From nobody Sat Sep 26 06:20:41 2026 Received: from mail-wr1-f54.google.com (mail-wr1-f54.google.com [209.85.221.54]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6F51050AC29 for ; Thu, 3 Sep 2026 20:37:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.54 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788467867; cv=none; b=FXtVwhKCoENj879za24422jNLhvd0sEbrHMtwcAhWcY2NNAjboLmTQEnHXl2+i8oiwDyzKawAV5wtWhSniSAXOVq/U/oqzvSjhr2HwH1oVGo+uLtARuHU657SnzyUxDjFZOyCvNtA8ruIT/45KBcvh99D3TJmbpedOtnexOoJcI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788467867; c=relaxed/simple; bh=mDzPWkMoO7yK7FwJIXdb8RjyDxLK4UW08E3phGRlvnE=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=HhIo0JMRAOqDalFkvWmpKpOFOJq6wVkbDJrS0BgyzrKlvG+em0Z4AIvmTYaE5YO0dVeA+oeCICv4qX3a/olwXJOFpG6Bn+VP6XNMCcvEQax9N5XPDRxpDiZ/HJzRvAKfwofMw6CTz8nQjIS3kIBeAARLxptf32onTJjOPdnEZAs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=phZhNiB2; arc=none smtp.client-ip=209.85.221.54 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="phZhNiB2" Received: by mail-wr1-f54.google.com with SMTP id ffacd0b85a97d-48441fa5c37so187269f8f.3 for ; Thu, 03 Sep 2026 13:37:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1788467850; x=1789072650; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Y0p7OiT9IYtJ0QF28DnbFmBCLEmI8cNswVbeL0gIZVk=; b=phZhNiB2JPwOVzfbjODU/rVBuCzEUk1yfw11MHjwlCgydOdqH4cYudgljkt9/Or4Jp Bh1dCCWwe2fV3EDwbj1VEW/UMU6KW+g5D8Y6/Xfn79UDSn2WuVHtn5PM1LneBBkfXKZW 6AOZAXCwECymuAf6m03WlDwRD8jjP3AfNcC2G4jIbs9C2cGoOjUhVHrtNIzw3CFPhe4W ZARFTQPAehdcg/6uzqwVJ90PSlZM1ZVKAHKdhLIq9jf4I4zzDkUScuPzhNo5ZN3RinAI grAFU6CEAVwvARcBri3M9OHoCTiNFNRtuLNekGhKVkdr39zMrVbOTrFFpgczcxVr9bLB 3v7A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788467850; x=1789072650; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=Y0p7OiT9IYtJ0QF28DnbFmBCLEmI8cNswVbeL0gIZVk=; b=P9UdbDIV2vCSuQRHYICGIIIkPtNa1y/pvVBBY46bRqQG+CXNuvbUIgMKDAJaLxCoqP ZYq6F2HFW+SFC5YQzI/kVtOtPE227O0LW+UXNAcALZ4Do2LHvLjuPIofkxRfcVHjY0lK SxrUO9N3ByKzaWn+Qe4M+WewoiTDyJ/yEwCUGhLl3+2pF8vPeaGf2P2fSFUZzH+cZOYh 54HaHAYBMAaP0+LdOVsi53MkGP/JpUG2F1fxud8tK0Hvb4r5pVfxgbJjJhuzYyYaK2ZS BkWjy3P41SVQ505FVmGU3TM3jt077Bww+8JNlYL+RByUUhsaMpxT9HSybAM9JHtTpRjm Y8QA== X-Forwarded-Encrypted: i=1; AKwUvBzKU6hu+hai3HOf0BgDl2idIJ7dL//HdhuE9N/gjzd9JZapsEeCxYRuJrXjeMYhiBYzKA5UgNEw7FaHsAg=@vger.kernel.org X-Gm-Message-State: AFuF++kzTSwfxTtvGY6FbnRYfbzSdOSB50kdtzDqzF2SofGpUXlCrLpT Z+kxApj642t6NkI5PxFP8p4xuWp3x0+Slh6iopNwSZVTZngaEO55IF1n X-Gm-Gg: AYBFou1yRijeF0rXhDD9Nk9MVvD82fJHqdWnRmWoV6sgg9Ya+PNsaBdJb9AYnFmRzIr BNZVdPOO0+K/gT/Vj2bERrbeM9kcTpnyIWCJ1adVp8d3UBS7Uy3QaIdQKGG162f7sEYyR8ytSzf skqfwdmt2fX4jqF/fl5Mwtfet/62Y7/H6FnTilJKxA9m6FdCWdhwjFjXA4adt2yaELPQszzh5hG J2aZx8ymzbahFk13xtGCEY344a0jiNzw+0QS0beV0Ell44Ibu/AF/8ljhg8EklWvQksMHDnrquS y7OmbmWKME+zxSIKSKfHll23qQIkZUwW6g4NukjnBaGHp1OYfzGIBvewuq5h/g1UMG4oBMjazsa CNVkw64febwlyjZRgXysln63wu5oJSz6s4xxNmZL8mL8XHtgvzPrR5osyuUV2trnXADwYtqNRNG oyWfc/eH81IGQMBHFMXjhruEUSEm7MYm808iXmzW/czROr8NASANf9eo3yMydoirE6LUl1k2t64 vazJ/Xwpkl1S9JIsMIEfcPVEi6I2rll3qs/G7T5lhw4HtuPkEo1j3l9mjWYs//VwOAHt13BOQf4 0jf+rbAuPOqyt00efhpMMY5gR1ANu3PL2k//3oGIsQR2xzgqY24s+UkHVlTECG/mIynlM6SooRV J/b1f X-Received: by 2002:a05:6000:46cc:b0:484:3f15:15f2 with SMTP id ffacd0b85a97d-485872bbf40mr1870059f8f.24.1788467849852; Thu, 03 Sep 2026 13:37:29 -0700 (PDT) Received: from MacBook-Pro-von-Karl.localdomain (dynamic-2a02-3100-a979-9501-3df6-d7fa-8a5a-06c5.310.pool.telefonica.de. [2a02:3100:a979:9501:3df6:d7fa:8a5a:6c5]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-48588394fa1sm1005070f8f.8.2026.09.03.13.37.28 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Thu, 03 Sep 2026 13:37:29 -0700 (PDT) From: Karl Mehltretter To: Vlastimil Babka , Harry Yoo , Andrew Morton Cc: Karl Mehltretter , Rasmus Villemoes , Hao Li , Christoph Lameter , David Rientjes , Roman Gushchin , Catalin Marinas , Kees Cook , "Gustavo A . R . Silva" , Arnd Bergmann , Greg Kroah-Hartman , Shuah Khan , Nathan Chancellor , Nick Desaulniers , Bill Wendling , Justin Stitt , linux-hardening@vger.kernel.org, linux-mm@kvack.org, linux-kselftest@vger.kernel.org, linux-kernel@vger.kernel.org, llvm@lists.linux.dev Subject: [PATCH v3 1/5] slab: align ZERO_SIZE_PTR to ARCH_KMALLOC_MINALIGN Date: Thu, 3 