775809\n'
+ '-1\n'
+ '9223372036854775808\n'
+ '1\n'
+ '0x10000000000000000\n'
+ '0x1\n'
+ '-9223372036854775808\n'
+ '9223372036854775807\n'
+ '0x0\n'
+ '0xffffffffffffffff\n'
+ )
+
+ assert conf.oldaskconfig(in_keys=in_keys) == 0
+ assert conf.stderr_matches('expected_frontend_stderr')
+ assert conf.config_matches('expected_frontend_config')
+
+ assert conf.olddefconfig('config') == 0
+ assert conf.stderr_matches('expected_config_stderr')
+ assert conf.config_matches('expected_config')
diff --git a/scripts/kconfig/tests/warn_num_bounds/config b/scripts/kconfig/tests/warn_num_bounds/config
new file mode 100644
index 000000000000..74bf263f99bf
--- /dev/null
+++ b/scripts/kconfig/tests/warn_num_bounds/config
@@ -0,0 +1,7 @@
+CONFIG_INT_TOO_LOW=-9223372036854775809
+CONFIG_INT_TOO_HIGH=9223372036854775808
+CONFIG_HEX_TOO_HIGH=0x10000000000000000
+CONFIG_INT_MIN=-9223372036854775808
+CONFIG_INT_MAX=9223372036854775807
+CONFIG_HEX_MIN=0x0
+CONFIG_HEX_MAX=0xffffffffffffffff
diff --git a/scripts/kconfig/tests/warn_num_bounds/expected_config b/scripts/kconfig/tests/warn_num_bounds/expected_config
new file mode 100644
index 000000000000..8b1aef612bc6
--- /dev/null
+++ b/scripts/kconfig/tests/warn_num_bounds/expected_config
@@ -0,0 +1,11 @@
+#
+# Automatically generated file; DO NOT EDIT.
+# Numeric bounds test
+#
+CONFIG_INT_TOO_LOW=-9223372036854775809
+CONFIG_INT_TOO_HIGH=9223372036854775808
+CONFIG_HEX_TOO_HIGH=0x10000000000000000
+CONFIG_INT_MIN=-9223372036854775808
+CONFIG_INT_MAX=9223372036854775807
+CONFIG_HEX_MIN=0x0
+CONFIG_HEX_MAX=0xffffffffffffffff
diff --git a/scripts/kconfig/tests/warn_num_bounds/expected_config_stderr b/scripts/kconfig/tests/warn_num_bounds/expected_config_stderr
new file mode 100644
index 000000000000..be2ed7fbf648
--- /dev/null
+++ b/scripts/kconfig/tests/warn_num_bounds/expected_config_stderr
@@ -0,0 +1,3 @@
+.config:1:warning: value '-9223372036854775809' for INT_TOO_LOW is outside the 64-bit signed integer bounds
+.config:2:warning: value '9223372036854775808' for INT_TOO_HIGH is outside the 64-bit signed integer bounds
+.config:3:warning: value '0x10000000000000000' for HEX_TOO_HIGH is outside the 64-bit unsigned integer bounds
diff --git a/scripts/kconfig/tests/warn_num_bounds/expected_frontend_config b/scripts/kconfig/tests/warn_num_bounds/expected_frontend_config
new file mode 100644
index 000000000000..a7e842517026
--- /dev/null
+++ b/scripts/kconfig/tests/warn_num_bounds/expected_frontend_config
@@ -0,0 +1,11 @@
+#
+# Automatically generated file; DO NOT EDIT.
+# Numeric bounds test
+#
+CONFIG_INT_TOO_LOW=-1
+CONFIG_INT_TOO_HIGH=1
+CONFIG_HEX_TOO_HIGH=0x1
+CONFIG_INT_MIN=-9223372036854775808
+CONFIG_INT_MAX=9223372036854775807
+CONFIG_HEX_MIN=0x0
+CONFIG_HEX_MAX=0xffffffffffffffff
diff --git a/scripts/kconfig/tests/warn_num_bounds/expected_frontend_stderr b/scripts/kconfig/tests/warn_num_bounds/expected_frontend_stderr
new file mode 100644
index 000000000000..e69de29bb2d1
--
2.55.0
^ permalink raw reply [flat|nested] 12+ messages in thread* Re: [PATCH v2 4/5] kconfig: prevent out-of-bounds user input for numeric options
2026-09-15 21:15 ` [PATCH v2 4/5] kconfig: prevent out-of-bounds user input for numeric options Julian Braha
@ 2026-09-17 16:13 ` Nicolas Schier
0 siblings, 0 replies; 12+ messages in thread
From: Nicolas Schier @ 2026-09-17 16:13 UTC (permalink / raw)
To: Julian Braha
Cc: nathan, nico, rdunlap, grahamr, kees, pengpeng, vegard.nossum,
linux-kernel, linux-kbuild
On Tue, Sep 15, 2026 at 10:15:07PM +0100, Julian Braha wrote:
> Currently, user input of out-of-bounds values for 'int' and 'hex' options
> is possible, leading to later silent failures in Kconfig if that value is
> used in a comparison, or a warning by GCC or error by Clang if used in the
> C code.
