[PATCH 0/2] kconfig: error on reverse range

[PATCH 0/2] kconfig: error on reverse range

[Julian Braha]

This series adds more input validation to Kconfig, specifically checking
that ranges for numeric options are properly ordered. This check was
originally introduced as part of kconfirm [1], but there are no findings
for this across the tree, so the check can be added directly into Kconfig.

Patch 1/2 adds a prop_err() function to match the existing prop_warn(),
which is then used in patch 2/2 where the check is introduced.

[1] https://lore.kernel.org/all/20260904220559.GB2787252@ax162/
---
Julian Braha (2):
  kconfig: add prop_err function to simplify property error handling
  kconfig: error on reverse range

 scripts/kconfig/menu.c                        | 45 +++++++---
 .../tests/err_num_bounds/expected_stderr      | 20 ++---
 .../tests/err_num_mismatch/expected_stderr    |  8 +-
 .../err_num_non_numeric_ref/expected_stderr   | 32 +++----
 .../tests/err_num_reverse_range/Kconfig       | 90 +++++++++++++++++++
 .../tests/err_num_reverse_range/__init__.py   |  9 ++
 .../err_num_reverse_range/expected_stderr     |  7 ++
 7 files changed, 169 insertions(+), 42 deletions(-)
 create mode 100644 scripts/kconfig/tests/err_num_reverse_range/Kconfig
 create mode 100644 scripts/kconfig/tests/err_num_reverse_range/__init__.py
 create mode 100644 scripts/kconfig/tests/err_num_reverse_range/expected_stderr

-- 
2.55.0

[PATCH 1/2] kconfig: add prop_err function to simplify property error handling

[Julian Braha]

As suggested by Nicolas while reviewing another Kconfig property error [1],
we can add a prop_err() function to simplify the tracking and display of
Kconfig property errors.

Note that the formatting of the error printing is changed slightly
(removing a space) to better match the formatting of warnings. This causes
a change to the expected test output for the existing errors that now call
prop_err().

Link: https://lore.kernel.org/all/20260917-proficient-swift-of-masquerade-0ff7ce@l-nschier-aarch64/ [1]
Assisted-by: LLM
Suggested-by: Nicolas Schier <n.schier@fritz.com>
Signed-off-by: Julian Braha <julianbraha@gmail.com>
---
 scripts/kconfig/menu.c                        | 23 ++++++++-----
 .../tests/err_num_bounds/expected_stderr      | 20 ++++++------
 .../tests/err_num_mismatch/expected_stderr    |  8 ++---
 .../err_num_non_numeric_ref/expected_stderr   | 32 +++++++++----------
 4 files changed, 45 insertions(+), 38 deletions(-)

diff --git a/scripts/kconfig/menu.c b/scripts/kconfig/menu.c
index bda3e2650216..118af2dde722 100644
--- a/scripts/kconfig/menu.c
+++ b/scripts/kconfig/menu.c
@@ -59,6 +59,16 @@ static void prop_warn(const struct property *prop, const char *fmt, ...)
 	va_end(ap);
 }
 
+static void prop_err(const struct property *prop, const char *fmt, ...)
+{
+	va_list ap;
+	va_start(ap, fmt);
+	fprintf(stderr, "%s:%d:error: ", prop->filename, prop->lineno);
+	vfprintf(stderr, fmt, ap);
+	fprintf(stderr, "\n");
+	va_end(ap);
+}
+
 void _menu_init(void)
 {
 	current_entry = current_menu = &rootmenu;
@@ -246,18 +256,15 @@ static int menu_validate_number(struct symbol *sym, struct symbol *sym2,
 
 	if (sym2->type != S_UNKNOWN ||
 		!sym_string_valid(sym, sym2->name)) {
-		fprintf(stderr, "%s:%d: error: '%s' is an invalid value for '%s'\n",
-			prop->filename, prop->lineno, sym2->name,
-			sym_type_name(sym->type));
+		prop_err(prop, "'%s' is an invalid value for '%s'",
+			 sym2->name, sym_type_name(sym->type));
 		return 1;
 	}
 
