git: 6edbfb48fc1a - stable/15 - uma: Enqueue full buckets in FIFO order when KASAN is configured

The branch stable/15 has been updated by markj:

URL: https://cgit.FreeBSD.org/src/commit/?id=6edbfb48fc1ac02ef12b3ae9e0955ff317c286a3

commit 6edbfb48fc1ac02ef12b3ae9e0955ff317c286a3
Author:     Mark Johnston <markj@FreeBSD.org>
AuthorDate: 2026-07-24 21:12:33 +0000
Commit:     Mark Johnston <markj@FreeBSD.org>
CommitDate: 2026-08-24 15:17:55 +0000

    uma: Enqueue full buckets in FIFO order when KASAN is configured
    
    We want to defer reuse of free objects, and this is a trivial way to
    promote that.
    
    Suggested by:   rlibby
    Reviewed by:    rlibby, alc
    MFC after:      1 month
    Sponsored by:   The FreeBSD Foundation
    Differential Revision:  https://reviews.freebsd.org/D58312
    
    (cherry picked from commit 492cfbe9e2f831fff290e019dae66345146978bd)
---
 sys/vm/uma_core.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/sys/vm/uma_core.c b/sys/vm/uma_core.c
index e5bbb63776e8..30d1c1d1ac79 100644
--- a/sys/vm/uma_core.c
+++ b/sys/vm/uma_core.c
@@ -864,6 +864,8 @@ zone_put_bucket(uma_zone_t zone, int domain, uma_bucket_t bucket, void *udata,
 	 */
 	zdom->uzd_nitems += bucket->ub_cnt;
 	if (__predict_true(zdom->uzd_nitems < zone->uz_bucket_max)) {
+		bool head;
+
 		if (ws) {
 			zone_domain_imax_set(zdom, zdom->uzd_nitems);
 		} else {
@@ -882,8 +884,14 @@ zone_put_bucket(uma_zone_t zone, int domain, uma_bucket_t bucket, void *udata,
 		/*
 		 * Try to promote reuse of recently used items.  For items
 		 * protected by SMR, try to defer reuse to minimize polling.
+		 * If KASAN is configured, try to defer reuse to improve UAF
+		 * detection.
 		 */
-		if (bucket->ub_seq == SMR_SEQ_INVALID)
+		head = bucket->ub_seq == SMR_SEQ_INVALID;
+#ifdef KASAN
+		head = head && (zone->uz_flags & UMA_ZONE_NOKASAN) != 0;
+#endif
+		if (head)
 			STAILQ_INSERT_HEAD(&zdom->uzd_buckets, bucket, ub_link);
 		else
 			STAILQ_INSERT_TAIL(&zdom->uzd_buckets, bucket, ub_link);