Sep 2026 22:37:16 +0200 Message-Id: <20260903203720.63689-2-kmehltretter@gmail.com> X-Mailer: git-send-email 2.39.5 (Apple Git-154) In-Reply-To: <20260903203720.63689-1-kmehltretter@gmail.com> References: <20260903203720.63689-1-kmehltretter@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The kmalloc entry points are annotated with __assume_kmalloc_alignment but return ZERO_SIZE_PTR, currently (void *)16, for zero-size requests. This violates the annotation when ARCH_KMALLOC_MINALIGN exceeds 16. This can mislead compiler optimizations. Clang's UBSAN_ALIGNMENT detects the violation on armv5. GCC and Clang retain the ZERO_OR_NULL_PTR() range check but eliminate an exact ZERO_SIZE_PTR comparison after an annotated allocation. Define ZERO_SIZE_PTR as the greater of 16 and ARCH_KMALLOC_MINALIGN, retaining the existing value where it is already aligned. Assert that ARCH_KMALLOC_MINALIGN remains below 0x100, the value of LIST_POISON1 when POISON_POINTER_DELTA is zero, so the sentinel remains distinct from that poison pointer. Fixes: 94a58c360a45 ("slab.h: sprinkle __assume_aligned attributes") Assisted-by: LLM Signed-off-by: Karl Mehltretter --- include/linux/slab.h | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/include/linux/slab.h b/include/linux/slab.h index cda126def67a..563dadc16d82 100644 --- a/include/linux/slab.h +++ b/include/linux/slab.h @@ -262,13 +262,16 @@ enum _slab_flag_bits { =20 /* * ZERO_SIZE_PTR will be returned for zero sized kmalloc requests. + * It satisfies the alignment promised by __assume_kmalloc_alignment + * and keeps the historic value 16 where that is already aligned. * * Dereferencing ZERO_SIZE_PTR will lead to a distinct access fault. * * ZERO_SIZE_PTR can be passed to kfree though in the same way that NULL c= an. * Both make kfree a no-op. */ -#define ZERO_SIZE_PTR ((void *)16) +#define ZERO_SIZE_PTR ((void *)(ARCH_KMALLOC_MINALIGN > 16 ? \ + ARCH_KMALLOC_MINALIGN : 16)) =20 #define ZERO_OR_NULL_PTR(x) ((unsigned long)(x) <=3D \ (unsigned long)ZERO_SIZE_PTR) @@ -625,6 +628,13 @@ static inline bool kmem_dump_obj(void *object) { retur= n false; } #define KMALLOC_SHIFT_LOW ilog2(KMALLOC_MIN_SIZE) #endif =20 +/* + * Keep ZERO_SIZE_PTR at most 128, i.e. below 0x100: LIST_POISON1 is + * 0x100 when POISON_POINTER_DELTA is 0, and no architecture currently + * has an ARCH_KMALLOC_MINALIGN above 128. + */ +static_assert(ARCH_KMALLOC_MINALIGN < 0x100); + /* * Setting ARCH_SLAB_MINALIGN in arch headers allows a different alignment. * Intended for arches that get misalignment faults even for 64 bit integer --=20 2.53.0 From nobody Sat Sep 26 06:20:41 2026 Received: from mail-wr1-f53.google.com (mail-wr1-f53.google.com [209.85.221.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 76514371068 for ; Thu, 3 Sep 2026 20:37:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.53 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788467864; cv=none; b=mCu5kyXATjAeoWIiTzQLbJxNfIqwesH1gSx2bJPQAB+TQomlCoa4YvEqMwBG4gl8ldkkiUCO+02+aYwuy9GGxuB3sXnEKtZJ+j72kAFxoZngIfv51MLh4a7d0COCypCA2e3JCoze6IMzNwT/KqnNgzCXwwTu0JgMmzFZZr1Yv84= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788467864; c=relaxed/simple; bh=0mPWZrRtMVPeUI6XJyCqfL68axEeDCO9y1H3650V6jM=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=gN7ks3plxne2eB72WSakuDehQ+YuB+QAIZbpUzpKRVm+rP5gjuoR+cgW0flfOqW9KK64eCML2xfI7X8WUj2dlXBAd+FK15mAG+E2n4k9pOx9o5wQQD4OK2zoVar9OBVgfBeuI2to6n/pHL0pb9xwRJ/6Ina6DWwjiSixXBqnMEM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=LlDKEkbm; arc=none smtp.client-ip=209.85.221.53 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="LlDKEkbm" Received: by mail-wr1-f53.google.com with SMTP id ffacd0b85a97d-482dbe4d247so182589f8f.2 for ; Thu, 03 Sep 2026 13:37:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1788467851; x=1789072651; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=TnjfNvCLnsTvxUWLkyT6RSPdRaY1HQsFa2V6exB/dnE=; b=LlDKEkbmjzIPcmLHIn0nsLH3JOroRmIAlnQOEqzvZtYimCF2vOWPYGCMONkFaArlU6 5YjN7srB9za4Q1c7pJeBcF3HVbzWvJeqmdF253nFzFY2MURKYbeX69VD8zaqQ/Qrfpk/ c/saUAVyYtc4Sk5g5nEB6IRz9XBPiQrqz996ok0kEZ7d4topHpEYgzP1LCIC2N7/5nzo TA2RfnwDzl5ykB/THYwqtt2ClzLww/+439dCVE6p2HK9ALAAtTRmiJa2ufS6YNxVvRy/ 2T8Ri4YHJhBzLScPeIPCVDv10xl1W126rBIRG1Aj2d2kXf5hsujcVPgAfMTIAovY8OAD