[PATCH] slab: Saturate to SIZE_MAX for allocation size overflows

[PATCH] slab: Saturate to SIZE_MAX for allocation size overflows

[Kees Cook]

Instead of silently returning NULL on size overflows from array
allocations, saturate the request to SIZE_MAX so the error will be
surfaced to the allocator (and still return NULL).

Suggested-by: Vlastimil Babka <vbabka@suse.cz>
Link: https://lore.kernel.org/lkml/a144cd1e-8bfc-4380-8f1b-071db0af0b2c@suse.cz/
Signed-off-by: Kees Cook <kees@kernel.org>
---
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Christoph Lameter <cl@gentwo.org>
Cc: David Rientjes <rientjes@google.com>
Cc: Roman Gushchin <roman.gushchin@linux.dev>
Cc: Harry Yoo <harry.yoo@oracle.com>
Cc: <linux-mm@kvack.org>
---
 include/linux/slab.h | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/include/linux/slab.h b/include/linux/slab.h
index a5a5e4108ae5..8453c81c75c3 100644
--- a/include/linux/slab.h
+++ b/include/linux/slab.h
@@ -1105,7 +1105,7 @@ static inline __alloc_size(1, 2) void *kmalloc_array_noprof(size_t n, size_t siz
 	size_t bytes;
 
 	if (unlikely(check_mul_overflow(n, size, &bytes)))
-		return NULL;
+		bytes = SIZE_MAX;
 	return kmalloc_noprof(bytes, flags);
 }
 #define kmalloc_array(...)			alloc_hooks(kmalloc_array_noprof(__VA_ARGS__))
@@ -1135,7 +1135,7 @@ static inline __realloc_size(2, 3) void * __must_check krealloc_array_noprof(voi
 	size_t bytes;
 
 	if (unlikely(check_mul_overflow(new_n, new_size, &bytes)))
-		return NULL;
+		bytes = SIZE_MAX;
 
 	return krealloc_noprof(p, bytes, flags);
 }
@@ -1175,7 +1175,7 @@ static inline __alloc_size(1, 2) void *kmalloc_array_node_noprof(size_t n, size_
 	size_t bytes;
 
 	if (unlikely(check_mul_overflow(n, size, &bytes)))
-		return NULL;
+		bytes = SIZE_MAX;
 	if (__builtin_constant_p(n) && __builtin_constant_p(size))
 		return kmalloc_node_noprof(bytes, flags, node);
 	return __kmalloc_node_noprof(PASS_BUCKET_PARAMS(bytes, NULL), flags, node);
@@ -1223,7 +1223,7 @@ kvmalloc_array_node_noprof(size_t n, size_t size, gfp_t flags, int node)
 	size_t bytes;
 
 	if (unlikely(check_mul_overflow(n, size, &bytes)))
-		return NULL;
+		bytes = SIZE_MAX;
 
 	return kvmalloc_node_align_noprof(bytes, 1, flags, node);
 }
-- 
2.34.1

Re: [PATCH] slab: Saturate to SIZE_MAX for allocation size overflows

[Harry Yoo]

On Tue, Feb 24, 2026 at 05:40:02PM -0800, Kees Cook wrote:
> Instead of silently returning NULL on size overflows from array
> allocations, saturate the request to SIZE_MAX so the error will be
> surfaced to the allocator (and still return NULL).
> 
> Suggested-by: Vlastimil Babka <vbabka@suse.cz>
> Link: https://lore.kernel.org/lkml/a144cd1e-8bfc-4380-8f1b-071db0af0b2c@suse.cz/
> Signed-off-by: Kees Cook <kees@kernel.org>
> ---

Yes, since it's larger than order-1, it'll be passed to
the page allocator and will hit the order > MAX_PAGE_ORDER warning in
__alloc_frozen_pages_noprof(). 

Looks good to me,
Reviewed-by: Harry Yoo <harry.yoo@oracle.com>

-- 
Cheers,
Harry / Hyeonggon

Re: [PATCH] slab: Saturate to SIZE_MAX for allocation size overflows

[Matthew Wilcox]

On Tue, Feb 24, 2026 at 05:40:02PM -0800, Kees Cook wrote:
> +++ b/include/linux/slab.h
> @@ -1105,7 +1105,7 @@ static inline __alloc_size(1, 2) void *kmalloc_array_noprof(size_t n, size_t siz
>  	size_t bytes;
>  
>  	if (unlikely(check_mul_overflow(n, size, &bytes)))
> -		return NULL;
> +		bytes = SIZE_MAX;
>  	return kmalloc_noprof(bytes, flags);

Wouldn't this be better written as:

	return kmalloc_noprof(size_mul(n, size), flags);

(etc)

Re: [PATCH] slab: Saturate to SIZE_MAX for allocation size overflows

[Kees Cook]

On Wed, Feb 25, 2026 at 03:59:08AM +0000, Matthew Wilcox wrote:
> On Tue, Feb 24, 2026 at 05:40:02PM -0800, Kees Cook wrote:
> > +++ b/include/linux/slab.h
> > @@ -1105,7 +1105,7 @@ static inline __alloc_size(1, 2) void *kmalloc_array_noprof(size_t n, size_t siz
> >  	size_t bytes;
> >  
> >  	if (unlikely(check_mul_overflow(n, size, &bytes)))
> > -		return NULL;
> > +		bytes = SIZE_MAX;
> >  	return kmalloc_noprof(bytes, flags);
> 
> Wouldn't this be better written as:
> 
> 	return kmalloc_noprof(size_mul(n, size), flags);
> 
> (etc)

Sure, I can convert them all that way if that's preferred?

-- 
Kees Cook