[PATCH v2] kconfig: use the value argument in sym_get_near_range_bound()

[PATCH v2] kconfig: use the value argument in sym_get_near_range_bound()

[Leizhen Zhang]

sym_get_near_range_bound() is meant to check whether the given value is
outside of the active range of an int/hex symbol, and is called with the
symbol's current value from sym_calc_value() and with the default value
from sym_get_string_default().

Since commit 9b8719973ee2 ("kconfig: use unsigned integers for hex range
checks") it ignores its value argument and uses the current value of the
symbol (via sym_get_range_val()) instead. As a result, an out-of-range
default is no longer clamped in sym_get_string_default(), and
savedefconfig writes out values that are equal to the effective default
again, for example CONFIG_A=4 for:

  config A
  	int "a"
  	range 1 4
  	default 8

The existing savedefconfig_range test did not catch this because it only
covers symbols without a prompt.

Parse the value argument again, and add a test case for a symbol with a
prompt.

Found while fuzzing Kconfig input with ASan/UBSan.

Fixes: 9b8719973ee2 ("kconfig: use unsigned integers for hex range checks")
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Leizhen Zhang <lzsx618@gmail.com>
---
v2:
 - Use my real name in the From and Signed-off-by lines. No code
   changes.

v1: https://lore.kernel.org/r/20261005202524.3461824-1-lzsx618@gmail.com

 scripts/kconfig/symbol.c                          | 5 ++++-
 scripts/kconfig/tests/savedefconfig_range/Kconfig | 7 +++++++
 scripts/kconfig/tests/savedefconfig_range/config  | 1 +
 3 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/scripts/kconfig/symbol.c b/scripts/kconfig/symbol.c
index 2e87af0985..11302faa28 100644
--- a/scripts/kconfig/symbol.c
+++ b/scripts/kconfig/symbol.c
@@ -195,7 +195,10 @@ static struct symbol *sym_get_near_range_bound(struct symbol *sym,
 	prop = sym_get_range_prop(sym);
 	if (!prop)
 		return NULL;
-	val = sym_get_range_val(sym, base);
+	if (base == 10)
+		val.s = strtoll(value, NULL, base);
+	else
+		val.u = strtoull(value, NULL, base);
 	range_sym = prop->expr->left.sym;
 	val2 = sym_get_range_val(range_sym, base);
 
diff --git a/scripts/kconfig/tests/savedefconfig_range/Kconfig b/scripts/kconfig/tests/savedefconfig_range/Kconfig
index fd59d9082e..d879870a52 100644
--- a/scripts/kconfig/tests/savedefconfig_range/Kconfig
+++ b/scripts/kconfig/tests/savedefconfig_range/Kconfig
@@ -58,3 +58,10 @@ config INT_CONDITIONAL_DEFAULT
 	int
 	range 1 2
 	default 3 if USE_DEFAULT
+
+# Default outside of the range of a symbol with a prompt
+
+config INT_PROMPT_DEFAULT_ABOVE_RANGE
+	int "int with prompt"
+	range 1 4
+	default 8
diff --git a/scripts/kconfig/tests/savedefconfig_range/config b/scripts/kconfig/tests/savedefconfig_range/config
index d939cfe5fd..079a3107a0 100644
--- a/scripts/kconfig/tests/savedefconfig_range/config
+++ b/scripts/kconfig/tests/savedefconfig_range/config
@@ -5,3 +5,4 @@ CONFIG_HEX_DEFAULT_ABOVE_RANGE=0x20
 CONFIG_INT_IMPLICIT_DEFAULT_ZERO=1
 CONFIG_INT_CONDITIONAL_RANGE=2
 CONFIG_INT_CONDITIONAL_DEFAULT=2
+CONFIG_INT_PROMPT_DEFAULT_ABOVE_RANGE=4
-- 
2.34.1

Re: [PATCH v2] kconfig: use the value argument in sym_get_near_range_bound()

[Julian Braha]

