From nobody Mon Aug 24 16:30:01 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hTGbY4zRgz6pbPq for ; Mon, 24 Aug 2026 16:30:01 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hTGbY1lwrz41Dy for ; Mon, 24 Aug 2026 16:30:01 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1787589001; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=8GQ7vj0y752cujPa7sxK5TBbjTzl9OzK6God+RE/3kc=; b=UsP4LkcQ4JoC5gIf1EBAu6XgGL0/Rx0fNcURDXuvR9H9qOfYOczuCHZut1kGd/tEZHC0uD DDp8MrRHDPicTocuOZIFKzEXjKZBCXyp9T9D19bX1QSjtUcsvkCq+y0kpZ3Vo1P1qd0vNc wpEy2iqp2odIxBlFCEyUnGbyK/NifG9ouIgEblB3RKF/2OB1DVlwgryWTU5eYRdOM4zdXX 8QwsIB682qzK7nfwdiiN+VMQ8Uo8Qgciq8O+3zhzkCIxbb2TExJXT+KED7iMo+qCAU57Im lzxfgLoGHOV8+VBIP7O2o9UkKjT/DKcPNX0aXed9DxP8C63ny7n9AfK+zEZwsA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1787589001; a=rsa-sha256; cv=none; b=nky9CRp7wjTVL4lbTeewv/Vg/V4C5Mgr8yqHEK8ongp/TyEyu/PPewDEJp5oAIEKA6adgJ UhQ48fwLMBCpe/m/ZMI0m8d20t6bAxLpvHduoxTziBvzQ15DjuLRfZRfbtmd1nQrZzE5aR MJBZGjol9xkDgXWtqAJix96VjLNhRkKM71qzv6EzMMV5XkeCXmeG9dIFk3AvcdJ0iJYgRT sQep0BT/zJbCyufR9qdIF1WU+lSTgKsKJhzDiIKehF+xTmBZ2J0gphnjPTFhWsasKReigY aYzaLnr6ZK7CUNytSHyzNg+qjOYjOFAGqBYTHcjaNGireOfVPp25FyIB84NtIA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1787589001; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=8GQ7vj0y752cujPa7sxK5TBbjTzl9OzK6God+RE/3kc=; b=Z92DiDGZpfaCHMo8fw/2uoQDUvRQsrQa8dDddsMa9RCbrX8JkF8OGjEsGUs2LmPaYhk93w VPmhiiZfC6TrLuqDzekWABIapHcKcH4mNIZz3qtkV+kmXWqcs+dMgaj5oLqbT1MSQtQetI 7TrtVyCCjA99tIHl88D9KXjjctMAOCc/uAhKDIeVASB9f0rlSe/U9oGlH/sV90TH7P8Aee wgm4NouOGSKOp8ry1HEt1Qr0zG3YM5DHGZdt1AuKIzUIQ1sKcnZBkHlhNnGl4j9/Fy+M3k sD9r6Ba2Nq+aL/7fgqijsSc9sMIhO0A+BZPfZmxXF4koH8NFjXKAwSA29cTy/Q== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hTGbY0h06z1BBx for ; Mon, 24 Aug 2026 16:30:01 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 22d1b by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 24 Aug 2026 16:30:01 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 01f6dff4ac58 - stable/15 - uma: Make an effort to defer reuse of items when KASAN is enabled List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 01f6dff4ac58d4e9573d0b698276bcbd9e2cd643 Auto-Submitted: auto-generated Date: Mon, 24 Aug 2026 16:30:01 +0000 Message-Id: <6a8c7189.22d1b.79e86870@gitrepo.freebsd.org> The branch stable/15 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=01f6dff4ac58d4e9573d0b698276bcbd9e2cd643 commit 01f6dff4ac58d4e9573d0b698276bcbd9e2cd643 Author: Mark Johnston AuthorDate: 2026-07-24 21:12:10 +0000 Commit: Mark Johnston CommitDate: 2026-08-24 15:17:55 +0000 uma: Make an effort to defer reuse of items when KASAN is enabled When KASAN is configured, make uma_zfree_arg() free items to the per-CPU free bucket, rather than to the alloc bucket. This means that the item won't be recycled immediately the next time a thread goes to allocate an item from that zone on the same CPU. In other words, the item will stay in a quarantine state longer, which helps make KASAN's use-after-free detection more reliable. Reviewed by: rlibby MFC after: 1 month Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D58269 (cherry picked from commit 990989c31b4637a23e64598a3d9929079bb9a8de) --- sys/vm/uma_core.c | 32 +++++++++++++++++++++++--------- 1 file changed, 23 insertions(+), 9 deletions(-) diff --git a/sys/vm/uma_core.c b/sys/vm/uma_core.c index f5500e507ccc..b3bf654d27e9 100644 --- a/sys/vm/uma_core.c +++ b/sys/vm/uma_core.c @@ -4461,8 +4461,11 @@ fail: return (NULL); } +/* + * Try to free an item to the per-CPU cache, promoting its quick reuse. + */ static __always_inline bool -cache_free_item(uma_zone_t zone, int uz_flags, void *item, void *udata) +cache_free_reuse(uma_zone_t zone, int uz_flags, void *item, void *udata) { uma_cache_t cache; int itemdomain; @@ -4518,8 +4521,14 @@ cache_free_item(uma_zone_t zone, int uz_flags, void *item, void *udata) return (false); } +/* + * Try to free an object to the per-CPU cache, deferring its reuse. This is + * used by the SMR-protected allocator, which cannot reuse the item until + * smr_poll() guarantees that no threads are still accessing it, and by + * sanitizers, which wish to defer reuse to make UAF detection more effective. + */ static __always_inline bool -cache_free_smr(uma_zone_t zone, void *item, void *udata) +cache_free_defer(uma_zone_t zone, void *item, void *udata) { uma_cache_t cache; int itemdomain; @@ -4538,7 +4547,6 @@ cache_free_smr(uma_zone_t zone, void *item, void *udata) uma_cache_bucket_t bucket; cache = &zone->uz_cpu[curcpu]; - /* SMR Zones must free to the free bucket. */ bucket = &cache->uc_freebucket; #ifdef NUMA if ((uz_flags & UMA_ZONE_FIRSTTOUCH) != 0 && @@ -4573,7 +4581,7 @@ uma_zfree_smr(uma_zone_t zone, void *item) return; #endif - if (cache_free_smr(zone, item, NULL)) + if (cache_free_defer(zone, item, NULL)) return; /* @@ -4621,16 +4629,22 @@ uma_zfree_arg(uma_zone_t zone, void *item, void *udata) * a little longer for the limits to be reset. */ if (__predict_false(uz_flags & UMA_ZFLAG_LIMIT) && - atomic_load_32(&zone->uz_sleepers) > 0) - goto zfree_item; - - if (cache_free_item(zone, uz_flags, item, udata)) + atomic_load_32(&zone->uz_sleepers) > 0) { + /* We will free directly to the zone. */ + } +#ifdef KASAN + else if ((uz_flags & UMA_ZONE_NOKASAN) == 0) { + if (cache_free_defer(zone, item, udata)) + return; + } +#endif + else if (cache_free_reuse(zone, uz_flags, item, udata)) { return; + } /* * If nothing else caught this, we'll just do an internal free. */ -zfree_item: zone_free_item(zone, item, udata, SKIP_DTOR); }