[PATCH v3 0/2] list: add missing empty list check to list_cut_before()

[PATCH v3 0/2] list: add missing empty list check to list_cut_before()

[Ziran Zhang]

v3:
- Elaborate the rationale in the commit message, as requested
  by Andy Shevchenko.
- Add Reviewed-by from Andy Shevchenko to patch 2/2.

v2:
- Add a KUnit test case as requested by Andy Shevchenko.
- Patch 1 adds the missing list_empty() guard, patch 2 adds the
  test case.

v1:
- https://lore.kernel.org/all/20260916100001.10634-1-zhangcoder@yeah.net/

Tested with:
  tools/testing/kunit/kunit.py run --kernel_args=kunit.filter_glob='list-kunit-test'

Test result:
  [PASSED] list_test_list_cut_before_empty
  Testing complete. Ran 40 tests: passed: 40

Ziran Zhang (2):
  list: add missing empty list check to list_cut_before()
  list: add KUnit test for list_cut_before() empty list case

 include/linux/list.h  |  5 +++++
 lib/tests/list-test.c | 18 ++++++++++++++++++
 2 files changed, 23 insertions(+)

-- 
2.51.0

[PATCH v3 1/2] list: add missing empty list check to list_cut_before()

[Ziran Zhang]

list_cut_before() lacks the list_empty() guard present in
list_cut_position().  With an empty head, the function falls through
to the pointer updates instead of returning early.

Both helpers share the same kernel-doc wording:

  'You should pass on @entry an element you know is on @head.'

Nevertheless, list_cut_position() returns early for an empty head,
and list_splice() also checks its source list before doing any
pointer updates.  Make list_cut_before() consistent with them for
the empty-list case.

Signed-off-by: Ziran Zhang <zhangcoder@yeah.net>
---
 include/linux/list.h | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/include/linux/list.h b/include/linux/list.h
index 77fb62f79..4d2061d35 100644
--- a/include/linux/list.h
+++ b/include/linux/list.h
@@ -555,6 +555,11 @@ static inline void list_cut_before(struct list_head *list,
 				   struct list_head *head,
 				   struct list_head *entry)
 {
+	if (list_empty(head)) {
+		INIT_LIST_HEAD(list);
+		return;
+	}
+
 	if (head->next == entry) {
 		INIT_LIST_HEAD(list);
 		return;
-- 
2.51.0

Re: [PATCH v3 1/2] list: add missing empty list check to list_cut_before()

[Andy Shevchenko]

On Fri, Sep 18, 2026 at 04:10:25PM +0800, Ziran Zhang wrote:
> list_cut_before() lacks the list_empty() guard present in
> list_cut_position().  With an empty head, the function falls through
> to the pointer updates instead of returning early.
> 
> Both helpers share the same kernel-doc wording:
> 
>   'You should pass on @entry an element you know is on @head.'
> 
> Nevertheless, list_cut_position() returns early for an empty head,
> and list_splice() also checks its source list before doing any
> pointer updates.  Make list_cut_before() consistent with them for
> the empty-list case.

OK, the reasoning sounds good to me,
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>

-- 
With Best Regards,
Andy Shevchenko

[PATCH v3 2/2] list: add KUnit test for list_cut_before() empty list case

[Ziran Zhang]

Add a test case covering list_cut_before() with an empty head
and an entry not on the list.  Without the empty list guard,
the call would corrupt the head list.

Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Ziran Zhang <zhangcoder@yeah.net>
---
 lib/tests/list-test.c | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/lib/tests/list-test.c b/lib/tests/list-test.c
index 6d9227a2b..f54facdb7 100644
--- a/lib/tests/list-test.c
+++ b/lib/tests/list-test.c
@@ -446,6 +446,23 @@ static void list_test_list_cut_before(struct kunit *test)
 	KUNIT_EXPECT_EQ(test, i, 3);
 }
 
+static void list_test_list_cut_before_empty(struct kunit *test)
+{
+	LIST_HEAD(entry);
+	LIST_HEAD(head);
+	LIST_HEAD(list);
+
+	/*
+	 * entry is initialized but not on head.  With an empty head
+	 * this used to corrupt the list.
+	 */
+	list_cut_before(&list, &head, &entry);
+
+	KUNIT_EXPECT_TRUE(test, list_empty(&head));
+	KUNIT_EXPECT_TRUE(test, list_empty(&list));
+	KUNIT_EXPECT_TRUE(test, list_empty(&entry));
+}
+
 static void list_test_list_splice(struct kunit *test)
 {
 	struct list_head entries[5], *cur;
@@ -788,6 +805,7 @@ static struct kunit_case list_test_cases[] = {
 	KUNIT_CASE(list_test_list_is_singular),
 	KUNIT_CASE(list_test_list_cut_position),
 	KUNIT_CASE(list_test_list_cut_before),
+	KUNIT_CASE(list_test_list_cut_before_empty),
 	KUNIT_CASE(list_test_list_splice),
 	KUNIT_CASE(list_test_list_splice_tail),
 	KUNIT_CASE(list_test_list_splice_init),
-- 
2.51.0