Re: [PATCH v2 2/3] slab: check for ZERO_SIZE_PTR by exact match

[Karl Mehltretter <kmehltretter@gmail.com>]

On Tue, Aug 11, 2026 at 05:17:48PM +0100, Kees Cook wrote:
> > Compare explicitly against NULL and ZERO_SIZE_PTR. Store the argument
> > in an unsigned long temporary to support both pointer and integer
> > address arguments while evaluating it only once.
> 
> Can we move ZERO_SIZE_PTR to cover the ERR_PTR range too? See this issue:
> https://github.com/KSPP/linux/issues/93
> 
> > This also changes check_bogus_address() in hardened usercopy: nonzero
> > addresses below ZERO_SIZE_PTR no longer cause its null-address abort.
> 
> And then check_bogus_address would also catch ERR_PTR.
> 

Thanks, I did not know about the earlier discussion and the KSPP issue.

Using -4096 for ZERO_SIZE_PTR is tempting.

However I found a few conflicts, for example:
  - PowerPC KVM guest kernels map their magic page at exactly -4096. A
    kernel making this change would probably have to move it to -8192.
  - m68k DragonBall has a hardware register at exactly 0xfffff000.
  - OpenRISC could reach this address with an exact 1 GiB direct map.

Linus's original reason for choosing 16 was that it should fault
like NULL:
https://lore.kernel.org/r/alpine.LFD.0.98.0706011554300.3957@woody.linux-foundation.org

I would not include ERR_PTR range for ZERO_OR_NULL_PTR()
globally. krealloc() also uses it, where it would make an ERR_PTR()
behave like NULL and allocate new memory.

Maybe keep the exact check and add IS_ERR() separately
to kfree() and hardened usercopy.

Karl