Re: [PATCH v4 2/7] mm/slab: Give bucket caches the alignment of the caches they mirror

[Harry Yoo]

On Mon, Sep 21, 2026 at 12:58:13AM -0700, Kees Cook wrote:
> A bucket set is created with kmem_cache_create_usercopy(..., align = 0),
> so calculate_alignment() falls back to arch_slab_minalign(), typically 8
> bytes. The general kmalloc caches it stands in for are created through
> create_boot_cache(), which starts from ARCH_KMALLOC_MINALIGN and raises
> it to the largest power-of-two divisor of the size:
> 
> 	if (flags & SLAB_KMALLOC)
> 		align = max(align, 1U << (ffs(size) - 1));
> 
> This is only a problem when slab metadata is enabled with
> CONFIG_KASAN=y, CONFIG_SLUB_DEBUG_ON=y, or "slab_debug=...", because
> metadata changes the stride size off a power of two, for example:
>
> 	size 128:  bucket align=8 size=224  | kmalloc align=128  size=384
> 	size 512:  bucket align=8 size=608  | kmalloc align=512  size=1536
> 	size 2048: bucket align=8 size=2144 | kmalloc align=2048 size=6144

Hmm... I think what adds confusion here is that in new_kmalloc_cache()
we adjust the size based on alignment, but in create_boot_cache() we
don't do that. Perhaps let's make it consistent and move it to
new_kmalloc_cache()?

> So bucket allocations will fail the IS_ALIGNED(p, ARCH_DMA_MINALIGN)
> check, potentially creating problems for non-coherent DMA situation.

I was wondering "Why should they respect kmalloc alignment..." but yeah,
It makes sense if the users were using kmalloc and depended on its
alignment.

Well, but that's already done in new_kmalloc_cache() and
kmem_buckets_create() should already honor ARCH_KMALLOC_MINALIGN? 

The largest-power-of-two-divisor-alignment guarantee was introduced by
commit ad59baa31695 ("slab, rust: extend kmalloc() alignment guarantees
to remove Rust padding")

...which makes me wonder what you're trying to fix here?

> Take the alignment from the cache being mirrored, which is where the
> size and the name suffix already come from. Nothing changes where the
> alignment was already implied by the size.
>
> Fixes: b32801d1255be ("mm/slab: Introduce kmem_buckets_create() and family")
> Assisted-by: LLM
> Signed-off-by: Kees Cook <kees@xxxxxxxxxx>
> ---
> Cc: Vlastimil Babka <vbabka@xxxxxxxxxx>
> Cc: Harry Yoo <harry@xxxxxxxxxx>
> Cc: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
> Cc: Hao Li <hao.li@xxxxxxxxx>
> Cc: Christoph Lameter <cl@xxxxxxxxxx>
> Cc: David Rientjes <rientjes@xxxxxxxxxx>
> Cc: Roman Gushchin <roman.gushchin@xxxxxxxxx>
> Cc: <linux-mm@xxxxxxxxx>
> Cc: Pedro Falcato <pfalcato@xxxxxxx>
> Cc: Kuniyuki Iwashima <kuniyu@xxxxxxxxxx>
> Cc: <linux-hardening@xxxxxxxxxxxxxxx>
> ---
>  mm/slab_common.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/mm/slab_common.c b/mm/slab_common.c
> index 270408ce5a9d..cc58f192f349 100644
> --- a/mm/slab_common.c
> +++ b/mm/slab_common.c
> @@ -487,7 +487,8 @@ kmem_buckets *kmem_buckets_create(const char *name, slab_flags_t flags,
>  			if (WARN_ON(!cache_name))
>  				goto fail;
>  			(*b)[aligned_idx] = kmem_cache_create_usercopy(cache_name, size,
> -					0, flags, cache_useroffset,
> +					kmalloc_caches[KMALLOC_NORMAL][idx]->align,
> +					flags, cache_useroffset,
>  					cache_usersize, ctor);
>  			kfree(cache_name);
>  			if (WARN_ON(!(*b)[aligned_idx]))
> -- 
> 2.34.1

-- 
Cheers,
Harry / Hyeonggon