 	if (!sym_string_check_bounds(sym, sym2->name)) {
-		fprintf(stderr,
-			"%s:%d: error: %s constant '%s' is outside the 64-bit %s bounds\n",
-			prop->filename, prop->lineno, sym_type_name(sym->type),
-			sym2->name, sym->type == S_INT ? "signed" : "unsigned");
-
+		prop_err(prop, "%s constant '%s' is outside the 64-bit %s bounds",
+			 sym_type_name(sym->type), sym2->name,
+			 sym->type == S_INT ? "signed" : "unsigned");
 		return 1;
 	}
 
diff --git a/scripts/kconfig/tests/err_num_bounds/expected_stderr b/scripts/kconfig/tests/err_num_bounds/expected_stderr
index 5f89cf4afff8..c012b10bae25 100644
--- a/scripts/kconfig/tests/err_num_bounds/expected_stderr
+++ b/scripts/kconfig/tests/err_num_bounds/expected_stderr
@@ -1,10 +1,10 @@
-Kconfig:51: error: integer constant '10000000000000000000' is outside the 64-bit signed bounds
-Kconfig:55: error: integer constant '-9223372036854775809' is outside the 64-bit signed bounds
-Kconfig:59: error: integer constant '10000000000000000000' is outside the 64-bit signed bounds
-Kconfig:63: error: integer constant '-10000000000000000000' is outside the 64-bit signed bounds
-Kconfig:67: error: integer constant '-9223372036854775809' is outside the 64-bit signed bounds
-Kconfig:67: error: integer constant '10000000000000000000' is outside the 64-bit signed bounds
-Kconfig:71: error: hex constant '0x10000000000000000' is outside the 64-bit unsigned bounds
-Kconfig:75: error: hex constant '0x10000000000000000' is outside the 64-bit unsigned bounds
-Kconfig:79: error: hex constant '0x10000000000000000' is outside the 64-bit unsigned bounds
-Kconfig:79: error: hex constant '0x20000000000000000' is outside the 64-bit unsigned bounds
+Kconfig:51:error: integer constant '10000000000000000000' is outside the 64-bit signed bounds
+Kconfig:55:error: integer constant '-9223372036854775809' is outside the 64-bit signed bounds
+Kconfig:59:error: integer constant '10000000000000000000' is outside the 64-bit signed bounds
+Kconfig:63:error: integer constant '-10000000000000000000' is outside the 64-bit signed bounds
+Kconfig:67:error: integer constant '-9223372036854775809' is outside the 64-bit signed bounds
+Kconfig:67:error: integer constant '10000000000000000000' is outside the 64-bit signed bounds
+Kconfig:71:error: hex constant '0x10000000000000000' is outside the 64-bit unsigned bounds
+Kconfig:75:error: hex constant '0x10000000000000000' is outside the 64-bit unsigned bounds
+Kconfig:79:error: hex constant '0x10000000000000000' is outside the 64-bit unsigned bounds
+Kconfig:79:error: hex constant '0x20000000000000000' is outside the 64-bit unsigned bounds
diff --git a/scripts/kconfig/tests/err_num_mismatch/expected_stderr b/scripts/kconfig/tests/err_num_mismatch/expected_stderr
index 587c34467ae6..058b507396f4 100644
--- a/scripts/kconfig/tests/err_num_mismatch/expected_stderr
+++ b/scripts/kconfig/tests/err_num_mismatch/expected_stderr
@@ -1,4 +1,4 @@
-Kconfig:14: error: 'HEX_SOURCE' is an invalid value for 'integer'
-Kconfig:18: error: 'HEX_SOURCE' is an invalid value for 'integer'
-Kconfig:24: error: 'INT_SOURCE' is an invalid value for 'hex'