MN7Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788467851; x=1789072651; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=TnjfNvCLnsTvxUWLkyT6RSPdRaY1HQsFa2V6exB/dnE=; b=XYxoGkmWSdo1g5ODlDHQFGNUHiLJeMKNNx8XwCTU7flc7Azh+X7Pvo1aaVkkhAtl8l dOftOulAvlHUWvIKlphELivBluiAzSJt1dLaVCJwVzwemzSivd5EBMLFT7uHETmNkVrr aVyqPLgVLvJJSuwG6GoBC3yRUfqggn6AZfagmQ3uxasBpO+ah/NvOo8FkG4nNmughwZt +U3Lk1NtxYaDyHvv53xvtNFDuAsHl+3xHweRsJtk4ANKK5fxDWI3Y1XExVbVMqe7e1O6 4Kzz+MqJUvPcwypZ/gud0NTk2/NetykbLhlFggMFn+wUGNQSjMzkVw4Y3JHQHDJ5zR/L em6g== X-Forwarded-Encrypted: i=1; AKwUvBx8IU0s9gldOB8DKbTesX+ko+UC21P7T6EnAEDAl1bTHQ87uLy7WMk4mgXcPKzBatEx2bzhA/xXAAH9q0s=@vger.kernel.org X-Gm-Message-State: AFuF++mqOrs27yEvsfCE64JT28XrzzLKgrrkpUrB5ItxlpYQBiDUMaqi 91rIitexaYqgTBk226KXcKFGTWMBIfKTwu/av/EO57xBMcKWKvBho3L8 X-Gm-Gg: AYBFou0Cqhz8ve2H1o13NfB1vF1fXpC7v+tdZzq6YbCrQ51A3bs5P6eQiYrtj2u8Sh+ 9BEcDE4N1siDzg1hqo4CK2gKl60eefe1bgTH0ZurBwEniKpjgz1GAgPhLgzI5NMhJIIFXjcI7fF c3IKiXwNsE4/SYWFc0WodMcszHZRQM5i9980R4DrG3rbR5APYPznuQUen2UG1/Z3uEQA6FjuHD/ Bh8Undk3kBXry714OMomoEJ7wmIYOJH37jEwEolNaq9k4xMdy/D4SpesicEJHg+GFvpdWk1/htU FdsR2TgaWD2i3+8dk6mdXkqrOzfnXJtXVqJY4XkS05FgUJvsV/L4f2F22wIUvtJhDyBjl8XIzjQ oLS9VVRgpuZA1kODogQfT15jHV24NHbP+bWzhayYWsWYibdeVuraAfRn/JTIZMPaAXScKtybqgX Y3xvjRmWuje75B9kgBFKNEaxFph/gxjGGBCajIYBQPGRpkRzihGOSM6PzIyc5fpWxXcDAGszo4f h+ak1uKDKnjIDqH7VVtSIzoYXZqLs+r0jwtdqfKbSLKZru+bIkT4UZcyr0KUOYdka8mdgVdC8kv nXLWkjcrz9HU9Pj2hxglLTVPDBvGV9T+rcLdtEkrRLx7eDp5Qe5F3zO21CSwY0FBeKd22Tk/MUX ufLrZVVmdrw9NbBL/ X-Received: by 2002:a05:6000:4b11:b0:485:8313:9f47 with SMTP id ffacd0b85a97d-48587055d09mr3572292f8f.10.1788467851379; Thu, 03 Sep 2026 13:37:31 -0700 (PDT) Received: from MacBook-Pro-von-Karl.localdomain (dynamic-2a02-3100-a979-9501-3df6-d7fa-8a5a-06c5.310.pool.telefonica.de. [2a02:3100:a979:9501:3df6:d7fa:8a5a:6c5]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-48588394fa1sm1005070f8f.8.2026.09.03.13.37.29 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Thu, 03 Sep 2026 13:37:30 -0700 (PDT) From: Karl Mehltretter To: Vlastimil Babka , Harry Yoo , Andrew Morton Cc: Karl Mehltretter , Rasmus Villemoes , Hao Li , Christoph Lameter , David Rientjes , Roman Gushchin , Catalin Marinas , Kees Cook , "Gustavo A . R . Silva" , Arnd Bergmann , Greg Kroah-Hartman , Shuah Khan , Nathan Chancellor , Nick Desaulniers , Bill Wendling , Justin Stitt , linux-hardening@vger.kernel.org, linux-mm@kvack.org, linux-kselftest@vger.kernel.org, linux-kernel@vger.kernel.org, llvm@lists.linux.dev Subject: [PATCH v3 2/5] slab: check for ZERO_SIZE_PTR by exact match Date: Thu, 3 Sep 2026 22:37:17 +0200 Message-Id: <20260903203720.63689-3-kmehltretter@gmail.com> X-Mailer: git-send-email 2.39.5 (Apple Git-154) In-Reply-To: <20260903203720.63689-1-kmehltretter@gmail.com> References: <20260903203720.63689-1-kmehltretter@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" ZERO_OR_NULL_PTR() returns true for every value less than or equal to ZERO_SIZE_PTR. With the sentinel raised to ARCH_KMALLOC_MINALIGN, up to 128 on some architectures, the helper matches additional values that are neither NULL nor the sentinel. Compare explicitly against NULL and ZERO_SIZE_PTR. Store the argument in an unsigned long temporary to support both pointer and integer address arguments while evaluating it only once. This also changes check_bogus_address() in hardened usercopy: nonzero addresses below ZERO_SIZE_PTR no longer cause its null-address abort. The rejected window was incidental to the sentinel value: address 17 already passed the old check, including in s390's mapped lowcore, and a principled first-page bound would be a separate usercopy change. Apart from hardened usercopy, direct in-tree users apply the helper to allocation results or explicit sentinel values. Assisted-by: LLM Signed-off-by: Karl Mehltretter --- include/linux/slab.h | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/include/linux/slab.h b/include/linux/slab.h index 563dadc16d82..458c4229b1d7 100644 --- a/include/linux/slab.h +++ b/include/linux/slab.h @@ -273,8 +273,12 @@ enum _slab_flag_bits { #define ZERO_SIZE_PTR ((void *)(ARCH_KMALLOC_MINALIGN > 16 ? \ ARCH_KMALLOC_MINALIGN : 16)) =20 -#define ZERO_OR_NULL_PTR(x) ((unsigned long)(x) <=3D \ - (unsigned long)ZERO_SIZE_PTR) +#define ZERO_OR_NULL_PTR(x) \ +({ \ + unsigned long __zon_ptr =3D (unsigned long)(x); \ + __zon_ptr =3D=3D 0 || \ + __zon_ptr =3D=3D (unsigned long)ZERO_SIZE_PTR; \ +}) =20 #include =20 --=20 2.53.0 From nobody Sat Sep 26 06:20:41 2026 Received: from mail-wm1-f42.google.com (mail-wm1-f42.google.com [209.85.128.42]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D25C925B2F4 for ; Thu, 3 Sep 2026 20:37:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.42 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788467859; cv=none; b=N42myuQwNRha6qJcreFijyjS+XqUsR7GZeU2px5/Sh5geLyfOYidaA97zUAKpnWQVrS39h8Ac73MeasQG3Z7DLD1Y2Qa+/zxy8FCjtukdPRsB27qVyXSV41T2OdGOoOVmUvv1tSNyxU8b6+1r8dNfriuynWo2WVLuoNvrvnD6eo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788467859; c=relaxed/simple; bh=O/xPPZ+sVVTaOOmEwsa+8rqbwM5fmRoimhLyr+2P6bA=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=NsWMypyhITx19FbyREnuBykeJ6lwEmIT9q/svXQrSApyKwvO+gG9DYhUZk8d+Z6qMUjci4b/JpENfheYl/WApF5pcYd9kD+p2ItMMuJV2/dl1CEQ/2ra4PvoZ02NzN+uN0uWsJ0YIIc/qeN3UvjvrVEOzEYVMoSj1k94+Raen+k= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=sxBNSnbM; arc=none smtp.client-ip=209.85.128.42 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="sxBNSnbM" Received: by mail-wm1-f42.google.com with SMTP id 5b1f17b1804b1-49b0d8bc2aaso3338505e9.0 for ; Thu, 03 Sep 2026 13:37:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1788467853; x=1789072653; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=rgIj/N8oul9ZLAizfJH63NRBCwMtcxycrJMIa0TwyZo=; b=sxBNSnbM925Xmo5xFRsdYK75FG4jLnidv2k76p3ry07PWePFFgrckheA2t8q5A06xT 9Dmv0a49W5WIJMfsgZt0kWw2/KNBYRU11sC6TsKn/8enZf/yVlbe1ocdNRZNINzzDAut YlTSVagBG+H88PVSxMp9BbLLvMkPGw+lojTgiAv9RQ6rr/alybLCjOF12Du3V0WJMeWU xDilYMbZgFjlv5NKAzIU/zSFQLbm9iF1zlSIqlMEsr0pPWdYRTGERvXhUCngxX0Hz/kb FZW2IOZsUnJ6DX/qPaAVczsxdm4t0hQYu/EBLd6+U0TX+ubjrzRje5jmztl1e9BXvlEU cGdQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788467853; x=1789072653; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=rgIj/N8oul9ZLAizfJH63NRBCwMtcxycrJMIa0TwyZo=; b=LUsbQiLLEdc4UR3CWXWFjVZ8emTXuYQX5T/BQs6xOKXYa5UIkeA/oZTSptAxw0gk/y z4TzMaoloVqASOjdFWE3CTZhcvHzgreVvgN2HWN7n1i6Nco7Io8t98CVPckqnapap8j5 W8SGNUspCn6jps3XNkfHIZPiJ+uiRUutuvfAwFZWH19niz67nhcuP4gKV9zdCNEiFUlg 9+yX1HtSJD/mtFwYu6pu3dD9rbyUWSjQxxCEmRp3PMlrmY4CUjBKTPl9aM7MAvzxvwJX CsbKnDJEBwNB10agLzzS2pLRyrvZg08zlTkNV2Rfoge2NnpLMTDL/oJxBS1VbuWz2h62 bQ7g== X-Forwarded-Encrypted: i=1; AKwUvBx58aC8YwsnnvShKKWJzCOLnIgDS1fElPYA/53F9XTKRDkeJCYdS3I/ND6YqUNBu3nl8K3JaaI9wHg+cvw=@vger.kernel.org X-Gm-Message-State: AFuF++kGKn/xfX3nxVdkGqphMgsmtdAZKTpQjICbSQZtXOr5OEwxDRH5 6DHKDNkYlrdEqLYJkxpdAOiY06wcV861Tt0AFsef1xOWOhGe1OMty5Wx X-Gm-Gg: AYBFou3Cycb7IjISy2HHckG5yTY93cbSM5k66Coug8NQT/7I9a4nSu2hsDNaJ/+vY9Z JIkI+CG0V9dmXlUXoeEAAPqRtnxEwCBJTsynmnJnbZjSPQwZsVWli1kk9svKgm1/Pa96vADTAhs lqD6U6Y5eyY1PM4Ie+2dZTgO7V2J9DJbQvSDcrr4iUb57fMkVAKj9YXnrTb5l3wP3dE+Dgq2sZD wJ8xbE+yLKgtK6Ps2lYAxGHn+Eur92xKO9lYhG5xaguYgdL9wi0Rea0+QCETL2UCgYDqYilLXK/ 6orObyBkQEjjcHa2udLgK0tQR7WeFtY2yieI77NR2ilr8Em/+Rte1iXLr7CK5PDDBmiZGqSDgl4 8PWWZ1fwnfv0zETzqqK5SVKD0IvnLOE+zY+bvFBKL9k9gXlFkSvcgAVDQPMPKIW3fB8AMQv9A39 +VhZq5K9Fcgj8ynKAel4RSgFpgONPFdZBcjt/8knQT11rpW7krGiB40iNHiAW0DDRW540Is2/Vc igYmIOA1bbf95zkUlSkB0BhT6LFQ8GWa7VMD+s/kdKRKHFSbiMO82nKr8sC6afEliq6SieiLuPb t0NPzgeCUKW2i242rX5O1eMi9FJU79yuk4IRm/y0OXBVkOpM4IiaoAFgJSE5HazRrA1fgXd+0zS xeX5R0xHUUhLbZ5xa X-Received: by 2002:a05:600c:1c23:b0:49c:eb16:9fd with SMTP id 5b1f17b1804b1-49cf820a8e3mr8535635e9.3.1788467852848; Thu, 03 Sep 2026 13:37:32 -0700 (PDT) Received: from MacBook-Pro-von-Karl.localdomain (dynamic-2a02-3100-a979-9501-3df6-d7fa-8a5a-06c5.310.pool.telefonica.de. [2a02:3100:a979:9501:3df6:d7fa:8a5a:6c5]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-48588394fa1sm1005070f8f.8.2026.09.03.13.37.31 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Thu, 03 Sep 2026 13:37:32 -0700 (PDT) From: Karl Mehltretter To: Vlastimil Babka , Harry Yoo , Andrew Morton Cc: Karl Mehltretter , Rasmus Villemoes , Hao Li , Christoph Lameter , David Rientjes , Roman Gushchin , Catalin Marinas , Kees Cook , "Gustavo A . R . Silva" , Arnd Bergmann , Greg Kroah-Hartman , Shuah Khan , Nathan Chancellor , Nick Desaulniers , Bill