The kmalloc entry points promise ARCH_KMALLOC_MINALIGN alignment but return (void *)16 for zero-size requests. Patch 1 aligns the sentinel to that promise.
Patch 2 limits ZERO_OR_NULL_PTR() to NULL and ZERO_SIZE_PTR. Patch 3 handles ERR_PTR explicitly in kfree() and hardened usercopy, without giving ERR_PTR special meaning to other users such as krealloc(). The old helper did not match ERR_PTR values either; patch 3 addresses the adjacent hardening concern raised during review. If backported, patches 1 and 2 should be taken together. Patch 4 adds zero-size KUnit coverage; patch 5 adds ERR_PTR KUnit, LKDTM, and kselftest coverage, which is why Arnd, Greg, Shuah, and [email protected] are newly copied on v3. Tested on 940de590b839: - GCC 15.2 UML slub_test: 10 passed, 2 skipped, including test_zero_size_alloc and test_kfree_err_ptr; NULL and ZERO_SIZE_PTR produced no warning, and the expected kfree(ERR_PTR) warning was suppressed and counted - GCC 15.2 matched x86_64 builds immediately before and after patch 3: kfree grew by 15 bytes; __check_object_size gained a 13-byte comparison on its normal path and a 23-byte cold abort path - GCC 15.2 x86_64 defconfig with HARDENED_USERCOPY: build and normal QEMU boot passed; the committed LKDTM selftest matched the distinct ERR_PTR diagnostic after reaching usercopy_abort() - Clang 21.1.8 armv5 UBSAN_ALIGNMENT: no alignment-assumption or slab.h report; generated code retains the exact comparison and single evaluation - GCC 15.2 MIPS64 big-endian noncoherent build passed with ARCH_KMALLOC_MINALIGN equal to 128 - Microchip SAM9X75 hardware (armv5, ARCH_KMALLOC_MINALIGN=32): ZERO_SIZE_PTR was 0x20; zero-size allocation, ksize(), and free passed with no boot splats - Raspberry Pi 400 hardware (arm64, Cortex-A72, ARCH_KMALLOC_MINALIGN=8): ZERO_SIZE_PTR remained 0x10; the ERR_PTR KUnit and hardened-usercopy rejection paths passed with no boot splats; the revised diagnostic was retested under x86_64 QEMU --- v2 -> v3: - document why patch 2's sentinel-derived low-address window in hardened usercopy was incidental - add new patch 3 to warn and return when kfree() receives an ERR_PTR and reject ERR_PTR values in hardened usercopy - replace patch 4's pointer-cast static assertion with a run-time KUnit expectation - add new patch 5 with KUnit and LKDTM coverage for patch 3 v2: https://lore.kernel.org/r/[email protected] v1: https://lore.kernel.org/r/[email protected] RFC: https://lore.kernel.org/r/[email protected] Karl Mehltretter (5): slab: align ZERO_SIZE_PTR to ARCH_KMALLOC_MINALIGN slab: check for ZERO_SIZE_PTR by exact match slab: handle ERR_PTR values in kfree and hardened usercopy slab: test zero-size allocations in slub_kunit slab: test ERR_PTR handling in kfree and hardened usercopy drivers/misc/lkdtm/usercopy.c | 27 +++++++++++ include/linux/slab.h | 20 ++++++-- lib/tests/slub_kunit.c | 61 +++++++++++++++++++++++++ mm/slub.c | 3 ++ mm/usercopy.c | 3 ++ tools/testing/selftests/lkdtm/tests.txt | 1 + 6 files changed, 112 insertions(+), 3 deletions(-) base-commit: 940de590b839f71d6dc846160534bf202401b8b7 -- 2.53.0
