drivers/misc/lkdtm/usercopy.c | 27 +++++++++++ include/linux/slab.h | 20 ++++++-- lib/tests/slub_kunit.c | 61 +++++++++++++++++++++++++ mm/slub.c | 3 ++ mm/usercopy.c | 3 ++ tools/testing/selftests/lkdtm/tests.txt | 1 + 6 files changed, 112 insertions(+), 3 deletions(-)
The kmalloc entry points promise ARCH_KMALLOC_MINALIGN alignment but
return (void *)16 for zero-size requests. Patch 1 aligns the sentinel
to that promise.
Patch 2 limits ZERO_OR_NULL_PTR() to NULL and ZERO_SIZE_PTR. Patch 3
handles ERR_PTR explicitly in kfree() and hardened usercopy, without
giving ERR_PTR special meaning to other users such as krealloc(). The
old helper did not match ERR_PTR values either; patch 3 addresses the
adjacent hardening concern raised during review.
If backported, patches 1 and 2 should be taken together.
Patch 4 adds zero-size KUnit coverage; patch 5 adds ERR_PTR KUnit,
LKDTM, and kselftest coverage, which is why Arnd, Greg, Shuah, and
linux-kselftest@vger.kernel.org are newly copied on v3.
Tested on 940de590b839:
- GCC 15.2 UML slub_test: 10 passed, 2 skipped, including
test_zero_size_alloc and test_kfree_err_ptr; NULL and ZERO_SIZE_PTR
produced no warning, and the expected kfree(ERR_PTR) warning was
suppressed and counted
- GCC 15.2 matched x86_64 builds immediately before and after patch 3:
kfree grew by 15 bytes; __check_object_size gained a 13-byte
comparison on its normal path and a 23-byte cold abort path
- GCC 15.2 x86_64 defconfig with HARDENED_USERCOPY: build and normal
QEMU boot passed; the committed LKDTM selftest matched the distinct
ERR_PTR diagnostic after reaching usercopy_abort()
- Clang 21.1.8 armv5 UBSAN_ALIGNMENT: no alignment-assumption or
slab.h report; generated code retains the exact comparison and
single evaluation
- GCC 15.2 MIPS64 big-endian noncoherent build passed with
ARCH_KMALLOC_MINALIGN equal to 128
- Microchip SAM9X75 hardware (armv5, ARCH_KMALLOC_MINALIGN=32):
ZERO_SIZE_PTR was 0x20; zero-size allocation, ksize(), and free
passed with no boot splats
- Raspberry Pi 400 hardware (arm64, Cortex-A72,
ARCH_KMALLOC_MINALIGN=8): ZERO_SIZE_PTR remained 0x10; the ERR_PTR
KUnit and hardened-usercopy rejection paths passed with no boot
splats; the revised diagnostic was retested under x86_64 QEMU
---
v2 -> v3:
- document why patch 2's sentinel-derived low-address window in hardened
usercopy was incidental
- add new patch 3 to warn and return when kfree() receives an ERR_PTR
and reject ERR_PTR values in hardened usercopy
- replace patch 4's pointer-cast static assertion with a run-time KUnit
expectation
- add new patch 5 with KUnit and LKDTM coverage for patch 3
v2: https://lore.kernel.org/r/20260811141240.62519-1-kmehltretter@gmail.com
v1: https://lore.kernel.org/r/20260808105622.62026-1-kmehltretter@gmail.com
RFC: https://lore.kernel.org/r/20260712120728.96628-1-kmehltretter@gmail.com
Karl Mehltretter (5):
slab: align ZERO_SIZE_PTR to ARCH_KMALLOC_MINALIGN
slab: check for ZERO_SIZE_PTR by exact match
slab: handle ERR_PTR values in kfree and hardened usercopy
slab: test zero-size allocations in slub_kunit
slab: test ERR_PTR handling in kfree and hardened usercopy
drivers/misc/lkdtm/usercopy.c | 27 +++++++++++
include/linux/slab.h | 20 ++++++--
lib/tests/slub_kunit.c | 61 +++++++++++++++++++++++++
mm/slub.c | 3 ++
mm/usercopy.c | 3 ++
tools/testing/selftests/lkdtm/tests.txt | 1 +
6 files changed, 112 insertions(+), 3 deletions(-)
base-commit: 940de590b839f71d6dc846160534bf202401b8b7
--
2.53.0
On Thu, Sep 03, 2026 at 10:37:15PM +0200, Karl Mehltretter wrote: > The kmalloc entry points promise ARCH_KMALLOC_MINALIGN alignment but > return (void *)16 for zero-size requests. Patch 1 aligns the sentinel > to that promise. > > Patch 2 limits ZERO_OR_NULL_PTR() to NULL and ZERO_SIZE_PTR. Patch 3 > handles ERR_PTR explicitly in kfree() and hardened usercopy, without > giving ERR_PTR special meaning to other users such as krealloc(). The > old helper did not match ERR_PTR values either; patch 3 addresses the > adjacent hardening concern raised during review. I don't understand why v3 of this patchset suddenly implements hardening for kfree() and usercopy to handle ERR_PTR(). The address range for 'zero or NULL PTR' range and ERR_PTR() do not overlap. The bugfixes and hardening patches are irrelevant. It should be a separate series? Also usercopy.c changes go through the hardening tree, slub.c and slub_kunit.c changes go through the slab tree, and LKDTM has its own