Wendling , Justin Stitt , linux-hardening@vger.kernel.org, linux-mm@kvack.org, linux-kselftest@vger.kernel.org, linux-kernel@vger.kernel.org, llvm@lists.linux.dev Subject: [PATCH v3 3/5] slab: handle ERR_PTR values in kfree and hardened usercopy Date: Thu, 3 Sep 2026 22:37:18 +0200 Message-Id: <20260903203720.63689-4-kmehltretter@gmail.com> X-Mailer: git-send-email 2.39.5 (Apple Git-154) In-Reply-To: <20260903203720.63689-1-kmehltretter@gmail.com> References: <20260903203720.63689-1-kmehltretter@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Passing an ERR_PTR to kfree() currently reaches virt_to_page() and may fault. Warn and return instead, leaving the bad caller visible without using the pointer as allocator metadata. Also reject ERR_PTR values in hardened usercopy. Keep both checks separate from ZERO_OR_NULL_PTR(), whose exact matching is required by krealloc(). Link: https://lore.kernel.org/r/CAG48ez05QVn6_gQ2TBrRa1a_DWQoaSSYubUsu5YMWx= x-gqMijQ@mail.gmail.com Link: https://lore.kernel.org/r/202608111716.0FA9DB17@keescook Link: https://github.com/KSPP/linux/issues/93 Assisted-by: LLM Signed-off-by: Karl Mehltretter --- mm/slub.c | 3 +++ mm/usercopy.c | 3 +++ 2 files changed, 6 insertions(+) diff --git a/mm/slub.c b/mm/slub.c index f9b56cb439e7..027b44dd7f07 100644 --- a/mm/slub.c +++ b/mm/slub.c @@ -6780,6 +6780,9 @@ void kfree(const void *object) if (unlikely(ZERO_OR_NULL_PTR(object))) return; =20 + if (WARN_ON(IS_ERR(object))) + return; + page =3D virt_to_page(object); slab =3D page_slab(page); if (!slab) { diff --git a/mm/usercopy.c b/mm/usercopy.c index 5de7a518b1b1..c8d8703544c6 100644 --- a/mm/usercopy.c +++ b/mm/usercopy.c @@ -157,6 +157,9 @@ static inline void check_bogus_address(const unsigned l= ong ptr, unsigned long n, /* Reject if NULL or ZERO-allocation. */ if (ZERO_OR_NULL_PTR(ptr)) usercopy_abort("null address", NULL, to_user, ptr, n); + + if (IS_ERR_VALUE(ptr)) + usercopy_abort("ERR_PTR", NULL, to_user, ptr, n); } =20 static inline void check_heap_object(const void *ptr, unsigned long n, --=20 2.53.0 From nobody Sat Sep 26 06:20:41 2026 Received: from mail-wr1-f52.google.com (mail-wr1-f52.google.com [209.85.221.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5D23A37C91A for ; Thu, 3 Sep 2026 20:37:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.52 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788467861; cv=none; b=CBLvvunWSNrsp64Q69uUrm7cVTQU1a9SvRsICSeSKjKImIdjXNDUAS9Dv6KuuzpVXU2ehl1UfoBwPqepp4CGBpS6/COhjBiXXopveVorTvZIQOevfAlawr04Tr1Hb6iIYOB2rSuSJ3qLW4Y1hiVvtMimdnegXCIVduraHsInYmU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788467861; c=relaxed/simple; bh=eQHeON0BpQBd/tO8wP0/baPlZbNUwkPl8Dihm2uv+Ak=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=Jl8WtR5mVuIP/UsboJyFD8XXSObnhbTl0fjtthGNZXKZzc96j9QjXAf3YrjQmwxnot2mUw7MS4KOAfg33XcEsUji7owj+5l2cCdDWJz9V27WKSEV8NdvGJSn4/uFV4wMQU6HHr83nKroD6DyrJhmsC+64kSIAO3QfRyZ7kZDH+M= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=mwEpWRJf; arc=none smtp.client-ip=209.85.221.52 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="mwEpWRJf" Received: by mail-wr1-f52.google.com with SMTP id ffacd0b85a97d-48441fa5c37so187314f8f.3 for ; Thu, 03 Sep 2026 13:37:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1788467854; x=1789072654; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=akOv2wAC7HX7aMxE6Q3m1WKBtSvSbn9vu4HmmhmzJNE=; b=mwEpWRJfPNFDWPxOlO/VlG+oSUnCC0DJcFaMhm9k7VwmmC4T9CEChBEFNfxl4XsAhn SIdLqat59QFWXM2b4BiKBFBLtrYZfUTAfHzk2CbM5cB8wMeqTOefupPU0mmmgWAOQdZB GHr6Vi3gQXfltHNFLJuPydI2g/fN6HlvBFljHdU1PB57ow+Za2pRod59QPcJLAvEdiwA lDuJS805xmAZgdX2ydvi9QU3pfo1/+OpwOMJBj3XUUQ2ULANALZuCEKJSLv3ixv4o3vZ Y7hOvlsFvrzWf1CLBQmA4+Y7j0EJGOYesP7OIYJdWpjF5tpKX3y7QdKpp0C8ERy20GUy KvXg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788467854; x=1789072654; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=akOv2wAC7HX7aMxE6Q3m1WKBtSvSbn9vu4HmmhmzJNE=; b=BsQxLWV/JeZ3GSw0d4fwuZjalDoVfum023w6lKXfBYoTySwlTjyNcNf5JF+/esAvm9 WAHmmwgmuTIE/AFCjaka4KkmOaQBKsBsGJtzM3nF2R1N7GemQ9wjqcJswg3K1fh/Icvp X2ya2VhGjwJEQoOXmpzECcKgN6Kqp8lEU/8n5/Gh9GH5FH6Y5yJzezSzRVfPOAH3we4g lj9kEgLENVjzLo3o9xUU+FrKpMiJspdnkb77XL+tsFp5PEopDukzk6HU6LXAHKb7SNIi MG2+vGnU8+R3y6GIaevWXQW3kcfLK0xZzPPkILarcDYRxzcjk7ilZxgK3f7uW8Xx7Usp