A bucket set is created with kmem_cache_create_usercopy(..., align = 0),
so calculate_alignment() falls back to arch_slab_minalign(), typically 8
bytes. The general kmalloc caches it stands in for are created through
create_boot_cache(), which starts from ARCH_KMALLOC_MINALIGN and raises
it to the largest power-of-two divisor of the size:
if (flags & SLAB_KMALLOC)
align = max(align, 1U << (ffs(size) - 1));
This is only a problem when slab metadata is enabled with
CONFIG_KASAN=y, CONFIG_SLUB_DEBUG_ON=y, or "slab_debug=...", because
metadata changes the stride size off a power of two, for example:
size 128: bucket align=8 size=224 | kmalloc align=128 size=384
size 512: bucket align=8 size=608 | kmalloc align=512 size=1536
size 2048: bucket align=8 size=2144 | kmalloc align=2048 size=6144
So bucket allocations will fail the IS_ALIGNED(p, ARCH_DMA_MINALIGN)
check, potentially creating problems for non-coherent DMA situation.
Take the alignment from the cache being mirrored, which is where the
size and the name suffix already come from. Nothing changes where the
alignment was already implied by the size.
Fixes: b32801d1255be ("mm/slab: Introduce kmem_buckets_create() and family")
Assisted-by: LLM
Signed-off-by: Kees Cook <[email protected]>
---
Cc: Vlastimil Babka <[email protected]>
Cc: Harry Yoo <[email protected]>
Cc: Andrew Morton <[email protected]>
Cc: Hao Li <[email protected]>
Cc: Christoph Lameter <[email protected]>
Cc: David Rientjes <[email protected]>
Cc: Roman Gushchin <[email protected]>
Cc: <[email protected]>
Cc: Pedro Falcato <[email protected]>
Cc: Kuniyuki Iwashima <[email protected]>
Cc: <[email protected]>
---
mm/slab_common.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/mm/slab_common.c b/mm/slab_common.c
index 270408ce5a9d..cc58f192f349 100644
--- a/mm/slab_common.c
+++ b/mm/slab_common.c
@@ -487,7 +487,8 @@ kmem_buckets *kmem_buckets_create(const char *name,
slab_flags_t flags,
if (WARN_ON(!cache_name))
goto fail;
(*b)[aligned_idx] =
kmem_cache_create_usercopy(cache_name, size,
- 0, flags, cache_useroffset,
+
kmalloc_caches[KMALLOC_NORMAL][idx]->align,
+ flags, cache_useroffset,
cache_usersize, ctor);
kfree(cache_name);
if (WARN_ON(!(*b)[aligned_idx]))
--
2.34.1