-Kconfig:28: error: 'INT_SOURCE' is an invalid value for 'hex'
+Kconfig:14:error: 'HEX_SOURCE' is an invalid value for 'integer'
+Kconfig:18:error: 'HEX_SOURCE' is an invalid value for 'integer'
+Kconfig:24:error: 'INT_SOURCE' is an invalid value for 'hex'
+Kconfig:28:error: 'INT_SOURCE' is an invalid value for 'hex'
diff --git a/scripts/kconfig/tests/err_num_non_numeric_ref/expected_stderr b/scripts/kconfig/tests/err_num_non_numeric_ref/expected_stderr
index 005f855ecbdd..48d78b5c18b1 100644
--- a/scripts/kconfig/tests/err_num_non_numeric_ref/expected_stderr
+++ b/scripts/kconfig/tests/err_num_non_numeric_ref/expected_stderr
@@ -1,16 +1,16 @@
-Kconfig:17: error: 'BOOL_SOURCE' is an invalid value for 'integer'
-Kconfig:21: error: 'TRISTATE_SOURCE' is an invalid value for 'integer'
-Kconfig:25: error: 'STRING_SOURCE' is an invalid value for 'integer'
-Kconfig:31: error: 'BOOL_SOURCE' is an invalid value for 'hex'
-Kconfig:35: error: 'TRISTATE_SOURCE' is an invalid value for 'hex'
-Kconfig:39: error: 'STRING_SOURCE' is an invalid value for 'hex'
-Kconfig:45: error: 'BOOL_SOURCE' is an invalid value for 'integer'
-Kconfig:49: error: 'TRISTATE_SOURCE' is an invalid value for 'integer'
-Kconfig:53: error: 'STRING_SOURCE' is an invalid value for 'integer'
-Kconfig:57: error: 'BOOL_SOURCE' is an invalid value for 'integer'
-Kconfig:57: error: 'TRISTATE_SOURCE' is an invalid value for 'integer'
-Kconfig:63: error: 'BOOL_SOURCE' is an invalid value for 'hex'
-Kconfig:67: error: 'TRISTATE_SOURCE' is an invalid value for 'hex'
-Kconfig:71: error: 'STRING_SOURCE' is an invalid value for 'hex'
-Kconfig:75: error: 'BOOL_SOURCE' is an invalid value for 'hex'
-Kconfig:75: error: 'TRISTATE_SOURCE' is an invalid value for 'hex'
+Kconfig:17:error: 'BOOL_SOURCE' is an invalid value for 'integer'
+Kconfig:21:error: 'TRISTATE_SOURCE' is an invalid value for 'integer'
+Kconfig:25:error: 'STRING_SOURCE' is an invalid value for 'integer'
+Kconfig:31:error: 'BOOL_SOURCE' is an invalid value for 'hex'
+Kconfig:35:error: 'TRISTATE_SOURCE' is an invalid value for 'hex'
+Kconfig:39:error: 'STRING_SOURCE' is an invalid value for 'hex'
+Kconfig:45:error: 'BOOL_SOURCE' is an invalid value for 'integer'
+Kconfig:49:error: 'TRISTATE_SOURCE' is an invalid value for 'integer'
+Kconfig:53:error: 'STRING_SOURCE' is an invalid value for 'integer'
+Kconfig:57:error: 'BOOL_SOURCE' is an invalid value for 'integer'
+Kconfig:57:error: 'TRISTATE_SOURCE' is an invalid value for 'integer'
+Kconfig:63:error: 'BOOL_SOURCE' is an invalid value for 'hex'
+Kconfig:67:error: 'TRISTATE_SOURCE' is an invalid value for 'hex'
+Kconfig:71:error: 'STRING_SOURCE' is an invalid value for 'hex'
+Kconfig:75:error: 'BOOL_SOURCE' is an invalid value for 'hex'
+Kconfig:75:error: 'TRISTATE_SOURCE' is an invalid value for 'hex'
-- 
2.55.0

[PATCH 2/2] kconfig: error on reverse range

[Julian Braha]

As discussed on kconfirm v4 [1], it was decided to move checks directly
into the kconfig interpreter once where are no findings from kconfirm.
This "reverse range" currently has no findings across the tree, so let's
add the check.