Jrzw== X-Forwarded-Encrypted: i=1; AKwUvBzLwS6W09LKmuobIR5N34/V9k5AjlsxReJF8vMgX5q+C/C+bc1L4d7gIU7Wmgtv2KSTvEDoo0Fr74wcT0s=@vger.kernel.org X-Gm-Message-State: AFuF++mKM5IfdKaDSRkJ28xqakjYq7f5dk/DMYYpYympSBPOAbCHpFED s44v+OOjpnkPWfL2r3vtmVbiqnAMO0m5kE0zEG5nrnRhvxYUBSgDH1uN X-Gm-Gg: AYBFou0s7Jwfa6vU86eTpR2ycWYu+XVAQU+4o6ATr+rsgg2btyGmcej7kMbfUPhH0I6 e94W73p8+FdGnFFz1u4IIFBbHQW+GLrCyAeLAUnNa7Josa+bEsv5uzQO5SO88iSJO7eblwswuxo +xelW76uZfZc+By+5SQo2lFzMqDcOHks78gGw70JpK53jSUojLxxfRmIwIOVbVs+U1H2/soavWl hNmto6wA3A+UaxA/n4+RajAnghB+V9zoEdXcBn352Waa2SooFsirB3WxcZc5EAQqoy5hBAWQKFY BnbB3tIkFyVVIfG50/w01c28PY7zHpQleD+9ymLLWb+i7Si3g0/sW6OdapLOo+Ie2CyVmoCzwls GqAKDbS/R2qY5MHrLKQUtMP54giBRn0zxt35XRKNJeHm7XVDztk/Jxmm8Y+uaTZfYAa3pPByjXl mW+09zd2CD642MR1kabR8FoAjmsb0X+s8n+hVKF6qNF8BBV+WSRYQZh59dTwQfNFnLZdpLps6+p NJCNnm/CS5qhgalZxV9ngCJE++zXe1J1jsMELj5QrH9+7rxJYyDUnf7kzI3f0u2wGLsTai+Mwoq o8jxsCIKZTQt4o5qxSAmzEaPrnE+soSm6vHU/f0EmH5JjuPvihTd1PuSWnultgaBVAGdW2jyp5Z 61OGT X-Received: by 2002:a05:6000:220a:b0:485:81a8:6f09 with SMTP id ffacd0b85a97d-485870982a4mr3472028f8f.9.1788467854295; Thu, 03 Sep 2026 13:37:34 -0700 (PDT) Received: from MacBook-Pro-von-Karl.localdomain (dynamic-2a02-3100-a979-9501-3df6-d7fa-8a5a-06c5.310.pool.telefonica.de. [2a02:3100:a979:9501:3df6:d7fa:8a5a:6c5]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-48588394fa1sm1005070f8f.8.2026.09.03.13.37.33 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Thu, 03 Sep 2026 13:37:33 -0700 (PDT) From: Karl Mehltretter To: Vlastimil Babka , Harry Yoo , Andrew Morton Cc: Karl Mehltretter , Rasmus Villemoes , Hao Li , Christoph Lameter , David Rientjes , Roman Gushchin , Catalin Marinas , Kees Cook , "Gustavo A . R . Silva" , Arnd Bergmann , Greg Kroah-Hartman , Shuah Khan , Nathan Chancellor , Nick Desaulniers , Bill Wendling , Justin Stitt , linux-hardening@vger.kernel.org, linux-mm@kvack.org, linux-kselftest@vger.kernel.org, linux-kernel@vger.kernel.org, llvm@lists.linux.dev Subject: [PATCH v3 4/5] slab: test zero-size allocations in slub_kunit Date: Thu, 3 Sep 2026 22:37:19 +0200 Message-Id: <20260903203720.63689-5-kmehltretter@gmail.com> X-Mailer: git-send-email 2.39.5 (Apple Git-154) In-Reply-To: <20260903203720.63689-1-kmehltretter@gmail.com> References: <20260903203720.63689-1-kmehltretter@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Add KUnit coverage for the zero-size allocation contract, including ZERO_SIZE_PTR alignment and exact ZERO_OR_NULL_PTR() matching. Assisted-by: LLM Signed-off-by: Karl Mehltretter --- lib/tests/slub_kunit.c | 43 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 43 insertions(+) diff --git a/lib/tests/slub_kunit.c b/lib/tests/slub_kunit.c index e3b63f0338d5..923d8646bca1 100644 --- a/lib/tests/slub_kunit.c +++ b/lib/tests/slub_kunit.c @@ -465,6 +465,48 @@ static void test_kmalloc_nolock_and_friends_kprobe(str= uct kunit *test) } #endif =20 +static void test_zero_size_alloc(struct kunit *test) +{ + unsigned long zsp =3D (unsigned long)ZERO_SIZE_PTR; + void *p, *r; + + KUNIT_EXPECT_EQ(test, zsp % ARCH_KMALLOC_MINALIGN, 0UL); + + p =3D kmalloc(0, GFP_KERNEL); + KUNIT_EXPECT_PTR_EQ(test, p, ZERO_SIZE_PTR); + KUNIT_EXPECT_EQ(test, ksize(p), 0); + kfree(p); + + KUNIT_EXPECT_PTR_EQ(test, kzalloc(0, GFP_KERNEL), ZERO_SIZE_PTR); + KUNIT_EXPECT_PTR_EQ(test, kmalloc_array(0, 8, GFP_KERNEL), ZERO_SIZE_PTR); + KUNIT_EXPECT_PTR_EQ(test, kcalloc(4, 0, GFP_KERNEL), ZERO_SIZE_PTR); + + p =3D kvmalloc(0, GFP_KERNEL); + KUNIT_EXPECT_PTR_EQ(test, p, ZERO_SIZE_PTR); + kvfree(p); + + p =3D krealloc(NULL, 0, GFP_KERNEL); + KUNIT_EXPECT_PTR_EQ(test, p, ZERO_SIZE_PTR); + r =3D krealloc(p, 64, GFP_KERNEL); + KUNIT_EXPECT_FALSE(test, ZERO_OR_NULL_PTR(r)); + p =3D krealloc(r, 0, GFP_KERNEL); + KUNIT_EXPECT_PTR_EQ(test, p, ZERO_SIZE_PTR); + kfree(p); + + /* Only NULL and the zero-size sentinel match. */ + KUNIT_EXPECT_TRUE(test, ZERO_OR_NULL_PTR(NULL)); + KUNIT_EXPECT_TRUE(test, ZERO_OR_NULL_PTR(ZERO_SIZE_PTR)); + KUNIT_EXPECT_FALSE(test, ZERO_OR_NULL_PTR((void *)1)); + KUNIT_EXPECT_FALSE(test, ZERO_OR_NULL_PTR((void *)(zsp - 1))); + KUNIT_EXPECT_FALSE(test, ZERO_OR_NULL_PTR((void *)(zsp + 1))); + KUNIT_EXPECT_FALSE(test, ZERO_OR_NULL_PTR((void *)(zsp * 2))); + + /* freeing the sentinel must stay a no-op */ + kfree(ZERO_SIZE_PTR); + kfree_sensitive(ZERO_SIZE_PTR); + kvfree(ZERO_SIZE_PTR); +} + static int test_init(struct kunit *test) { slab_errors =3D 0; @@ -489,6 +531,7 @@ static struct kunit_case test_cases[] =3D { KUNIT_CASE(test_kfree_rcu_wq_destroy), KUNIT_CASE(test_leak_destroy), KUNIT_CASE(test_krealloc_redzone_zeroing), + KUNIT_CASE(test_zero_size_alloc), #ifdef CONFIG_PERF_EVENTS KUNIT_CASE_SLOW(test_kmalloc_nolock_and_friends_perf), #endif --=20 2.53.0 From nobody Sat Sep 26 06:20:41 2026 Received: from mail-wr1-f41.google.com (mail-wr1-f41.google.com [209.85.221.