[PATCH v2 0/2] list: add missing empty list check to list_cut_before()

[PATCH v2 0/2] list: add missing empty list check to list_cut_before()

[Ziran Zhang]

v2:
- Add a KUnit test case as requested by Andy Shevchenko.
- Patch 1 adds the missing list_empty() guard, patch 2 adds the
  test case.

v1:
- https://lore.kernel.org/all/20260916100001.10634-1-zhangcoder@yeah.net/

Tested with:
  tools/testing/kunit/kunit.py run --kernel_args=kunit.filter_glob='list-kunit-test'

Test result:
  [PASSED] list_test_list_cut_before_empty
  Testing complete. Ran 40 tests: passed: 40

Ziran Zhang (2):
  list: add missing empty list check to list_cut_before()
  list: add KUnit test for list_cut_before() empty list case

 include/linux/list.h  |  5 +++++
 lib/tests/list-test.c | 18 ++++++++++++++++++
 2 files changed, 23 insertions(+)

-- 
2.51.0

[PATCH v2 1/2] list: add missing empty list check to list_cut_before()

[Ziran Zhang]

list_cut_before() lacks the list_empty() guard present
in list_cut_position().

With an empty head and an entry not on the list, it
corrupts the list.

Add the missing check.  When head is empty, initialize
@list as empty, consistent with the existing
head->next == entry case.

Signed-off-by: Ziran Zhang <zhangcoder@yeah.net>
---
 include/linux/list.h | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/include/linux/list.h b/include/linux/list.h
index 77fb62f79..4d2061d35 100644
--- a/include/linux/list.h
+++ b/include/linux/list.h
@@ -555,6 +555,11 @@ static inline void list_cut_before(struct list_head *list,
 				   struct list_head *head,
 				   struct list_head *entry)
 {
+	if (list_empty(head)) {
+		INIT_LIST_HEAD(list);
+		return;
+	}
+
 	if (head->next == entry) {
 		INIT_LIST_HEAD(list);
 		return;
-- 
2.51.0

Re: [PATCH v2 1/2] list: add missing empty list check to list_cut_before()

[Andy Shevchenko]

On Thu, Sep 17, 2026 at 08:55:04PM +0800, Ziran Zhang wrote:
> list_cut_before() lacks the list_empty() guard present
> in list_cut_position().
> 
> With an empty head and an entry not on the list, it
> corrupts the list.

The kernel-doc specifically says:

  'You should pass in @entry an element you know is on @head.'

Do you have a real life example?

> Add the missing check.  When head is empty, initialize
> @list as empty, consistent with the existing
> head->next == entry case.

The room of the lines for the body of the commit message is ~72 characters
and not 56.

...

What makes it different to the similar cases in list_splice(), for example?

-- 
With Best Regards,
Andy Shevchenko

Re: [PATCH v2 1/2] list: add missing empty list check to list_cut_before()

[Ziran Zhang]

On Thu, 17 Sep 2026 18:21:45 +0300, Andy Shevchenko <andriy.shevchenko@linux.intel.com> wrote:
> The kernel-doc specifically says:
> 
>   'You should pass in @entry an element you know is on @head.'
> 
> Do you have a real life example?

No, I do not have a real life example.  It was based on code
analysis only.

> The room of the lines for the body of the commit message is ~72
> characters and not 56.

Noted, I will keep that in mind for future patches.

> What makes it different to the similar cases in list_splice(), for
> example?

list_splice() has an empty-list check too, on its source list:

	if (!list_empty(list))
		__list_splice(list, head, head->next);

list_cut_position() does the same for its source list:

	if (list_empty(head))
		return;

But list_cut_position() has the same kernel-doc wording:

  'You should pass on @entry an element you know is on @head.'

and still returns early for an empty head.

So list_cut_position() handles an empty head before doing any pointer
updates, even though the kernel-doc contract only requires @entry to
be on @head.  My patch makes list_cut_before() do the same.

I agree this is a defensive change, not a bug fix.  If the consensus
is to rely strictly on the caller contract, I will drop this series.

For list_cut_before() specifically, making it match list_cut_position()
seemed reasonable.

