On Tue, Aug 11, 2026 at 05:17:48PM +0100, Kees Cook wrote:
> > Compare explicitly against NULL and ZERO_SIZE_PTR. Store the argument
> > in an unsigned long temporary to support both pointer and integer
> > address arguments while evaluating it only once.
>
> Can we move ZERO_SIZE_PTR to cover the ERR_PTR range too? See this issue:
> https://github.com/KSPP/linux/issues/93
>
> > This also changes check_bogus_address() in hardened usercopy: nonzero
> > addresses below ZERO_SIZE_PTR no longer cause its null-address abort.
>
> And then check_bogus_address would also catch ERR_PTR.
>
Thanks, I did not know about the earlier discussion and the KSPP issue.
Using -4096 for ZERO_SIZE_PTR is tempting.
However I found a few conflicts, for example:
- PowerPC KVM guest kernels map their magic page at exactly -4096. A
kernel making this change would probably have to move it to -8192.
- m68k DragonBall has a hardware register at exactly 0xfffff000.
- OpenRISC could reach this address with an exact 1 GiB direct map.
Linus's original reason for choosing 16 was that it should fault
like NULL:
https://lore.kernel.org/r/[email protected]
I would not include ERR_PTR range for ZERO_OR_NULL_PTR()
globally. krealloc() also uses it, where it would make an ERR_PTR()
behave like NULL and allocate new memory.
Maybe keep the exact check and add IS_ERR() separately
to kfree() and hardened usercopy.
Karl
