From 5e73e8c8d62b68b9f81d1076a6d8f85359311f0d Mon Sep 17 00:00:00 2001 From: Chris Kennelly CA Date: Tue, 8 Sep 2026 10:53:28 -0700 Subject: [PATCH] Guard slabs_end hugepage_status marking with IsAlignedTo in ReleaseSlabMetadataForDrainedCpus. When slabs_end is hugepage-aligned, `address_to_hugepage_number(slabs_end) - base_hugepage_nr` indexes the hugepage immediately following the allocated slabs, causing an out-of-bounds array write and erroneously marking an untouched hugepage as kCannotFree. Guard the marking with `!IsAlignedTo(slabs_end, kHugePageSize)`. PiperOrigin-RevId: 978002656 --- tcmalloc/internal/percpu_tcmalloc.h | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/tcmalloc/internal/percpu_tcmalloc.h b/tcmalloc/internal/percpu_tcmalloc.h index 31502b42a..feaa5ba07 100644 --- a/tcmalloc/internal/percpu_tcmalloc.h +++ b/tcmalloc/internal/percpu_tcmalloc.h @@ -1495,8 +1495,10 @@ void TcmallocSlab::ReleaseSlabMetadataForDrainedCpus( // end perfectly on a hugepage boundary. (At the very least, // we'd risk tearing a hugepage.) void* slabs_end = CpuMemoryStart(slabs, shift, n_cpus); - hugepage_status[address_to_hugepage_number(slabs_end) - base_hugepage_nr] = - kCannotFree; + if (!IsAlignedTo(slabs_end, kHugePageSize)) { + hugepage_status[address_to_hugepage_number(slabs_end) - base_hugepage_nr] = + kCannotFree; + } // Go through all the CPUs and figure out which hugepage its slab // lives in. (Because we've already tested that slabs are slab-aligned