From: Nicolas Schier <n.schier@fritz.com>
To: Julian Braha <julianbraha@gmail.com>
Cc: nathan@kernel.org, nico@fluxnic.net, rdunlap@infradead.org,
grahamr@qti.qualcomm.com, kees@kernel.org, pengpeng@iscas.ac.cn,
vegard.nossum@oracle.com, linux-kernel@vger.kernel.org,
linux-kbuild@vger.kernel.org
Subject: Re: [PATCH v2 4/5] kconfig: prevent out-of-bounds user input for numeric options
Date: Thu, 17 Sep 2026 18:13:57 +0200 [thread overview]
Message-ID: <20260917-impossible-vanilla-stoat-a8e9ce@l-nschier-aarch64> (raw)
In-Reply-To: <20260915211508.291790-5-julianbraha@gmail.com>
On Tue, Sep 15, 2026 at 10:15:07PM +0100, Julian Braha wrote:
> Currently, user input of out-of-bounds values for 'int' and 'hex' options
> is possible, leading to later silent failures in Kconfig if that value is
> used in a comparison, or a warning by GCC or error by Clang if used in the
> C code.
>
> Let's factor out the out-of-bounds check on constants, so that it can be
> reused for checking user input.
>
> The frontend will now reject an attempted user input of an out-of-bounds
> numeric value, similarly to how a value outside the active 'range' already
> does.
>
> For migration of existing configurations, a .config file with an
> out-of-bounds numeric value will be allowed for now, but will warn the
> user when read in by confdata.c
>
> Assisted-by: LLM
> Signed-off-by: Julian Braha <julianbraha@gmail.com>
> ---
> scripts/kconfig/confdata.c | 6 +++++
> scripts/kconfig/lkc_proto.h | 1 +
> scripts/kconfig/menu.c | 19 +++-----------
> scripts/kconfig/symbol.c | 20 +++++++++++++++
> .../tests/err_num_bounds/expected_stderr | 20 +++++++--------
> scripts/kconfig/tests/warn_num_bounds/Kconfig | 24 ++++++++++++++++++
> .../kconfig/tests/warn_num_bounds/__init__.py | 25 +++++++++++++++++++
> scripts/kconfig/tests/warn_num_bounds/config | 7 ++++++
> .../tests/warn_num_bounds/expected_config | 11 ++++++++
> .../warn_num_bounds/expected_config_stderr | 3 +++
> .../warn_num_bounds/expected_frontend_config | 11 ++++++++
> .../warn_num_bounds/expected_frontend_stderr | 0
> 12 files changed, 121 insertions(+), 26 deletions(-)
> create mode 100644 scripts/kconfig/tests/warn_num_bounds/Kconfig
> create mode 100644 scripts/kconfig/tests/warn_num_bounds/__init__.py
> create mode 100644 scripts/kconfig/tests/warn_num_bounds/config
> create mode 100644 scripts/kconfig/tests/warn_num_bounds/expected_config
> create mode 100644 scripts/kconfig/tests/warn_num_bounds/expected_config_stderr
> create mode 100644 scripts/kconfig/tests/warn_num_bounds/expected_frontend_config
> create mode 100644 scripts/kconfig/tests/warn_num_bounds/expected_frontend_stderr
>
> diff --git a/scripts/kconfig/confdata.c b/scripts/kconfig/confdata.c
> index 4234a51d16fd..2227d89d6328 100644
> --- a/scripts/kconfig/confdata.c
> +++ b/scripts/kconfig/confdata.c
> @@ -354,6 +354,12 @@ static int conf_set_sym_val(struct symbol *sym, int def, int def_flags, char *p)
> case S_INT:
> case S_HEX:
> if (sym_string_valid(sym, p)) {
> + if (def != S_DEF_AUTO &&
> + !sym_string_check_bounds(sym, p))
> + /* hex uses 64-bit unsigned integer */
> + conf_warning("value '%s' for %s is outside the 64-bit %s integer bounds",
> + p, sym->name,
> + sym->type == S_INT ? "signed" : "unsigned");
> sym->def[def].val = xstrdup(p);
> sym->flags |= def_flags;
> } else {
> diff --git a/scripts/kconfig/lkc_proto.h b/scripts/kconfig/lkc_proto.h
> index 8914b4e8f2a8..8b436c87ba4a 100644