Currently, if a reverse range is attempted, such as:

    config EXAMPLE
        int "Reverse range example"
        range 2 1

then the value of the option defaults to its "lower" limit of 2. If the
option is visible in the frontend, then the user gets trapped in the value
selection interface, since there is no value that is actually valid for
the user to set.

Note that this only checks ranges that use constant values. Statically
checking ranges using symbols would require SAT solving, or similar.

Link: https://lore.kernel.org/all/20260904220559.GB2787252@ax162/ [1]
Assisted-by: LLM
Signed-off-by: Julian Braha <julianbraha@gmail.com>
---
 scripts/kconfig/menu.c                        | 22 ++++-
 .../tests/err_num_reverse_range/Kconfig       | 86 +++++++++++++++++++
 .../tests/err_num_reverse_range/__init__.py   |  8 ++
 .../err_num_reverse_range/expected_stderr     |  7 ++
 4 files changed, 119 insertions(+), 4 deletions(-)
 create mode 100644 scripts/kconfig/tests/err_num_reverse_range/Kconfig
 create mode 100644 scripts/kconfig/tests/err_num_reverse_range/__init__.py
 create mode 100644 scripts/kconfig/tests/err_num_reverse_range/expected_stderr

diff --git a/scripts/kconfig/menu.c b/scripts/kconfig/menu.c
index 118af2dde722..cc335f6db257 100644
--- a/scripts/kconfig/menu.c
+++ b/scripts/kconfig/menu.c
@@ -274,9 +274,9 @@ static int menu_validate_number(struct symbol *sym, struct symbol *sym2,
 static int sym_check_prop(struct symbol *sym)
 {
 	struct property *prop;
-	struct symbol *sym2;
+	struct symbol *sym2, *lower, *upper;
 	char *use;
-	int errors = 0;
+	int errors = 0, numeric_errors = 0;
 
