Re: [PATCH v3 0/5] slab: ZERO_SIZE_PTR alignment and ERR_PTR hardening

[Harry Yoo <harry@kernel.org>]

On Thu, Sep 03, 2026 at 10:37:15PM +0200, Karl Mehltretter wrote:
> The kmalloc entry points promise ARCH_KMALLOC_MINALIGN alignment but
> return (void *)16 for zero-size requests. Patch 1 aligns the sentinel
> to that promise.
> 
> Patch 2 limits ZERO_OR_NULL_PTR() to NULL and ZERO_SIZE_PTR. Patch 3
> handles ERR_PTR explicitly in kfree() and hardened usercopy, without
> giving ERR_PTR special meaning to other users such as krealloc(). The
> old helper did not match ERR_PTR values either; patch 3 addresses the
> adjacent hardening concern raised during review.

I don't understand why v3 of this patchset suddenly implements
hardening for kfree() and usercopy to handle ERR_PTR().

The address range for 'zero or NULL PTR' range and ERR_PTR() do not
overlap. The bugfixes and hardening patches are irrelevant.
It should be a separate series?

Also usercopy.c changes go through the hardening tree, slub.c and
slub_kunit.c changes go through the slab tree, and LKDTM has its own
tree. Patch 3 and 5 touch files across multiple trees, which can be
avoided.

> If backported, patches 1 and 2 should be taken together.
>
> Patch 4 adds zero-size KUnit coverage; patch 5 adds ERR_PTR KUnit,
> LKDTM, and kselftest coverage, which is why Arnd, Greg, Shuah, and
> linux-kselftest@vger.kernel.org are newly copied on v3.
> 
> Tested on 940de590b839:
> 
>   - GCC 15.2 UML slub_test: 10 passed, 2 skipped, including
>     test_zero_size_alloc and test_kfree_err_ptr; NULL and ZERO_SIZE_PTR
>     produced no warning, and the expected kfree(ERR_PTR) warning was
>     suppressed and counted
>   - GCC 15.2 matched x86_64 builds immediately before and after patch 3:
>     kfree grew by 15 bytes; __check_object_size gained a 13-byte
>     comparison on its normal path and a 23-byte cold abort path
>   - GCC 15.2 x86_64 defconfig with HARDENED_USERCOPY: build and normal
>     QEMU boot passed; the committed LKDTM selftest matched the distinct
>     ERR_PTR diagnostic after reaching usercopy_abort()
>   - Clang 21.1.8 armv5 UBSAN_ALIGNMENT: no alignment-assumption or
>     slab.h report; generated code retains the exact comparison and
>     single evaluation
>   - GCC 15.2 MIPS64 big-endian noncoherent build passed with
>     ARCH_KMALLOC_MINALIGN equal to 128
>   - Microchip SAM9X75 hardware (armv5, ARCH_KMALLOC_MINALIGN=32):
>     ZERO_SIZE_PTR was 0x20; zero-size allocation, ksize(), and free
>     passed with no boot splats
>   - Raspberry Pi 400 hardware (arm64, Cortex-A72,
>     ARCH_KMALLOC_MINALIGN=8): ZERO_SIZE_PTR remained 0x10; the ERR_PTR
>     KUnit and hardened-usercopy rejection paths passed with no boot
>     splats; the revised diagnostic was retested under x86_64 QEMU
> 
> ---
> v2 -> v3:
> 
>   - document why patch 2's sentinel-derived low-address window in hardened
>     usercopy was incidental
>   - add new patch 3 to warn and return when kfree() receives an ERR_PTR
>     and reject ERR_PTR values in hardened usercopy
>   - replace patch 4's pointer-cast static assertion with a run-time KUnit
>     expectation
>   - add new patch 5 with KUnit and LKDTM coverage for patch 3
> 
> v2: https://lore.kernel.org/r/20260811141240.62519-1-kmehltretter@gmail.com
> v1: https://lore.kernel.org/r/20260808105622.62026-1-kmehltretter@gmail.com
> RFC: https://lore.kernel.org/r/20260712120728.96628-1-kmehltretter@gmail.com
> 
> Karl Mehltretter (5):
>   slab: align ZERO_SIZE_PTR to ARCH_KMALLOC_MINALIGN
>   slab: check for ZERO_SIZE_PTR by exact match
>   slab: handle ERR_PTR values in kfree and hardened usercopy
>   slab: test zero-size allocations in slub_kunit
>   slab: test ERR_PTR handling in kfree and hardened usercopy
> 
>  drivers/misc/lkdtm/usercopy.c           | 27 +++++++++++
>  include/linux/slab.h                    | 20 ++++++--
>  lib/tests/slub_kunit.c                  | 61 +++++++++++++++++++++++++
>  mm/slub.c                               |  3 ++
>  mm/usercopy.c                           |  3 ++
>  tools/testing/selftests/lkdtm/tests.txt |  1 +
>  6 files changed, 112 insertions(+), 3 deletions(-)
> 
> 
> base-commit: 940de590b839f71d6dc846160534bf202401b8b7
> -- 
> 2.53.0