>
> Let's factor out the out-of-bounds check on constants, so that it can be
> reused for checking user input.
>
> The frontend will now reject an attempted user input of an out-of-bounds
> numeric value, similarly to how a value outside the active 'range' already
> does.
>
> For migration of existing configurations, a .config file with an
> out-of-bounds numeric value will be allowed for now, but will warn the
> user when read in by confdata.c
>
> Assisted-by: LLM
> Signed-off-by: Julian Braha <julianbraha@gmail.com>
> ---
> scripts/kconfig/confdata.c | 6 +++++
> scripts/kconfig/lkc_proto.h | 1 +
> scripts/kconfig/menu.c | 19 +++-----------
> scripts/kconfig/symbol.c | 20 +++++++++++++++
> .../tests/err_num_bounds/expected_stderr | 20 +++++++--------
> scripts/kconfig/tests/warn_num_bounds/Kconfig | 24 ++++++++++++++++++
> .../kconfig/tests/warn_num_bounds/__init__.py | 25 +++++++++++++++++++
> scripts/kconfig/tests/warn_num_bounds/config | 7 ++++++
> .../tests/warn_num_bounds/expected_config | 11 ++++++++
> .../warn_num_bounds/expected_config_stderr | 3 +++
> .../warn_num_bounds/expected_frontend_config | 11 ++++++++
> .../warn_num_bounds/expected_frontend_stderr | 0
> 12 files changed, 121 insertions(+), 26 deletions(-)
> create mode 100644 scripts/kconfig/tests/warn_num_bounds/Kconfig
> create mode 100644 scripts/kconfig/tests/warn_num_bounds/__init__.py
> create mode 100644 scripts/kconfig/tests/warn_num_bounds/config
> create mode 100644 scripts/kconfig/tests/warn_num_bounds/expected_config
> create mode 100644 scripts/kconfig/tests/warn_num_bounds/expected_config_stderr
> create mode 100644 scripts/kconfig/tests/warn_num_bounds/expected_frontend_config
> create mode 100644 scripts/kconfig/tests/warn_num_bounds/expected_frontend_stderr
>
> diff --git a/scripts/kconfig/confdata.c b/scripts/kconfig/confdata.c
> index 4234a51d16fd..2227d89d6328 100644
> --- a/scripts/kconfig/confdata.c
> +++ b/scripts/kconfig/confdata.c
> @@ -354,6 +354,12 @@ static int conf_set_sym_val(struct symbol *sym, int def, int def_flags, char *p)
> case S_INT:
> case S_HEX:
> if (sym_string_valid(sym, p)) {
> + if (def != S_DEF_AUTO &&
> + !sym_string_check_bounds(sym, p))
> + /* hex uses 64-bit unsigned integer */
> + conf_warning("value '%s' for %s is outside the 64-bit %s integer bounds",
> + p, sym->name,
> + sym->type == S_INT ? "signed" : "unsigned");
> sym->def[def].val = xstrdup(p);
> sym->flags |= def_flags;
> } else {
> diff --git a/scripts/kconfig/lkc_proto.h b/scripts/kconfig/lkc_proto.h
> index 8914b4e8f2a8..8b436c87ba4a 100644
> --- a/scripts/kconfig/lkc_proto.h
> +++ b/scripts/kconfig/lkc_proto.h
> @@ -31,6 +31,7 @@ bool sym_set_tristate_value(struct symbol *sym,tristate tri);
> void choice_set_value(struct menu *choice, struct symbol *sym);
> tristate sym_toggle_tristate_value(struct symbol *sym);
> bool sym_string_valid(struct symbol *sym, const char *newval);
> +bool sym_string_check_bounds(struct symbol *sym, const char *str);
