[PATCH v2] linux: align the ancillary buffer in tst-socket-timestamp

Florian Weimer fweimer@redhat.com
Wed Aug 12 10:41:54 GMT 2026


* Matt Turner:

> The test places the ancillary buffer so that it ends against a PROT_NONE
> page, at cmsg - (CMSG_SPACE (tsize) + slack).  CMSG_SPACE (sizeof (struct
> timeval)) is a multiple of the alignment of struct cmsghdr, so the start of
> the buffer inherits the alignment of the slack, and one of the slack sizes
> the test uses is 4.
>
> msg_control has to be suitably aligned for struct cmsghdr: recvmsg and the
> CMSG_* macros both read cmsg_len from the start of the buffer, and it is a
> size_t.  On a target that does not fix up unaligned accesses in hardware,
> reading it from a misaligned address traps into the kernel.  On alpha each
> one is reported:
>
>   ld-linux.so.2(48878): unaligned trap at 0000000120001e3c: ... 29 2
>
> five per run, all from the loop over the control messages in
> do_recvmsg_slack_ancillary.  The test still passes, since the kernel
> completes the access and returns.
>
> Round the start of the buffer down to the alignment, and add the alignment
> minus one to the requested allocation so the rounding cannot move the start
> outside it.  A slack that is not a multiple of the alignment then leaves the
> buffer ending a few bytes short of the guard page rather than against it; the
> overruns the guard page is there to catch are a whole timestamp rather than a
> few bytes, so they are still caught.
> ---
>  .../unix/sysv/linux/tst-socket-timestamp.c    | 20 +++++++++++++++----
>  1 file changed, 16 insertions(+), 4 deletions(-)

This looks okay to me.  I think I verified that the test still works as
expected to isolate the original bug after your changes, on i386 with
the old code paths being used.

Reviewed-by: Florian Weimer <fweimer@redhat.com>

Thanks,
Florian



More information about the Libc-alpha mailing list