[PATCH v2] linux: align the ancillary buffer in tst-socket-timestamp
Florian Weimer
fweimer@redhat.com
Wed Aug 12 10:41:54 GMT 2026
* Matt Turner:
> The test places the ancillary buffer so that it ends against a PROT_NONE
> page, at cmsg - (CMSG_SPACE (tsize) + slack). CMSG_SPACE (sizeof (struct
> timeval)) is a multiple of the alignment of struct cmsghdr, so the start of
> the buffer inherits the alignment of the slack, and one of the slack sizes
> the test uses is 4.
>
> msg_control has to be suitably aligned for struct cmsghdr: recvmsg and the
> CMSG_* macros both read cmsg_len from the start of the buffer, and it is a
> size_t. On a target that does not fix up unaligned accesses in hardware,
> reading it from a misaligned address traps into the kernel. On alpha each
> one is reported:
>
> ld-linux.so.2(48878): unaligned trap at 0000000120001e3c: ... 29 2
>
> five per run, all from the loop over the control messages in
> do_recvmsg_slack_ancillary. The test still passes, since the kernel
> completes the access and returns.
>
> Round the start of the buffer down to the alignment, and add the alignment
> minus one to the requested allocation so the rounding cannot move the start
> outside it. A slack that is not a multiple of the alignment then leaves the
> buffer ending a few bytes short of the guard page rather than against it; the
> overruns the guard page is there to catch are a whole timestamp rather than a
> few bytes, so they are still caught.
> ---
> .../unix/sysv/linux/tst-socket-timestamp.c | 20 +++++++++++++++----
> 1 file changed, 16 insertions(+), 4 deletions(-)
This looks okay to me. I think I verified that the test still works as
expected to isolate the original bug after your changes, on i386 with
the old code paths being used.
Reviewed-by: Florian Weimer <fweimer@redhat.com>
Thanks,
Florian
More information about the Libc-alpha
mailing list