 	for (prop = sym->prop; prop; prop = prop->next) {
 		switch (prop->type) {
@@ -325,8 +325,22 @@ static int sym_check_prop(struct symbol *sym)
 			if (sym->type != S_INT && sym->type != S_HEX)
 				prop_warn(prop, "range is only allowed "
 						"for int or hex symbols");
-			errors += menu_validate_number(sym, prop->expr->left.sym, prop);
-			errors += menu_validate_number(sym, prop->expr->right.sym, prop);
+			lower = prop->expr->left.sym;
+			upper = prop->expr->right.sym;
+			numeric_errors += menu_validate_number(sym, lower, prop);
+			numeric_errors += menu_validate_number(sym, upper, prop);
+			errors += numeric_errors;
+			if (numeric_errors || lower->type != S_UNKNOWN || upper->type != S_UNKNOWN)
+				break;
+
+			if ((sym->type == S_INT &&
+				strtoll(lower->name, NULL, 10) > strtoll(upper->name, NULL, 10)) ||
+				(sym->type == S_HEX &&
+				strtoull(lower->name, NULL, 16) > strtoull(upper->name, NULL, 16))) {
+				prop_err(prop, "range lower limit '%s' is greater than upper limit '%s'",
+					lower->name, upper->name);
+				errors++;
+			}
 			break;
 		default:
 			;
diff --git a/scripts/kconfig/tests/err_num_reverse_range/Kconfig b/scripts/kconfig/tests/err_num_reverse_range/Kconfig
new file mode 100644
index 000000000000..064586597e50
--- /dev/null
+++ b/scripts/kconfig/tests/err_num_reverse_range/Kconfig
@@ -0,0 +1,86 @@
+# SPDX-License-Identifier: GPL-2.0
+# Check constant range bounds.
+
+config INT_ORDERED
+	int
+	range -10 10
+
+config INT_EQUAL
+	int
+	range 5 5
+
+config HEX_ORDERED
+	hex
+	range 0x7fffffffffffffff 0xffffffffffffffff
+
+config HEX_EQUAL
+	hex
+	range 0xffffffffffffffff 0xffffffffffffffff
+
+# Skip ranges with symbolic bounds.
+
+config INT_LOWER
+	int
+
+config INT_UPPER
+	int
+
+config INT_SYMBOL_LOWER
+	int
+	range INT_LOWER 0
+
+config INT_SYMBOL_UPPER
+	int
+	range 0 INT_UPPER
+
+config INT_SYMBOL_BOTH
+	int
+	range INT_LOWER INT_UPPER
+
+config HEX_LOWER
+	hex
+
+config HEX_UPPER
+	hex
+
+config HEX_SYMBOL_LOWER
+	hex
+	range HEX_LOWER 0x0
+
+config HEX_SYMBOL_UPPER
+	hex
+	range 0x0 HEX_UPPER
+
+config HEX_SYMBOL_BOTH
+	hex
+	range HEX_LOWER HEX_UPPER
+
+# Reject reversed constant bounds.
+
+config INT_REVERSED
+	int
+	range 10 2
+
+config INT_REVERSED_NEGATIVE
+	int
+	range -1 -10
+
+config INT_REVERSED_SIGNED
+	int
+	range 1 -1
+
+config INT_REVERSED_QUOTED
+	int
+	range "8" "2"
+
+config HEX_REVERSED
+	hex
+	range 0x10 0xf
+
+config HEX_REVERSED_HIGH
+	hex
+	range 0xffffffffffffffff 0x8000000000000000
+
+config HEX_REVERSED_UNPREFIXED
+	hex
+	range f a
diff --git a/scripts/kconfig/tests/err_num_reverse_range/__init__.py b/scripts/kconfig/tests/err_num_reverse_range/__init__.py
new file mode 100644
index 000000000000..4a7219bbe49e
--- /dev/null
+++ b/scripts/kconfig/tests/err_num_reverse_range/__init__.py
@@ -0,0 +1,8 @@
+# SPDX-License-Identifier: GPL-2.0
+"""
+Reject constant range bounds when the lower bound is greater than the upper.
+"""
+
+def test(conf):
+    assert conf.olddefconfig() == 1
+    assert conf.stderr_matches('expected_stderr')
diff --git a/scripts/kconfig/tests/err_num_reverse_range/expected_stderr b/scripts/kconfig/tests/err_num_reverse_range/expected_stderr
new file mode 100644
index 000000000000..c06edc48547d
--- /dev/null
+++ b/scripts/kconfig/tests/err_num_reverse_range/expected_stderr
@@ -0,0 +1,7 @@
+Kconfig:62:error: range lower limit '10' is greater than upper limit '2'
+Kconfig:66:error: range lower limit '-1' is greater than upper limit '-10'
+Kconfig:70:error: range lower limit '1' is greater than upper limit '-1'
+Kconfig:74:error: range lower limit '8' is greater than upper limit '2'
+Kconfig:78:error: range lower limit '0x10' is greater than upper limit '0xf'
+Kconfig:82:error: range lower limit '0xffffffffffffffff' is greater than upper limit '0x8000000000000000'
+Kconfig:86:error: range lower limit 'f' is greater than upper limit 'a'
-- 
2.55.0

Re: [PATCH 1/2] kconfig: add prop_err function to simplify property error handling

[Nicolas Schier]

> As suggested by Nicolas while reviewing another Kconfig property error [1],
> we can add a prop_err() function to simplify the tracking and display of
> Kconfig property errors.
> 
> Note that the formatting of the error printing is changed slightly
> (removing a space) to better match the formatting of warnings. This causes
> a change to the expected test output for the existing errors that now call
> prop_err().

I think it would be better to keep the space here and add it to
menu_warn() and prop_warn() output instead.  Then the format matches the
warning/error format of gcc:

$ gcc -x c - <<<"main() { return 0; }"
<stdin>:1:1: error: return type defaults to ‘int’ [-Wimplicit-int]


Otherwise, this looks good to me, thanks!

