static inline unsigned int shash_align_buffer_size(unsigned len,
						   unsigned long mask)
{
	typedef u8 __aligned_largest u8_aligned;
	return len + (mask & ~(__alignof__(u8_aligned) - 1));
}

The product writes data past the end, or before the beginning, of the intended buffer.