On Thu, Sep 03, 2026 at 10:37:15PM +0200, Karl Mehltretter wrote: > The kmalloc entry points promise ARCH_KMALLOC_MINALIGN alignment but > return (void *)16 for zero-size requests. Patch 1 aligns the sentinel > to that promise. > > Patch 2 limits ZERO_OR_NULL_PTR() to NULL and ZERO_SIZE_PTR. Patch 3 > handles ERR_PTR explicitly in kfree() and hardened usercopy, without > giving ERR_PTR special meaning to other users such as krealloc(). The > old helper did not match ERR_PTR values either; patch 3 addresses the > adjacent hardening concern raised during review.
I don't understand why v3 of this patchset suddenly implements hardening for kfree() and usercopy to handle ERR_PTR(). The address range for 'zero or NULL PTR' range and ERR_PTR() do not overlap. The bugfixes and hardening patches are irrelevant. It should be a separate series? Also usercopy.c changes go through the hardening tree, slub.c and slub_kunit.c changes go through the slab tree, and LKDTM has its own tree. Patch 3 and 5 touch files across multiple trees, which can be avoided. > If backported, patches 1 and 2 should be taken together. > > Patch 4 adds zero-size KUnit coverage; patch 5 adds ERR_PTR KUnit, > LKDTM, and kselftest coverage, which is why Arnd, Greg, Shuah, and > [email protected] are newly copied on v3. > > Tested on 940de590b839: > > - GCC 15.2 UML slub_test: 10 passed, 2 skipped, including > test_zero_size_alloc and test_kfree_err_ptr; NULL and ZERO_SIZE_PTR > produced no warning, and the expected kfree(ERR_PTR) warning was > suppressed and counted > - GCC 15.2 matched x86_64 builds immediately before and after patch 3: > kfree grew by 15 bytes; __check_object_size gained a 13-byte > comparison on its normal path and a 23-byte cold abort path > - GCC 15.2 x86_64 defconfig with HARDENED_USERCOPY: build and normal > QEMU boot passed; the committed LKDTM selftest matched the distinct > ERR_PTR diagnostic after reaching usercopy_abort() > - Clang 21.1.8 armv5 UBSAN_ALIGNMENT: no alignment-assumption or > slab.h report; generated code retains the exact comparison and > single evaluation > - GCC 15.2 MIPS64 big-endian noncoherent build passed with > ARCH_KMALLOC_MINALIGN equal to 128 > - Microchip SAM9X75 hardware (armv5, ARCH_KMALLOC_MINALIGN=32): > ZERO_SIZE_PTR was 0x20; zero-size allocation, ksize(), and free > passed with no boot splats > - Raspberry Pi 400 hardware (arm64, Cortex-A72, > ARCH_KMALLOC_MINALIGN=8): ZERO_SIZE_PTR remained 0x10; the ERR_PTR > KUnit and hardened-usercopy rejection paths passed with no boot > splats; the revised diagnostic was retested under x86_64 QEMU > > --- > v2 -> v3: > > - document why patch 2's sentinel-derived low-address window in hardened > usercopy was incidental > - add new patch 3 to warn and return when kfree() receives an ERR_PTR > and reject ERR_PTR values in hardened usercopy > - replace patch 4's pointer-cast static assertion with a run-time KUnit > expectation > - add new patch 5 with KUnit and LKDTM coverage for patch 3 > > v2: https://lore.kernel.org/r/[email protected] > v1: https://lore.kernel.org/r/[email protected] > RFC: https://lore.kernel.org/r/[email protected] > > Karl Mehltretter (5): > slab: align ZERO_SIZE_PTR to ARCH_KMALLOC_MINALIGN > slab: check for ZERO_SIZE_PTR by exact match > slab: handle ERR_PTR values in kfree and hardened usercopy > slab: test zero-size allocations in slub_kunit > slab: test ERR_PTR handling in kfree and hardened usercopy > > drivers/misc/lkdtm/usercopy.c | 27 +++++++++++ > include/linux/slab.h | 20 ++++++-- > lib/tests/slub_kunit.c | 61 +++++++++++++++++++++++++ > mm/slub.c | 3 ++ > mm/usercopy.c | 3 ++ > tools/testing/selftests/lkdtm/tests.txt | 1 + > 6 files changed, 112 insertions(+), 3 deletions(-) > > > base-commit: 940de590b839f71d6dc846160534bf202401b8b7 > -- > 2.53.0