> --- a/scripts/kconfig/lkc_proto.h
> +++ b/scripts/kconfig/lkc_proto.h
> @@ -31,6 +31,7 @@ bool sym_set_tristate_value(struct symbol *sym,tristate tri);
> void choice_set_value(struct menu *choice, struct symbol *sym);
> tristate sym_toggle_tristate_value(struct symbol *sym);
> bool sym_string_valid(struct symbol *sym, const char *newval);
> +bool sym_string_check_bounds(struct symbol *sym, const char *str);
> bool sym_string_within_range(struct symbol *sym, const char *str);
> bool sym_set_string_value(struct symbol *sym, const char *newval);
> bool sym_is_changeable(const struct symbol *sym);
> diff --git a/scripts/kconfig/menu.c b/scripts/kconfig/menu.c
> index 2d8b0c65ce1e..6b9ef738ee71 100644
> --- a/scripts/kconfig/menu.c
> +++ b/scripts/kconfig/menu.c
> @@ -4,7 +4,6 @@
> */
>
> #include <ctype.h>
> -#include <errno.h>
> #include <stdarg.h>
> #include <stdlib.h>
> #include <string.h>
> @@ -239,8 +238,6 @@ void menu_add_symbol(enum prop_type type, struct symbol *sym, struct expr *dep)
> static int menu_validate_number(struct symbol *sym, struct symbol *sym2,
> const struct property *prop)
> {
> - const char *type_bounds;
> -
> if (sym->type != S_INT && sym->type != S_HEX)
> return 0;
>
> @@ -255,21 +252,11 @@ static int menu_validate_number(struct symbol *sym, struct symbol *sym2,
> return 1;
> }
>
> - errno = 0;
> - if (sym->type == S_INT) {
> - type_bounds = "64-bit signed integer";
> - strtoll(sym2->name, NULL, 10);
> - } else {
> - /* hex */
> - type_bounds = "64-bit unsigned integer";
> - strtoull(sym2->name, NULL, 16);
> - }
> -
> - if (errno == ERANGE) {
> + if (!sym_string_check_bounds(sym, sym2->name)) {
> fprintf(stderr,
> - "%s:%d: error: %s constant '%s' is outside the %s bounds\n",
> + "%s:%d: error: %s constant '%s' is outside the 64-bit %s bounds\n",
tests/err_num_bounds/expected_stderr wouldn't need to be updated here
with 's/bounds/integer bounds/'; but AFAIC leave it as it is right now.
Reviewed-by: Nicolas Schier <n.schier@fritz.com>
--
Nicolas
next prev parent reply other threads:[~2026-09-17 16:14 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-15 21:15 [PATCH v2 0/5] kconfig: improve input validation " Julian Braha
2026-09-15 21:15 ` [PATCH v2 1/5] kconfig: promote invalid numeric reference from warning to error Julian Braha
2026-09-17 10:54 ` Nicolas Schier
2026-09-15 21:15 ` [PATCH v2 2/5] kconfig: check for out-of-bounds numeric constants Julian Braha
2026-09-17 15:13 ` Nicolas Schier
2026-09-15 21:15 ` [PATCH v2 3/5] kconfig: check for hex and int mismatches Julian Braha
2026-09-17 15:57 ` Nicolas Schier
2026-09-15 21:15 ` [PATCH v2 4/5] kconfig: prevent out-of-bounds user input for numeric options Julian Braha
2026-09-17 16:13 ` Nicolas Schier [this message]
2026-09-15 21:15 ` [PATCH v2 5/5] kconfig: use unsigned integers for hex range checks Julian Braha
2026-09-17 16:36 ` Nicolas Schier
2026-09-17 23:48 ` [PATCH v2 0/5] kconfig: improve input validation for numeric options Nathan Chancellor
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260917-impossible-vanilla-stoat-a8e9ce@l-nschier-aarch64 \
--to=n.schier@fritz.com \
--cc=grahamr@qti.qualcomm.com \
--cc=julianbraha@gmail.com \
--cc=kees@kernel.org \
--cc=linux-kbuild@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=nathan@kernel.org \
--cc=nico@fluxnic.net \
--cc=pengpeng@iscas.ac.cn \
--cc=rdunlap@infradead.org \
--cc=vegard.nossum@oracle.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®