Tested-by: Nicolas Schier <n.schier@fritz.com>
Reviewed-by: Nicolas Schier <n.schier@fritz.com>

-- 
Nicolas

Re: [PATCH 2/2] kconfig: error on reverse range

[Nicolas Schier]

> As discussed on kconfirm v4 [1], it was decided to move checks directly
> into the kconfig interpreter once where are no findings from kconfirm.

s/where/there/

> This "reverse range" currently has no findings across the tree, so let's
> add the check.
> 
> Currently, if a reverse range is attempted, such as:
> 
>     config EXAMPLE
>         int "Reverse range example"
>         range 2 1
> 
> then the value of the option defaults to its "lower" limit of 2. If the
> option is visible in the frontend, then the user gets trapped in the value
> selection interface, since there is no value that is actually valid for
> the user to set.
> 
> Note that this only checks ranges that use constant values. Statically
> checking ranges using symbols would require SAT solving, or similar.
> 
> Link: https://lore.kernel.org/all/20260904220559.GB2787252@ax162/ [1]
> Assisted-by: LLM
> Signed-off-by: Julian Braha <julianbraha@gmail.com>
>
> diff --git a/scripts/kconfig/menu.c b/scripts/kconfig/menu.c
> index 118af2dde722..cc335f6db257 100644
> --- a/scripts/kconfig/menu.c
> +++ b/scripts/kconfig/menu.c
> @@ -274,9 +274,9 @@ static int menu_validate_number(struct symbol *sym, struct symbol *sym2,
>  static int sym_check_prop(struct symbol *sym)
>  {
>  	struct property *prop;
> -	struct symbol *sym2;
> +	struct symbol *sym2, *lower, *upper;
>  	char *use;
> -	int errors = 0;
> +	int errors = 0, numeric_errors = 0;
>  
>  	for (prop = sym->prop; prop; prop = prop->next) {
>  		switch (prop->type) {
> @@ -325,8 +325,22 @@ static int sym_check_prop(struct symbol *sym)
>  			if (sym->type != S_INT && sym->type != S_HEX)
>  				prop_warn(prop, "range is only allowed "
>  						"for int or hex symbols");
> -			errors += menu_validate_number(sym, prop->expr->left.sym, prop);
> -			errors += menu_validate_number(sym, prop->expr->right.sym, prop);
> +			lower = prop->expr->left.sym;
> +			upper = prop->expr->right.sym;
> +			numeric_errors += menu_validate_number(sym, lower, prop);
> +			numeric_errors += menu_validate_number(sym, upper, prop);
> +			errors += numeric_errors;
> +			if (numeric_errors || lower->type != S_UNKNOWN || upper->type != S_UNKNOWN)
> +				break;
> +
> +			if ((sym->type == S_INT &&
> +				strtoll(lower->name, NULL, 10) > strtoll(upper->name, NULL, 10)) ||
> +				(sym->type == S_HEX &&
> +				strtoull(lower->name, NULL, 16) > strtoull(upper->name, NULL, 16))) {
> +				prop_err(prop, "range lower limit '%s' is greater than upper limit '%s'",
> +					lower->name, upper->name);
> +				errors++;
> +			}

Thanks, looks good to me.  I don't like that we do these strto{u,}ll()
conversions everywhere repeated.  But I think it's ok for now.

Tested-by: Nicolas Schier <n.schier@fritz.com>
Reviewed-by: Nicolas Schier <n.schier@fritz.com>

-- 
Nicolas

Re: [PATCH 2/2] kconfig: error on reverse range

[Julian Braha]

On 9/24/26 11:57, Nicolas Schier wrote:
> Thanks, looks good to me.  I don't like that we do these strto{u,}ll()
> conversions everywhere repeated.  But I think it's ok for now.

Very much agreed, I'm thinking about how best to refactor this.

- Julian Braha

Re: [PATCH 1/2] kconfig: add prop_err function to simplify property error handling

[Julian Braha]

On 9/24/26 11:57, Nicolas Schier wrote:
> I think it would be better to keep the space here and add it to
> menu_warn() and prop_warn() output instead.  Then the format matches the
> warning/error format of gcc:
> 
> $ gcc -x c - <<<"main() { return 0; }"
> <stdin>:1:1: error: return type defaults to ‘int’ [-Wimplicit-int]

Ah very good point! Will update both of these to the gcc style.

- Julian Braha