Thanks,
Ziran Zhang

Re: [PATCH v2 1/2] list: add missing empty list check to list_cut_before()

[Andy Shevchenko]

On Fri, Sep 18, 2026 at 12:14:56AM +0800, Ziran Zhang wrote:
> On Thu, 17 Sep 2026 18:21:45 +0300, Andy Shevchenko <andriy.shevchenko@linux.intel.com> wrote:
> > The kernel-doc specifically says:
> > 
> >   'You should pass in @entry an element you know is on @head.'
> > 
> > Do you have a real life example?
> 
> No, I do not have a real life example.  It was based on code
> analysis only.
> 
> > The room of the lines for the body of the commit message is ~72
> > characters and not 56.
> 
> Noted, I will keep that in mind for future patches.
> 
> > What makes it different to the similar cases in list_splice(), for
> > example?
> 
> list_splice() has an empty-list check too, on its source list:
> 
> 	if (!list_empty(list))
> 		__list_splice(list, head, head->next);
> 
> list_cut_position() does the same for its source list:
> 
> 	if (list_empty(head))
> 		return;
> 
> But list_cut_position() has the same kernel-doc wording:
> 
>   'You should pass on @entry an element you know is on @head.'
> 
> and still returns early for an empty head.
> 
> So list_cut_position() handles an empty head before doing any pointer
> updates, even though the kernel-doc contract only requires @entry to
> be on @head.  My patch makes list_cut_before() do the same.
> 
> I agree this is a defensive change, not a bug fix.  If the consensus
> is to rely strictly on the caller contract, I will drop this series.
> 
> For list_cut_before() specifically, making it match list_cut_position()
> seemed reasonable.

Please, summarize the above and elaborate all this in the commit message
in the next version.

-- 
With Best Regards,
Andy Shevchenko

[PATCH v2 2/2] list: add KUnit test for list_cut_before() empty list case

[Ziran Zhang]

Add a test case covering list_cut_before() with an empty head
and an entry not on the list.  Without the empty list guard,
the call would corrupt the head list.

Signed-off-by: Ziran Zhang <zhangcoder@yeah.net>
---
 lib/tests/list-test.c | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/lib/tests/list-test.c b/lib/tests/list-test.c
index 6d9227a2b..f54facdb7 100644
--- a/lib/tests/list-test.c
+++ b/lib/tests/list-test.c
@@ -446,6 +446,23 @@ static void list_test_list_cut_before(struct kunit *test)
 	KUNIT_EXPECT_EQ(test, i, 3);
 }
 
+static void list_test_list_cut_before_empty(struct kunit *test)
+{
+	LIST_HEAD(entry);
+	LIST_HEAD(head);
+	LIST_HEAD(list);
+
+	/*
+	 * entry is initialized but not on head.  With an empty head
+	 * this used to corrupt the list.
+	 */
+	list_cut_before(&list, &head, &entry);
+
+	KUNIT_EXPECT_TRUE(test, list_empty(&head));
+	KUNIT_EXPECT_TRUE(test, list_empty(&list));
+	KUNIT_EXPECT_TRUE(test, list_empty(&entry));
+}
+
 static void list_test_list_splice(struct kunit *test)
 {
 	struct list_head entries[5], *cur;
@@ -788,6 +805,7 @@ static struct kunit_case list_test_cases[] = {
 	KUNIT_CASE(list_test_list_is_singular),
 	KUNIT_CASE(list_test_list_cut_position),
 	KUNIT_CASE(list_test_list_cut_before),
+	KUNIT_CASE(list_test_list_cut_before_empty),
 	KUNIT_CASE(list_test_list_splice),
 	KUNIT_CASE(list_test_list_splice_tail),
 	KUNIT_CASE(list_test_list_splice_init),
-- 
2.51.0

Re: [PATCH v2 2/2] list: add KUnit test for list_cut_before() empty list case

[Andy Shevchenko]

On Thu, Sep 17, 2026 at 08:55:05PM +0800, Ziran Zhang wrote:
> Add a test case covering list_cut_before() with an empty head
> and an entry not on the list.  Without the empty list guard,
> the call would corrupt the head list.

Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>

(New test cases, when they are desired, have always a green light!)

-- 
With Best Regards,
Andy Shevchenko