[PATCH v2 0/3] slab: ZERO_SIZE_PTR alignment and exact matching

Karl Mehltretter <[email protected]>
Newsgroups org.kernel.vger.linux-hardening,dev.linux.lists.llvm,org.kernel.vger.linux-kernel,org.kvack.linux-mm
Message-ID <[email protected]>
The kmalloc entry points promise ARCH_KMALLOC_MINALIGN alignment but
return (void *)16 for zero-size requests. Patch 1 aligns the sentinel
to that promise. Patch 2 makes ZERO_OR_NULL_PTR() match only NULL and
the sentinel, so increasing the sentinel does not widen the set it
matches. Patch 3 adds KUnit coverage.

In hardened usercopy, patch 2 changes check_bogus_address() so nonzero
addresses below ZERO_SIZE_PTR no longer cause its null-address abort.

v1 -> v2:

  - express the poison-pointer bound as 0x100 instead of 128 (Catalin)
  - make ZERO_OR_NULL_PTR() use exact matches
  - add KUnit coverage

Tested on bcc44b6785f21 with the series applied:

  - GCC 15.2 QEMU boots on ten configurations spanning sentinel values
    16, 32, 64 and 128, all passing the zero-size allocation selftest
  - the x86_64 test also passes with GCC 8.1, the minimum supported
    compiler
  - the new KUnit test passes on UML
  - Clang UBSAN_ALIGNMENT is clean on armv5 and the generated code
    retains the exact sentinel comparison
  - Clang builds the macro for 21 targets at -O2 and -Os, with single
    evaluation confirmed in the generated IR
  - patch 2 changes vmlinux text by -2 bytes on x86_64 and -72 bytes
    on armv5, and arm64 gains 44 symbol bytes

v1: https://lore.kernel.org/r/[email protected]
RFC: https://lore.kernel.org/r/[email protected]

Karl Mehltretter (3):
  slab: align ZERO_SIZE_PTR to ARCH_KMALLOC_MINALIGN
  slab: check for ZERO_SIZE_PTR by exact match
  slab: test zero-size allocations in slub_kunit

 include/linux/slab.h   | 20 +++++++++++++++++---
 lib/tests/slub_kunit.c | 43 ++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 60 insertions(+), 3 deletions(-)


base-commit: bcc44b6785f216eb939226ade6e3910baa30516b
--
2.53.0
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.