Re: [PATCH v2] kconfig: use the value argument in sym_get_near_range_bound()

[Julian Braha]

Hi Leizhen,

On 10/8/26 17:45, Leizhen Zhang wrote:
> sym_get_near_range_bound() is meant to check whether the given value is
> outside of the active range of an int/hex symbol, and is called with the
> symbol's current value from sym_calc_value() and with the default value
> from sym_get_string_default().
> 
> Since commit 9b8719973ee2 ("kconfig: use unsigned integers for hex range
> checks") it ignores its value argument and uses the current value of the
> symbol (via sym_get_range_val()) instead. As a result, an out-of-range
> default is no longer clamped in sym_get_string_default(), and
> savedefconfig writes out values that are equal to the effective default
> again, for example CONFIG_A=4 for:
> 
>   config A
>   	int "a"
>   	range 1 4
>   	default 8
> 
> The existing savedefconfig_range test did not catch this because it only
> covers symbols without a prompt.
> 
> Parse the value argument again, and add a test case for a symbol with a
> prompt.
> 
> Found while fuzzing Kconfig input with ASan/UBSan.
> 
> Fixes: 9b8719973ee2 ("kconfig: use unsigned integers for hex range checks")
> Assisted-by: Claude:claude-opus-5-5
> Signed-off-by: Leizhen Zhang <lzsx618@xxxxxxxxx>
> ---
> v2:
>  - Use my real name in the From and Signed-off-by lines. No code
>    changes.
> 
> v1: https://lore.kernel.org/r/20261005202524.3461824-1-lzsx618@xxxxxxxxx
> 
>  scripts/kconfig/symbol.c                          | 5 ++++-
>  scripts/kconfig/tests/savedefconfig_range/Kconfig | 7 +++++++
>  scripts/kconfig/tests/savedefconfig_range/config  | 1 +
>  3 files changed, 12 insertions(+), 1 deletion(-)
> 
> diff --git a/scripts/kconfig/symbol.c b/scripts/kconfig/symbol.c
> index 2e87af0985..11302faa28 100644
> --- a/scripts/kconfig/symbol.c
> +++ b/scripts/kconfig/symbol.c
> @@ -195,7 +195,10 @@ static struct symbol *sym_get_near_range_bound(struct symbol *sym,
>  	prop = sym_get_range_prop(sym);
>  	if (!prop)
>  		return NULL;
> -	val = sym_get_range_val(sym, base);
> +	if (base == 10)
> +		val.s = strtoll(value, NULL, base);
> +	else
> +		val.u = strtoull(value, NULL, base);

Minor style nitpick: I'd prefer a comment clarifying that the 'else'
branch is for the 'hex' type.

But... since I'm planning on a refactoring of this int / hex parsing
soon, this is fine for now.

>  	range_sym = prop->expr->left.sym;
>  	val2 = sym_get_range_val(range_sym, base);
>  
> diff --git a/scripts/kconfig/tests/savedefconfig_range/Kconfig b/scripts/kconfig/tests/savedefconfig_range/Kconfig
> index fd59d9082e..d879870a52 100644
> --- a/scripts/kconfig/tests/savedefconfig_range/Kconfig
> +++ b/scripts/kconfig/tests/savedefconfig_range/Kconfig
> @@ -58,3 +58,10 @@ config INT_CONDITIONAL_DEFAULT
>  	int
>  	range 1 2
>  	default 3 if USE_DEFAULT
> +
> +# Default outside of the range of a symbol with a prompt
> +
> +config INT_PROMPT_DEFAULT_ABOVE_RANGE
> +	int "int with prompt"
> +	range 1 4
> +	default 8
> diff --git a/scripts/kconfig/tests/savedefconfig_range/config b/scripts/kconfig/tests/savedefconfig_range/config
> index d939cfe5fd..079a3107a0 100644
> --- a/scripts/kconfig/tests/savedefconfig_range/config
> +++ b/scripts/kconfig/tests/savedefconfig_range/config
> @@ -5,3 +5,4 @@ CONFIG_HEX_DEFAULT_ABOVE_RANGE=0x20
>  CONFIG_INT_IMPLICIT_DEFAULT_ZERO=1
>  CONFIG_INT_CONDITIONAL_RANGE=2
>  CONFIG_INT_CONDITIONAL_DEFAULT=2
> +CONFIG_INT_PROMPT_DEFAULT_ABOVE_RANGE=4
> -- 2.34.1
> 

Thanks!

Tested-by: Julian Braha <julianbraha@xxxxxxxxx>
Reviewed-by: Julian Braha <julianbraha@xxxxxxxxx>