Hi Leizhen,

On 10/8/26 17:45, Leizhen Zhang wrote:
> sym_get_near_range_bound() is meant to check whether the given value is
> outside of the active range of an int/hex symbol, and is called with the
> symbol's current value from sym_calc_value() and with the default value
> from sym_get_string_default().
> 
> Since commit 9b8719973ee2 ("kconfig: use unsigned integers for hex range
> checks") it ignores its value argument and uses the current value of the
> symbol (via sym_get_range_val()) instead. As a result, an out-of-range
> default is no longer clamped in sym_get_string_default(), and
> savedefconfig writes out values that are equal to the effective default
> again, for example CONFIG_A=4 for:
> 
>   config A
>   	int "a"
>   	range 1 4
>   	default 8
> 
> The existing savedefconfig_range test did not catch this because it only
> covers symbols without a prompt.
> 
> Parse the value argument again, and add a test case for a symbol with a
> prompt.
> 
> Found while fuzzing Kconfig input with ASan/UBSan.
> 
> Fixes: 9b8719973ee2 ("kconfig: use unsigned integers for hex range checks")
> Assisted-by: Claude:claude-opus-5-5
> Signed-off-by: Leizhen Zhang <lzsx618@gmail.com>
> ---
> v2:
>  - Use my real name in the From and Signed-off-by lines. No code
>    changes.
> 
> v1: https://lore.kernel.org/r/20261005202524.3461824-1-lzsx618@gmail.com
> 
>  scripts/kconfig/symbol.c                          | 5 ++++-
>  scripts/kconfig/tests/savedefconfig_range/Kconfig | 7 +++++++
>  scripts/kconfig/tests/savedefconfig_range/config  | 1 +
>  3 files changed, 12 insertions(+), 1 deletion(-)
> 
> diff --git a/scripts/kconfig/symbol.c b/scripts/kconfig/symbol.c
> index 2e87af0985..11302faa28 100644
> --- a/scripts/kconfig/symbol.c
> +++ b/scripts/kconfig/symbol.c
> @@ -195,7 +195,10 @@ static struct symbol *sym_get_near_range_bound(struct symbol *sym,
>  	prop = sym_get_range_prop(sym);
>  	if (!prop)
>  		return NULL;
> -	val = sym_get_range_val(sym, base);
> +	if (base == 10)
> +		val.s = strtoll(value, NULL, base);
> +	else
> +		val.u = strtoull(value, NULL, base);

Minor style nitpick: I'd prefer a comment clarifying that the 'else'
branch is for the 'hex' type.

But... since I'm planning on a refactoring of this int / hex parsing
soon, this is fine for now.

>  	range_sym = prop->expr->left.sym;
>  	val2 = sym_get_range_val(range_sym, base);
>  
> diff --git a/scripts/kconfig/tests/savedefconfig_range/Kconfig b/scripts/kconfig/tests/savedefconfig_range/Kconfig
> index fd59d9082e..d879870a52 100644
> --- a/scripts/kconfig/tests/savedefconfig_range/Kconfig
> +++ b/scripts/kconfig/tests/savedefconfig_range/Kconfig
> @@ -58,3 +58,10 @@ config INT_CONDITIONAL_DEFAULT
>  	int
>  	range 1 2
>  	default 3 if USE_DEFAULT
> +
> +# Default outside of the range of a symbol with a prompt
> +
> +config INT_PROMPT_DEFAULT_ABOVE_RANGE
> +	int "int with prompt"
> +	range 1 4
> +	default 8
> diff --git a/scripts/kconfig/tests/savedefconfig_range/config b/scripts/kconfig/tests/savedefconfig_range/config
> index d939cfe5fd..079a3107a0 100644
> --- a/scripts/kconfig/tests/savedefconfig_range/config
> +++ b/scripts/kconfig/tests/savedefconfig_range/config
> @@ -5,3 +5,4 @@ CONFIG_HEX_DEFAULT_ABOVE_RANGE=0x20
>  CONFIG_INT_IMPLICIT_DEFAULT_ZERO=1
>  CONFIG_INT_CONDITIONAL_RANGE=2
>  CONFIG_INT_CONDITIONAL_DEFAULT=2
> +CONFIG_INT_PROMPT_DEFAULT_ABOVE_RANGE=4
> -- 2.34.1
> 

Thanks!

Tested-by: Julian Braha <julianbraha@gmail.com>
Reviewed-by: Julian Braha <julianbraha@gmail.com>

Re: [PATCH v2] kconfig: use the value argument in sym_get_near_range_bound()

[Nathan Chancellor]

On Thu, 08 Oct 2026 11:45:40 -0500, Leizhen Zhang wrote:
> kconfig: use the value argument in sym_get_near_range_bound()

Applied to

  https://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux.git kbuild-next-unstable

Thanks!

[1/1] kconfig: use the value argument in sym_get_near_range_bound()
      https://git.kernel.org/kbuild/c/a8f72a75b38a1

Please look out for regression or issue reports or other follow up
comments, as they may result in the patch/series getting dropped or
reverted. Patches applied to an "unstable" branch are accepted pending
wider testing in -next and any post-commit review; they will generally
be moved to the main branch in a week if no issues are found.

Best regards,
-- 
Cheers,
Nathan