> bool sym_string_within_range(struct symbol *sym, const char *str);
> bool sym_set_string_value(struct symbol *sym, const char *newval);
> bool sym_is_changeable(const struct symbol *sym);
> diff --git a/scripts/kconfig/menu.c b/scripts/kconfig/menu.c
> index 2d8b0c65ce1e..6b9ef738ee71 100644
> --- a/scripts/kconfig/menu.c
> +++ b/scripts/kconfig/menu.c
> @@ -4,7 +4,6 @@
> */
>
> #include <ctype.h>
> -#include <errno.h>
> #include <stdarg.h>
> #include <stdlib.h>
> #include <string.h>
> @@ -239,8 +238,6 @@ void menu_add_symbol(enum prop_type type, struct symbol *sym, struct expr *dep)
> static int menu_validate_number(struct symbol *sym, struct symbol *sym2,
> const struct property *prop)
> {
> - const char *type_bounds;
> -
> if (sym->type != S_INT && sym->type != S_HEX)
> return 0;
>
> @@ -255,21 +252,11 @@ static int menu_validate_number(struct symbol *sym, struct symbol *sym2,
> return 1;
> }
>
> - errno = 0;
> - if (sym->type == S_INT) {
> - type_bounds = "64-bit signed integer";
> - strtoll(sym2->name, NULL, 10);
> - } else {
> - /* hex */
> - type_bounds = "64-bit unsigned integer";
> - strtoull(sym2->name, NULL, 16);
> - }
> -
> - if (errno == ERANGE) {
> + if (!sym_string_check_bounds(sym, sym2->name)) {
> fprintf(stderr,
> - "%s:%d: error: %s constant '%s' is outside the %s bounds\n",
> + "%s:%d: error: %s constant '%s' is outside the 64-bit %s bounds\n",
tests/err_num_bounds/expected_stderr wouldn't need to be updated here
with 's/bounds/integer bounds/'; but AFAIC leave it as it is right now.
Reviewed-by: Nicolas Schier <n.schier@fritz.com>
--
Nicolas
^ permalink raw reply [flat|nested] 12+ messages in thread
* [PATCH v2 5/5] kconfig: use unsigned integers for hex range checks
2026-09-15 21:15 [PATCH v2 0/5] kconfig: improve input validation for numeric options Julian Braha
` (3 preceding siblings ...)
2026-09-15 21:15 ` [PATCH v2 4/5] kconfig: prevent out-of-bounds user input for numeric options Julian Braha
@ 2026-09-15 21:15 ` Julian Braha
2026-09-17 16:36 ` Nicolas Schier
2026-09-17 23:48 ` [PATCH v2 0/5] kconfig: improve input validation for numeric options Nathan Chancellor
5 siblings, 1 reply; 12+ messages in thread
From: Julian Braha @ 2026-09-15 21:15 UTC (permalink / raw)
To: nathan, nsc
Cc: nico, rdunlap, grahamr, kees, pengpeng, vegard.nossum,
linux-kernel, linux-kbuild, Julian Braha
While 'hex' values should use the bounds of 64-bit unsigned integers, the
range values are treated as signed (checks use strtoll).
For example:
config HEX_RANGE
hex
range 0 0xfffffffffffffffe
default 0xffffffffffffffff
the default value should adjust down to the upper bound of
0xfffffffffffffffe, but since the check incorrectly parses both as
LLONG_MAX, the value stays at the out-of-range default of
0xffffffffffffffff.
To fix this, let's use a union of signed and unsigned integers to
represent both 'int' and 'hex' range values, then use both strtoll and
strtoull where appropriate.
