Re: [RFC PATCH] slab: don't assume alignment on allocators that may return ZERO_SIZE_PTR

[Karl Mehltretter]

On Mon, Jul 13, 2026 at 06:53:40PM +0100, Vlastimil Babka (SUSE) wrote:
> On 7/13/26 07:18, Harry Yoo wrote:
> > 
> > Bumping ZERO_SIZE_PTR to something smaller than PAGE_SIZE should still
> > work: (addr < PAGE_SIZE) check still works, and accessing it still
> > causes a fault. No arch should have ARCH_KMALLOC_MINALIGN >= PAGE_SIZE?
> 
> Yeah, I don't see why anything should mind if the value changes to a larger
> one, if it's still well below PAGE_SIZE.

That should work for the affected architectures. The maximum effective
ARCH_KMALLOC_MINALIGN is 128 bytes.
It exceeds 16 on 32-bit arm, ARC, non-coherent MIPS and similar
configurations (32/64/128). Before commit 9382bc44b5f5 ("arm64: allow
kmalloc() caches aligned to the smaller cache_line_size()"), arm64 also
used 128 via ARCH_DMA_MINALIGN.

Preserve 16 where possible:

	#define ZERO_SIZE_PTR ((void *)(ARCH_KMALLOC_MINALIGN > 16 ? \
					ARCH_KMALLOC_MINALIGN : 16))

with static_assert(ARCH_KMALLOC_MINALIGN <= 128) after the effective
definition. This only changes architectures that need it.

The max value 128 remains below VFS_PTR_POISON (245) and
LIST_POISON1 (256) even before POISON_POINTER_DELTA is added.

A fixed value of 128 for all architectures would be problematic: s390
does not need the alignment change, and its lowcore uses address 128.

On affected architectures, the current ZERO_OR_NULL_PTR() range check
would accept values from 0 up to 128. 

Exact NULL-or-sentinel comparison may be preferable for hardening.
This was discussed in 2016 [1][2]. For a power-of-two sentinel, 
current GCC and Clang can optimize the comparisons to a mask/test.

With exact matching, applying POISON_POINTER_DELTA to ZERO_SIZE_PTR could
also be offered as a configurable hardening option.

[1] https://lore.kernel.org/all/1479376267-18486-1-git-send-email-mpe@xxxxxxxxxxxxxx/
[2] https://lore.kernel.org/all/alpine.DEB.2.20.1611181146330.26818@xxxxxxxxxxxxxxx/

Karl