On Mon, Sep 21, 2026 at 12:58:13AM -0700, Kees Cook wrote:
> A bucket set is created with kmem_cache_create_usercopy(..., align = 0),
> so calculate_alignment() falls back to arch_slab_minalign(), typically 8
> bytes. The general kmalloc caches it stands in for are created through
> create_boot_cache(), which starts from ARCH_KMALLOC_MINALIGN and raises
> it to the largest power-of-two divisor of the size:
>
> if (flags & SLAB_KMALLOC)
> align = max(align, 1U << (ffs(size) - 1));
>
> This is only a problem when slab metadata is enabled with
> CONFIG_KASAN=y, CONFIG_SLUB_DEBUG_ON=y, or "slab_debug=...", because
> metadata changes the stride size off a power of two, for example:
>
> size 128: bucket align=8 size=224 | kmalloc align=128 size=384
> size 512: bucket align=8 size=608 | kmalloc align=512 size=1536
> size 2048: bucket align=8 size=2144 | kmalloc align=2048 size=6144
Hmm... I think what adds confusion here is that in new_kmalloc_cache()
we adjust the size based on alignment, but in create_boot_cache() we
don't do that. Perhaps let's make it consistent and move it to
new_kmalloc_cache()?
> So bucket allocations will fail the IS_ALIGNED(p, ARCH_DMA_MINALIGN)
> check, potentially creating problems for non-coherent DMA situation.
I was wondering "Why should they respect kmalloc alignment..." but yeah,
It makes sense if the users were using kmalloc and depended on its
alignment.
Well, but that's already done in new_kmalloc_cache() and
kmem_buckets_create() should already honor ARCH_KMALLOC_MINALIGN?
The largest-power-of-two-divisor-alignment guarantee was introduced by
commit ad59baa31695 ("slab, rust: extend kmalloc() alignment guarantees
to remove Rust padding")
...which makes me wonder what you're trying to fix here?
> Take the alignment from the cache being mirrored, which is where the
> size and the name suffix already come from. Nothing changes where the
> alignment was already implied by the size.
>
> Fixes: b32801d1255be ("mm/slab: Introduce kmem_buckets_create() and family")
> Assisted-by: LLM
> Signed-off-by: Kees Cook <[email protected]>
> ---
> Cc: Vlastimil Babka <[email protected]>
> Cc: Harry Yoo <[email protected]>
> Cc: Andrew Morton <[email protected]>
> Cc: Hao Li <[email protected]>
> Cc: Christoph Lameter <[email protected]>
> Cc: David Rientjes <[email protected]>
> Cc: Roman Gushchin <[email protected]>
> Cc: <[email protected]>
> Cc: Pedro Falcato <[email protected]>
> Cc: Kuniyuki Iwashima <[email protected]>
> Cc: <[email protected]>
> ---
> mm/slab_common.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/mm/slab_common.c b/mm/slab_common.c
> index 270408ce5a9d..cc58f192f349 100644
> --- a/mm/slab_common.c
> +++ b/mm/slab_common.c
> @@ -487,7 +487,8 @@ kmem_buckets *kmem_buckets_create(const char *name,
> slab_flags_t flags,
> if (WARN_ON(!cache_name))
> goto fail;
> (*b)[aligned_idx] =
> kmem_cache_create_usercopy(cache_name, size,
> - 0, flags, cache_useroffset,
> +
> kmalloc_caches[KMALLOC_NORMAL][idx]->align,
> + flags, cache_useroffset,
> cache_usersize, ctor);
> kfree(cache_name);
> if (WARN_ON(!(*b)[aligned_idx]))
> --
> 2.34.1
--
Cheers,
Harry / Hyeonggon
