Re: [PATCH v2 2/3] slab: check for ZERO_SIZE_PTR by exact match

On Tue, Aug 11, 2026 at 04:12:39PM +0200, Karl Mehltretter wrote:
> ZERO_OR_NULL_PTR() returns true for every value less than or equal to
> ZERO_SIZE_PTR. With the sentinel raised to ARCH_KMALLOC_MINALIGN, up
> to 128 on some architectures, the helper matches additional values
> that are neither NULL nor the sentinel.
> 
> Compare explicitly against NULL and ZERO_SIZE_PTR. Store the argument
> in an unsigned long temporary to support both pointer and integer
> address arguments while evaluating it only once.

Can we move ZERO_SIZE_PTR to cover the ERR_PTR range too? See this issue:
https://github.com/KSPP/linux/issues/93

> This also changes check_bogus_address() in hardened usercopy: nonzero
> addresses below ZERO_SIZE_PTR no longer cause its null-address abort.

And then check_bogus_address would also catch ERR_PTR.

-Kees

-- 
Kees Cook