On Tue, Aug 11, 2026 at 04:12:39PM +0200, Karl Mehltretter wrote: > ZERO_OR_NULL_PTR() returns true for every value less than or equal to > ZERO_SIZE_PTR. With the sentinel raised to ARCH_KMALLOC_MINALIGN, up > to 128 on some architectures, the helper matches additional values > that are neither NULL nor the sentinel. > > Compare explicitly against NULL and ZERO_SIZE_PTR. Store the argument > in an unsigned long temporary to support both pointer and integer > address arguments while evaluating it only once.
Can we move ZERO_SIZE_PTR to cover the ERR_PTR range too? See this issue: https://github.com/KSPP/linux/issues/93 > This also changes check_bogus_address() in hardened usercopy: nonzero > addresses below ZERO_SIZE_PTR no longer cause its null-address abort. And then check_bogus_address would also catch ERR_PTR. -Kees -- Kees Cook