Assisted-by: LLM
Signed-off-by: Julian Braha <julianbraha@gmail.com>
---
scripts/kconfig/symbol.c | 41 ++++++++++++++-----
.../kconfig/tests/warn_changed_input/Kconfig | 5 +++
.../tests/warn_changed_input/expected_config | 1 +
3 files changed, 36 insertions(+), 11 deletions(-)
diff --git a/scripts/kconfig/symbol.c b/scripts/kconfig/symbol.c
index 0b3d19af269f..14b029f9d6df 100644
--- a/scripts/kconfig/symbol.c
+++ b/scripts/kconfig/symbol.c
@@ -142,8 +142,15 @@ struct property *sym_get_range_prop(struct symbol *sym)
return NULL;
}
-static long long sym_get_range_val(struct symbol *sym, int base)
+union range_value {
+ long long s;
+ unsigned long long u;
+};
+
+static union range_value sym_get_range_val(struct symbol *sym, int base)
{
+ union range_value val;
+
sym_calc_value(sym);
switch (sym->type) {
case S_INT:
@@ -155,7 +162,12 @@ static long long sym_get_range_val(struct symbol *sym, int base)
default:
break;
}
- return strtoll(sym->curr.val, NULL, base);
+ if (base == 10)
+ val.s = strtoll(sym->curr.val, NULL, base);
+ else
+ /* HEX */
+ val.u = strtoull(sym->curr.val, NULL, base);
+ return val;
}
static void sym_validate_range(struct symbol *sym)
@@ -163,7 +175,7 @@ static void sym_validate_range(struct symbol *sym)
struct property *prop;
struct symbol *range_sym;
int base;
- long long val, val2;
+ union range_value val, val2;
switch (sym->type) {
case S_INT:
@@ -178,13 +190,19 @@ static void sym_validate_range(struct symbol *sym)
prop = sym_get_range_prop(sym);
if (!prop)
return;
- val = strtoll(sym->curr.val, NULL, base);
+ val = sym_get_range_val(sym, base);
range_sym = prop->expr->left.sym;
val2 = sym_get_range_val(range_sym, base);
- if (val >= val2) {
+
+ if (base == 10 && val.s >= val2.s) {
+ range_sym = prop->expr->right.sym;
+ val2 = sym_get_range_val(range_sym, base);
+ if (val.s <= val2.s)
+ return;
+ } else if (base == 16 && val.u >= val2.u) {
range_sym = prop->expr->right.sym;
val2 = sym_get_range_val(range_sym, base);
- if (val <= val2)
+ if (val.u <= val2.u)
return;
}
sym->curr.val = range_sym->curr.val;
@@ -731,6 +749,7 @@ bool sym_string_within_range(struct symbol *sym, const char *str)
{
struct property *prop;
long long val;
+ unsigned long long uval;
switch (sym->type) {
case S_STRING:
@@ -744,8 +763,8 @@ bool sym_string_within_range(struct symbol *sym, const char *str)
if (!prop)
return true;
val = strtoll(str, NULL, 10);
- return val >= sym_get_range_val(prop->expr->left.sym, 10) &&
- val <= sym_get_range_val(prop->expr->right.sym, 10);
+ return val >= sym_get_range_val(prop->expr->left.sym, 10).s &&
+ val <= sym_get_range_val(prop->expr->right.sym, 10).s;
case S_HEX:
if (!sym_string_valid(sym, str))
return false;
@@ -754,9 +773,9 @@ bool sym_string_within_range(struct symbol *sym, const char *str)
prop = sym_get_range_prop(sym);
if (!prop)
return true;
- val = strtoll(str, NULL, 16);
- return val >= sym_get_range_val(prop->expr->left.sym, 16) &&
- val <= sym_get_range_val(prop->expr->right.sym, 16);
+ uval = strtoull(str, NULL, 16);
+ return uval >= sym_get_range_val(prop->expr->left.sym, 16).u &&
+ uval <= sym_get_range_val(prop->expr->right.sym, 16).u;
case S_BOOLEAN:
case S_TRISTATE:
switch (str[0]) {
diff --git a/scripts/kconfig/tests/warn_changed_input/Kconfig b/scripts/kconfig/tests/warn_changed_input/Kconfig
index 69845e2f3fb3..df4183a08420 100644
--- a/scripts/kconfig/tests/warn_changed_input/Kconfig
+++ b/scripts/kconfig/tests/warn_changed_input/Kconfig
@@ -26,6 +26,11 @@ config NUM
Kconfig resolves it to the constrained in-range value.
The warning should report that adjustment.