tree. Patch 3 and 5 touch files across multiple trees, which can be avoided. > If backported, patches 1 and 2 should be taken together. > > Patch 4 adds zero-size KUnit coverage; patch 5 adds ERR_PTR KUnit, > LKDTM, and kselftest coverage, which is why Arnd, Greg, Shuah, and > linux-kselftest@vger.kernel.org are newly copied on v3. > > Tested on 940de590b839: > > - GCC 15.2 UML slub_test: 10 passed, 2 skipped, including > test_zero_size_alloc and test_kfree_err_ptr; NULL and ZERO_SIZE_PTR > produced no warning, and the expected kfree(ERR_PTR) warning was > suppressed and counted > - GCC 15.2 matched x86_64 builds immediately before and after patch 3: > kfree grew by 15 bytes; __check_object_size gained a 13-byte > comparison on its normal path and a 23-byte cold abort path > - GCC 15.2 x86_64 defconfig with HARDENED_USERCOPY: build and normal > QEMU boot passed; the committed LKDTM selftest matched the distinct > ERR_PTR diagnostic after reaching usercopy_abort() > - Clang 21.1.8 armv5 UBSAN_ALIGNMENT: no alignment-assumption or > slab.h report; generated code retains the exact comparison and > single evaluation > - GCC 15.2 MIPS64 big-endian noncoherent build passed with > ARCH_KMALLOC_MINALIGN equal to 128 > - Microchip SAM9X75 hardware (armv5, ARCH_KMALLOC_MINALIGN=32): > ZERO_SIZE_PTR was 0x20; zero-size allocation, ksize(), and free > passed with no boot splats > - Raspberry Pi 400 hardware (arm64, Cortex-A72, > ARCH_KMALLOC_MINALIGN=8): ZERO_SIZE_PTR remained 0x10; the ERR_PTR > KUnit and hardened-usercopy rejection paths passed with no boot > splats; the revised diagnostic was retested under x86_64 QEMU > > --- > v2 -> v3: > > - document why patch 2's sentinel-derived low-address window in hardened > usercopy was incidental > - add new patch 3 to warn and return when kfree() receives an ERR_PTR > and reject ERR_PTR values in hardened usercopy > - replace patch 4's pointer-cast static assertion with a run-time KUnit > expectation > - add new patch 5 with KUnit and LKDTM coverage for patch 3 > > v2: https://lore.kernel.org/r/20260811141240.62519-1-kmehltretter@gmail.com > v1: https://lore.kernel.org/r/20260808105622.62026-1-kmehltretter@gmail.com > RFC: https://lore.kernel.org/r/20260712120728.96628-1-kmehltretter@gmail.com > > Karl Mehltretter (5): > slab: align ZERO_SIZE_PTR to ARCH_KMALLOC_MINALIGN > slab: check for ZERO_SIZE_PTR by exact match > slab: handle ERR_PTR values in kfree and hardened usercopy > slab: test zero-size allocations in slub_kunit > slab: test ERR_PTR handling in kfree and hardened usercopy > > drivers/misc/lkdtm/usercopy.c | 27 +++++++++++ > include/linux/slab.h | 20 ++++++-- > lib/tests/slub_kunit.c | 61 +++++++++++++++++++++++++ > mm/slub.c | 3 ++ > mm/usercopy.c | 3 ++ > tools/testing/selftests/lkdtm/tests.txt | 1 + > 6 files changed, 112 insertions(+), 3 deletions(-) > > > base-commit: 940de590b839f71d6dc846160534bf202401b8b7 > -- > 2.53.0
On Fri, Sep 04, 2026 at 12:25:59PM +0100, Harry Yoo wrote: > I don't understand why v3 of this patchset suddenly implements > hardening for kfree() and usercopy to handle ERR_PTR(). > > The address range for 'zero or NULL PTR' range and ERR_PTR() do not > overlap. The bugfixes and hardening patches are irrelevant. > It should be a separate series? > > Also usercopy.c changes go through the hardening tree, slub.c and > slub_kunit.c changes go through the slab tree, and LKDTM has its own > tree. Patch 3 and 5 touch files across multiple trees, which can be > avoided. > I added the ERR_PTR changes after Kees raised handling that range in the v2 review [1]. The two topics also came up together in the 2014 [2] and 2019 [3] discussions; in the latter, Jann suggested a separate warning-and-return check [4]. I wanted to broaden the discussion and see whether considering both together might suggest a better approach. I agree that the resulting implementations are independent. I'll send v4 with the ZERO_SIZE_PTR alignment, exact-match and zero-size KUnit patches only, and pursue the ERR_PTR work separately. I'll split that work along the SLUB, usercopy and LKDTM boundaries you pointed out. [1] https://lore.kernel.org/r/202608111716.0FA9DB17@keescook/ [2] https://lore.kernel.org/r/87oaumdz1f.fsf@rasmusvillemoes.dk/ [3] https://lore.kernel.org/r/20191010103151.7708-1-mayhs11saini@gmail.com/ [4] https://lore.kernel.org/r/CAG48ez05QVn6_gQ2TBrRa1a_DWQoaSSYubUsu5YMWxx-gqMijQ@mail.gmail.com/ Thanks, Karl
© 2016 - 2026 Red Hat, Inc.