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5B1403BBFCF for ; Thu, 3 Sep 2026 20:37:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.41 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788467875; cv=none; b=qserB611lP0yrkwQ8cCJSiG3lz7gWx3iyGA9icijHSu5bJ2WQM7FnvXP1rsX77rzWezYVFVvKAmMu81SUElzH06c6VCGvnAoG9fExssDYToIk+9L2ObuX5l8AUCT0U/Y1f6HPdI2LXY6bvcmOWWMSB4qSHmpymy7PxryPFVsoA4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788467875; c=relaxed/simple; bh=2UBlYQEyGWOQDtIcz85wPWpuQThTw5iKFdTHWIgVFSQ=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=LZEqzQSMC7GsWoPKDM5PnNm55ZmBpfOIH1TiJxvpv3AAbMQ1HVNtuq53/uEKvYbXTi6HWAIFF/FoRu4pEF/2iNVzvs7BgJz3UPdVzcrZw3HerUePK8tjzqH/gcG+80+ZHQJC2Lg8XuQB809W7YqNLFyusBUDeU/+X7fOIaYVOEA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=ph9B1whv; arc=none smtp.client-ip=209.85.221.41 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="ph9B1whv" Received: by mail-wr1-f41.google.com with SMTP id ffacd0b85a97d-47fe89fb333so216524f8f.3 for ; Thu, 03 Sep 2026 13:37:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1788467856; x=1789072656; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=JG5wHGxobGMru3PHPCCaPFK+av72ZMxaO+XhGsfKu1Y=; b=ph9B1whvBT8TvHNzlYj5fngC4KNl8ic5pB7hUhI9EmVFkf8zM46QqzBr1wsR5wdeR1 QBwF5UzF745ngelPYPWU2BeOpsla2Nqg3DwfRgb/ogYYOkt1hURPCIGii8CnJhXBuWvO mu8j6kV+9ewhnLYoGU6aJUdFPUgXaj0faclZ4V935AI6Im23FW9ZfC2XlpPiHsCgTij6 JT8J47WYqp48mbWkpjZ8HaiyBvNrn/iigFSHtgtto4pOkXG5aJlLFJFm48DOQel5jjK3 Q10y0aTdoCVdsYkBDsv9n416DMZxFzJbA/267PzAVL/p+WxCHSpqRsbBUnNg6ZXkfBWF YXZw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788467856; x=1789072656; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=JG5wHGxobGMru3PHPCCaPFK+av72ZMxaO+XhGsfKu1Y=; b=D1EAuG50vMB2aSD/FvSTEx1IJF8YXPDmL81PlEa0/tnWxjejjaIVq6Ow1eBVXrDwVe 0skgpX9OaumLUBA8TQ1ggxQb/wBi/Ahy8t2y6qzQjJQd4rUBhR4OOxYwE55R1oZRxzRA +NxGqdmx3AogtQbHqjO93EReuNxGSS0RPU8d8py1rclAyn5qjbrFz595D+03OFcJNKGc qKd8RkzMkUeMhpLig2M3byYiqUoukxROwy6notEidoVGsv1N8MprLoqbV17NK7SO0biW 03r3NG7y2ZH1WqbT5b/dQcJ58jG1EtiethHZMtulHtzIJV8B6f+AeJNq1jTwu7l07JMt qgqg== X-Forwarded-Encrypted: i=1; AKwUvByCrNy3SAZwQk9KmkdvvReVxLVtxaLeZ094uMNvyJwmhIU8qD5gZrv612cYsdYbPrtOILFxqCeGP+pYRoQ=@vger.kernel.org X-Gm-Message-State: AFuF++mSJPqF3acuazHZ4sHuWVtCI8S3XUq6C2JA8sHskcCbUqmdqOdI bO4c7IL42ZyEGk2DQZpGxpmaZ+1aKmn1w7sONh+d8XKi2Mf5SvMKm+aE X-Gm-Gg: AYBFou20VkCuu+2zCau/23jWY/XkAz/fYvzaFAP7GJM+yKlMBVQkL5MryfNzru/+hfL rjf4O4Ip2Aon/CXL/rFyUbWyQVRAFC0/LokSTI0VpQNvuHIwF7WPiOiCfu7xhKPkvDUC01sM8ou jWV+mp+zo9JeTc+eHWDkR4fTFV1lXIk9/mUCRidgzIX0u8084M4oC9arjINbPWnsPrw4QiGRsCO vQn3ULgY8xnZeDnCIj4+YF5SyWmbGLiW5DdeK686Xqif3sUUZuZ/g2BeuU+YN5ihs2eZ0q73F9I oGTlF5DDRqURXccOn6uYoDhDDhTd4h+0oM4QDnUhFDL8ks+W4PkFkykoXdBbcGaGVMFvWvMmxAx vto9foOiXFRfNcVIS2/FgpQaXXGWE/mErKQKIVXi2YL8F5OjDyysTGY/IodEZvAF8hkF9BEEU8a SM8m+6tz1dkJWBhcG3vpTjsu0IFrt1JPwiRa3BjqmIHdhmNSj2FbiuY+9JT7h07BbCTcbVZQqMQ mrVAQ9yZzATErQFxj14nUWYoFiGxLRmhBZ4Ej4XyX0oozRrK2Ud9jv9GFzls7La4zoo5N5JaOR3 GSScctzzAoEJBJxyR58TEgj11bAfJV5Y3CKGVwx/d1DVZDpgWFSxvSCuoa4vN6Uas9PNjO6KoUM WY4fS X-Received: by 2002:a05:6000:4b0f:b0:484:3647:d977 with SMTP id ffacd0b85a97d-485872df445mr2610818f8f.27.1788467855677; Thu, 03 Sep 2026 13:37:35 -0700 (PDT) Received: from MacBook-Pro-von-Karl.localdomain (dynamic-2a02-3100-a979-9501-3df6-d7fa-8a5a-06c5.310.pool.telefonica.de. [2a02:3100:a979:9501:3df6:d7fa:8a5a:6c5]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-48588394fa1sm1005070f8f.8.2026.09.03.13.37.34 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Thu, 03 Sep 2026 13:37:35 -0700 (PDT) From: Karl Mehltretter To: Vlastimil Babka , Harry Yoo , Andrew Morton Cc: Karl Mehltretter , Rasmus