+config HEX_RANGE
+ hex
+ range 0 0xfffffffffffffffe
+ default 0xffffffffffffffff
+
config DUP
bool "DUP"
depends on DEP
diff --git a/scripts/kconfig/tests/warn_changed_input/expected_config b/scripts/kconfig/tests/warn_changed_input/expected_config
index fe8bbec66c53..6a8d98a69b7e 100644
--- a/scripts/kconfig/tests/warn_changed_input/expected_config
+++ b/scripts/kconfig/tests/warn_changed_input/expected_config
@@ -4,3 +4,4 @@
#
# CONFIG_DEP is not set
CONFIG_NUM=20
+CONFIG_HEX_RANGE=0xfffffffffffffffe
--
2.55.0
^ permalink raw reply [flat|nested] 12+ messages in thread* Re: [PATCH v2 5/5] kconfig: use unsigned integers for hex range checks
2026-09-15 21:15 ` [PATCH v2 5/5] kconfig: use unsigned integers for hex range checks Julian Braha
@ 2026-09-17 16:36 ` Nicolas Schier
0 siblings, 0 replies; 12+ messages in thread
From: Nicolas Schier @ 2026-09-17 16:36 UTC (permalink / raw)
To: Julian Braha
Cc: nathan, nico, rdunlap, grahamr, kees, pengpeng, vegard.nossum,
linux-kernel, linux-kbuild
On Tue, Sep 15, 2026 at 10:15:08PM +0100, Julian Braha wrote:
> While 'hex' values should use the bounds of 64-bit unsigned integers, the
> range values are treated as signed (checks use strtoll).
>
> For example:
>
> config HEX_RANGE
> hex
> range 0 0xfffffffffffffffe
> default 0xffffffffffffffff
>
> the default value should adjust down to the upper bound of
> 0xfffffffffffffffe, but since the check incorrectly parses both as
> LLONG_MAX, the value stays at the out-of-range default of
> 0xffffffffffffffff.
>
> To fix this, let's use a union of signed and unsigned integers to
> represent both 'int' and 'hex' range values, then use both strtoll and
> strtoull where appropriate.
>
> Assisted-by: LLM
> Signed-off-by: Julian Braha <julianbraha@gmail.com>
> ---
> scripts/kconfig/symbol.c | 41 ++++++++++++++-----
> .../kconfig/tests/warn_changed_input/Kconfig | 5 +++
> .../tests/warn_changed_input/expected_config | 1 +
> 3 files changed, 36 insertions(+), 11 deletions(-)
>
Thanks for the whole patch-set, I appreciate your clean-up and
strengthening of kconfig!
Reviewed-by: Nicolas Schier <n.schier@fritz.com>
Kind regards,
Nicolas
^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCH v2 0/5] kconfig: improve input validation for numeric options
2026-09-15 21:15 [PATCH v2 0/5] kconfig: improve input validation for numeric options Julian Braha
` (4 preceding siblings ...)
2026-09-15 21:15 ` [PATCH v2 5/5] kconfig: use unsigned integers for hex range checks Julian Braha
@ 2026-09-17 23:48 ` Nathan Chancellor
5 siblings, 0 replies; 12+ messages in thread
From: Nathan Chancellor @ 2026-09-17 23:48 UTC (permalink / raw)
To: nsc, Julian Braha
Cc: nico, rdunlap, grahamr, kees, pengpeng, vegard.nossum,
linux-kernel, linux-kbuild
On Tue, 15 Sep 2026 22:15:03 +0100, Julian Braha wrote:
> kconfig: improve input validation for numeric options
>
> This series improves checks for invalid values of 'int' and 'hex' config
> options in the Kconfig interpreter.
>
> Tests are added for all new warnings and errors.
>
> [...]
Applied to
https://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux.git kbuild-next-unstable
Thanks!
[1/5] kconfig: promote invalid numeric reference from warning to error
https://git.kernel.org/kbuild/c/95fde4bcc0b7c
[2/5] kconfig: check for out-of-bounds numeric constants
https://git.kernel.org/kbuild/c/a5e84d6f6df1f
[3/5] kconfig: check for hex and int mismatches
https://git.kernel.org/kbuild/c/d13bad83d89d1
[4/5] kconfig: prevent out-of-bounds user input for numeric options
https://git.kernel.org/kbuild/c/54f11924e4854
[5/5] kconfig: use unsigned integers for hex range checks
https://git.kernel.org/kbuild/c/9b8719973ee2c
Please look out for regression or issue reports or other follow up
comments, as they may result in the patch/series getting dropped or
reverted. Patches applied to an "unstable" branch are accepted pending
wider testing in -next and any post-commit review; they will generally
be moved to the main branch in a week if no issues are found.
Best regards,
--
Cheers,
Nathan
^ permalink raw reply [flat|nested] 12+ messages in thread