From nobody Mon Aug 24 16:30:02 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hTGbZ4ZF7z6pbKN for ; Mon, 24 Aug 2026 16:30:02 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hTGbZ21HGz41XW for ; Mon, 24 Aug 2026 16:30:02 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1787589002; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=G1w0XXx8Ayniv8jP/uFvbn4R6AXzibyXeDWiU+506/I=; b=RyCwJ/zQwy6Pk8R7qx/qVWYEB6YjumRqZ4VJpvbhgiX+T/LNEpKZjGFjguxt27TxhGNihn 42XJO8ipzeh1XUNPx8YDteB4DMWlSs8CAYeGZwbLqPEZLrMYEIItrUQs5KK0x4uPMscNSb BIRLznhkm8ghfudURPEel0yK8uwGgcx4zTWff6h7JLFiERmDU7NhWEeIDgjvqHdby3pfR/ 4xsiH4q4+dpgFvQBxRRICGBKcMdm7gJNRsmCN9Q2c/x1yw5oMlkQ6w7Jt9g1chayXYtu69 kWu6GvDUqqjYCZsHk0ju0WAbS82hmNOIOvCwKv6jaH0kD1hgl1RpBnVEpvMOpQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1787589002; a=rsa-sha256; cv=none; b=FGsCmQ/yCM07TR4V7oq4qbquW6n1Iw1XNQUrtMXlF7o0nh8xeV4izEvK3TeVQyvptg/9p5 eAlwYFOpkhVDTGU/4de9+wVyjtdV4EQTB0e+gQ0EAdzgyOH8yNmdZAbI0OAidw85rtcdfn 2JqNztCqTqcMRM2mjUcgrP5gpvmXGRarA2JyThm0LcClFvBf8WTbrVC/K/DHyll5BQYars vdGthQx1R5y9J7K/PiP8Xl8eRrDTWqDDpUPg60sdwxFR+94QOXfW/DQil+jD8vzCK4fmgI lzEaJ3W8uQMWzdG4MT7m0UBhXS9EfaTdSmaYtVxcPpS6XEdf+lpLhlNoF+exRg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1787589002; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=G1w0XXx8Ayniv8jP/uFvbn4R6AXzibyXeDWiU+506/I=; b=EqZ1Bg9/nptX/GqGYQ0NdZQjpBtWTJvn+v10jC3hFtnR12yfRl/aILP3/WGe7hVkQZgLai 2nZ8RV0g5LCDmdXMbFrHtKAwiRXCpFerPZ/bwe2cZaMRuBGa5xW8bD9BuJ51/lU7CCmfN1 6G0f5eL48RX3gdMn+lHyewgRieqQ791D4jRTVPze1EuBQwepoKKqTtJi/hO8O5vXYwZeA7 9ow7DHkf+iP932jcx61kLE4euE5YOoTgFD6hTpR0PEeZ0lrLlHxw+nd8b/teLR2SGx6y9M oXI8MC9y7oIAslgUzhtQbmuxHqO1IRFIYFEKF3n2IGnKwaE+oTX0mO4/St3xsQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hTGbZ14flz1Bcg for ; Mon, 24 Aug 2026 16:30:02 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 2237e by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 24 Aug 2026 16:30:02 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 646a9f2a13ef - stable/15 - uma: Avoid allocating from free buckets when KASAN is enabled List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 646a9f2a13ef5e11d0033207edcacce14d496bab Auto-Submitted: auto-generated Date: Mon, 24 Aug 2026 16:30:02 +0000 Message-Id: <6a8c718a.2237e.66d58560@gitrepo.freebsd.org> The branch stable/15 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=646a9f2a13ef5e11d0033207edcacce14d496bab commit 646a9f2a13ef5e11d0033207edcacce14d496bab Author: Mark Johnston AuthorDate: 2026-07-24 21:12:21 +0000 Commit: Mark Johnston CommitDate: 2026-08-24 15:17:55 +0000 uma: Avoid allocating from free buckets when KASAN is enabled When uma_zalloc_arg() hits an empty alloc bucket in the per-CPU cache, it tries swapping the alloc and free buckets in the hope that the free bucket has some items available. If not, it has to lock the zone. Disable this behaviour when KASAN is configured in order to further defer reuse of freed items. This forces a free item to go to the per-domain full bucket cache before it becomes accessible to the allocator. Reviewed by: rlibby MFC after: 1 month Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D58270 (cherry picked from commit 666eab3afc52bf20d57c24e98a6aa667433fb7c2) --- sys/vm/uma_core.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/sys/vm/uma_core.c b/sys/vm/uma_core.c index b3bf654d27e9..e5bbb63776e8 100644 --- a/sys/vm/uma_core.c +++ b/sys/vm/uma_core.c @@ -3796,6 +3796,7 @@ static __noinline bool cache_alloc(uma_zone_t zone, uma_cache_t cache, void *udata, int flags) { uma_bucket_t bucket; + uint32_t zflags; int curdomain, domain; bool new; @@ -3805,10 +3806,15 @@ cache_alloc(uma_zone_t zone, uma_cache_t cache, void *udata, int flags) * If we have run out of items in our alloc bucket see * if we can switch with the free bucket. * - * SMR Zones can't re-use the free bucket until the sequence has - * expired. + * SMR zones can't re-use the free bucket until the sequence has + * expired. When KASAN is enabled, we want to avoid re-using free + * items in order to improve reliability of use-after-free detection. */ - if ((cache_uz_flags(cache) & UMA_ZONE_SMR) == 0 && + zflags = cache_uz_flags(cache); + if ((zflags & UMA_ZONE_SMR) == 0 && +#ifdef KASAN + (zflags & UMA_ZONE_NOKASAN) != 0 && +#endif cache->uc_freebucket.ucb_cnt != 0) { cache_bucket_swap(&cache->uc_freebucket, &cache->uc_allocbucket); @@ -3837,8 +3843,7 @@ cache_alloc(uma_zone_t zone, uma_cache_t cache, void *udata, int flags) * the critical section. */ domain = PCPU_GET(domain); - if ((cache_uz_flags(cache) & UMA_ZONE_ROUNDROBIN) != 0 || - VM_DOMAIN_EMPTY(domain)) + if ((zflags & UMA_ZONE_ROUNDROBIN) != 0 || VM_DOMAIN_EMPTY(domain)) domain = zone_domain_highest(zone, domain); bucket = cache_fetch_bucket(zone, cache, domain); if (bucket == NULL && zone->uz_bucket_size != 0 && !bucketdisable) { @@ -3863,7 +3868,7 @@ cache_alloc(uma_zone_t zone, uma_cache_t cache, void *udata, int flags) critical_enter(); cache = &zone->uz_cpu[curcpu]; if (cache->uc_allocbucket.ucb_bucket == NULL && - ((cache_uz_flags(cache) & UMA_ZONE_FIRSTTOUCH) == 0 || + ((zflags & UMA_ZONE_FIRSTTOUCH) == 0 || (curdomain = PCPU_GET(domain)) == domain || VM_DOMAIN_EMPTY(curdomain))) { if (new)