Villemoes , Hao Li , Christoph Lameter , David Rientjes , Roman Gushchin , Catalin Marinas , Kees Cook , "Gustavo A . R . Silva" , Arnd Bergmann , Greg Kroah-Hartman , Shuah Khan , Nathan Chancellor , Nick Desaulniers , Bill Wendling , Justin Stitt , linux-hardening@vger.kernel.org, linux-mm@kvack.org, linux-kselftest@vger.kernel.org, linux-kernel@vger.kernel.org, llvm@lists.linux.dev Subject: [PATCH v3 5/5] slab: test ERR_PTR handling in kfree and hardened usercopy Date: Thu, 3 Sep 2026 22:37:20 +0200 Message-Id: <20260903203720.63689-6-kmehltretter@gmail.com> X-Mailer: git-send-email 2.39.5 (Apple Git-154) In-Reply-To: <20260903203720.63689-1-kmehltretter@gmail.com> References: <20260903203720.63689-1-kmehltretter@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Add KUnit coverage that kfree() warns and returns for ERR_PTR values while remaining silent for NULL and ZERO_SIZE_PTR. Add an LKDTM test that verifies hardened usercopy rejects an ERR_PTR before attempting the copy. Assisted-by: LLM Signed-off-by: Karl Mehltretter --- drivers/misc/lkdtm/usercopy.c | 27 +++++++++++++++++++++++++ lib/tests/slub_kunit.c | 18 +++++++++++++++++ tools/testing/selftests/lkdtm/tests.txt | 1 + 3 files changed, 46 insertions(+) diff --git a/drivers/misc/lkdtm/usercopy.c b/drivers/misc/lkdtm/usercopy.c index 67db57249a34..10751e48211f 100644 --- a/drivers/misc/lkdtm/usercopy.c +++ b/drivers/misc/lkdtm/usercopy.c @@ -4,6 +4,7 @@ * hardening. */ #include "lkdtm.h" +#include #include #include #include @@ -273,6 +274,31 @@ static void do_usercopy_slab_whitelist(bool to_user) } =20 /* Callable tests. */ +static void lkdtm_USERCOPY_ERR_PTR(void) +{ + unsigned long user_addr; + size_t size =3D unconst + 1; + + user_addr =3D vm_mmap(NULL, 0, PAGE_SIZE, + PROT_READ | PROT_WRITE, + MAP_ANONYMOUS | MAP_PRIVATE, 0); + if (user_addr >=3D TASK_SIZE) { + pr_warn("Failed to allocate user memory\n"); + return; + } + + pr_info("attempting bad one-byte copy_to_user() from ERR_PTR\n"); + if (copy_to_user((void __user *)user_addr, ERR_PTR(-EINVAL), size)) { + pr_warn("copy_to_user failed, but lacked Oops\n"); + goto free_user; + } + pr_err("FAIL: ERR_PTR usercopy not detected!\n"); + pr_expected_config_param(CONFIG_HARDENED_USERCOPY, "hardened_usercopy"); + +free_user: + vm_munmap(user_addr, PAGE_SIZE); +} + static void lkdtm_USERCOPY_SLAB_SIZE_TO(void) { do_usercopy_slab_size(true); @@ -439,6 +465,7 @@ void __exit lkdtm_usercopy_exit(void) } =20 static struct crashtype crashtypes[] =3D { + CRASHTYPE(USERCOPY_ERR_PTR), CRASHTYPE(USERCOPY_SLAB_SIZE_TO), CRASHTYPE(USERCOPY_SLAB_SIZE_FROM), CRASHTYPE(USERCOPY_SLAB_WHITELIST_TO), diff --git a/lib/tests/slub_kunit.c b/lib/tests/slub_kunit.c index 923d8646bca1..079563387007 100644 --- a/lib/tests/slub_kunit.c +++ b/lib/tests/slub_kunit.c @@ -507,6 +507,23 @@ static void test_zero_size_alloc(struct kunit *test) kvfree(ZERO_SIZE_PTR); } =20 +static void test_kfree_err_ptr(struct kunit *test) +{ + if (!IS_ENABLED(CONFIG_BUG)) + kunit_skip(test, "requires CONFIG_BUG"); + + kunit_warning_suppress(test) { + kfree(NULL); + KUNIT_EXPECT_SUPPRESSED_WARNING_COUNT(test, 0); + + kfree(ZERO_SIZE_PTR); + KUNIT_EXPECT_SUPPRESSED_WARNING_COUNT(test, 0); + + kfree(ERR_PTR(-EINVAL)); + KUNIT_EXPECT_SUPPRESSED_WARNING_COUNT(test, 1); + } +} + static int test_init(struct kunit *test) { slab_errors =3D 0; @@ -532,6 +549,7 @@ static struct kunit_case test_cases[] =3D { KUNIT_CASE(test_leak_destroy), KUNIT_CASE(test_krealloc_redzone_zeroing), KUNIT_CASE(test_zero_size_alloc), + KUNIT_CASE(test_kfree_err_ptr), #ifdef CONFIG_PERF_EVENTS KUNIT_CASE_SLOW(test_kmalloc_nolock_and_friends_perf), #endif diff --git a/tools/testing/selftests/lkdtm/tests.txt b/tools/testing/selfte= sts/lkdtm/tests.txt index bec57a02913a..d3e38c1c75cd 100644 --- a/tools/testing/selftests/lkdtm/tests.txt +++ b/tools/testing/selftests/lkdtm/tests.txt @@ -70,6 +70,7 @@ REFCOUNT_DEC_AND_TEST_SATURATED Saturation detected: stil= l saturated REFCOUNT_SUB_AND_TEST_SATURATED Saturation detected: still saturated #REFCOUNT_TIMING timing only #ATOMIC_TIMING timing only +USERCOPY_ERR_PTR Kernel memory exposure attempt detected from ERR_PTR USERCOPY_SLAB_SIZE_TO USERCOPY_SLAB_SIZE_FROM USERCOPY_SLAB_WHITELIST_TO --=20 2.53.0