From nobody Fri Jul 24 22:36:24 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4h6NBd0mgZz6mqrq for ; Fri, 24 Jul 2026 22:36:25 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4h6NBc5kFcz3rQ9 for ; Fri, 24 Jul 2026 22:36:24 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1784932584; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=HokieKV2Jbm2tCEc5vDUoKfv6e16Iw7r6uHogeeFZ+0=; b=X+tKqNKicNzNv3B+iCoz8KCae80ALKecKXr+55zO+dXrrvwxehGlp7sEfIxZIy7+RTX9Kk vdrLA+IwjtE5erGY4MS92Yfrw8V88rkdnaMSCiZWsXEoanhvZrTjBgHM2t0whUROrwXp4U kXcdb9sJR1UZUR+tanklLtB3gqmv99p16wCNAEQsOOMInUVNmF3/WA8E8eQzj9p8DrHsQP n8PYHKkLl4mlu2UkS3QNZDiqJtoNbE1dV0IdRt3VEA2XwXlZ6Az53+Pl3D5nm63dqKsNk9 BME6p5J1SKaGZHNOep/flf/UUwUOC3ofrQVawDETf12bMKO7/+Ml41XIAsuVEA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1784932584; a=rsa-sha256; cv=none; b=nnIpI6rsSVJZ+v2J9GqW/XJwvpbiKRxVuwE1QsTXy14fBr8lyWf5TATHstGS2aETbAVtvK TgER98AiMJLP6pRmYd32uCTbQj6wtNWvcBJ6dQgHofIFD7OH1svpj/IOTZDgFcTz/GWgdW ZTDI1J7EZqHb88Upjr6jaCvfJAIpKCIn+HiE27eomNyBcOJ01T4F7nNRK0zYDFUs9p6crC hnsNcaFQ3IyGm4T7sd43VrijRezVwwDa5DSJ63f3wew7USESQNHXYlDeC2T1vKuhPgLzF+ +Q0QPN9yrTg6561VG+Wjq8KHdNQra6LVhTtESkjIr5nJVVdxouVOh+qbgt5OpQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1784932584; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=HokieKV2Jbm2tCEc5vDUoKfv6e16Iw7r6uHogeeFZ+0=; b=Av0oaAwL5HYpZ42Rl18LeDXefpe/A9Pgq+5g/XApxoUdXtaHOoC1p4dJ3A6wFhZlm30skr LbGTWViMLEmK16W0fsnk4MCZuOKAA6ljzrondADtOBLQBLfWy4wtkyioBsjDRpfsMDMeqC DhK26NQ2/hn0q9ufAMqv5qJ4qU/67N80fZC8imaP3rgP0ja3/2pK06LEctnl//yxba8W1P VjgfIhCRCFXlIVaajX8Q18cJn7ihIO+qXDJekfXSDQw9NZmnUNS2//KMG67UcfoucuZrNh kxiLJbIVIrxCWH0TMVJ9ICRLqATj9ExaZZVQf99jp1IRqLKaXWjwq3QUp36F9Q== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4h6NBc3jLrz19TP for ; Fri, 24 Jul 2026 22:36:24 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 188be by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Fri, 24 Jul 2026 22:36:24 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Mark Johnston Subject: git: 990989c31b46 - main - uma: Make an effort to defer reuse of items when KASAN is enabled List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 990989c31b4637a23e64598a3d9929079bb9a8de Auto-Submitted: auto-generated Date: Fri, 24 Jul 2026 22:36:24 +0000 Message-Id: <6a63e8e8.188be.576e443f@gitrepo.freebsd.org> The branch main has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=990989c31b4637a23e64598a3d9929079bb9a8de commit 990989c31b4637a23e64598a3d9929079bb9a8de Author: Mark Johnston AuthorDate: 2026-07-24 21:12:10 +0000 Commit: Mark Johnston CommitDate: 2026-07-24 21:12:10 +0000 uma: Make an effort to defer reuse of items when KASAN is enabled When KASAN is configured, make uma_zfree_arg() free items to the per-CPU free bucket, rather than to the alloc bucket. This means that the item won't be recycled immediately the next time a thread goes to allocate an item from that zone on the same CPU. In other words, the item will stay in a quarantine state longer, which helps make KASAN's use-after-free detection more reliable. Reviewed by: rlibby MFC after: 1 month Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D58269 --- sys/vm/uma_core.c | 32 +++++++++++++++++++++++--------- 1 file changed, 23 insertions(+), 9 deletions(-) diff --git a/sys/vm/uma_core.c b/sys/vm/uma_core.c index 02b2df89f636..fb72fafe9abc 100644 --- a/sys/vm/uma_core.c +++ b/sys/vm/uma_core.c @@ -4447,8 +4447,11 @@ fail: return (NULL); } +/* + * Try to free an item to the per-CPU cache, promoting its quick reuse. + */ static __always_inline bool -cache_free_item(uma_zone_t zone, int uz_flags, void *item, void *udata) +cache_free_reuse(uma_zone_t zone, int uz_flags, void *item, void *udata) { uma_cache_t cache; int itemdomain; @@ -4504,8 +4507,14 @@ cache_free_item(uma_zone_t zone, int uz_flags, void *item, void *udata) return (false); } +/* + * Try to free an object to the per-CPU cache, deferring its reuse. This is + * used by the SMR-protected allocator, which cannot reuse the item until + * smr_poll() guarantees that no threads are still accessing it, and by + * sanitizers, which wish to defer reuse to make UAF detection more effective. + */ static __always_inline bool -cache_free_smr(uma_zone_t zone, void *item, void *udata) +cache_free_defer(uma_zone_t zone, void *item, void *udata) { uma_cache_t cache; int itemdomain; @@ -4524,7 +4533,6 @@ cache_free_smr(uma_zone_t zone, void *item, void *udata) uma_cache_bucket_t bucket; cache = &zone->uz_cpu[curcpu]; - /* SMR Zones must free to the free bucket. */ bucket = &cache->uc_freebucket; #ifdef NUMA if ((uz_flags & UMA_ZONE_FIRSTTOUCH) != 0 && @@ -4559,7 +4567,7 @@ uma_zfree_smr(uma_zone_t zone, void *item) return; #endif - if (cache_free_smr(zone, item, NULL)) + if (cache_free_defer(zone, item, NULL)) return; /* @@ -4607,16 +4615,22 @@ uma_zfree_arg(uma_zone_t zone, void *item, void *udata) * a little longer for the limits to be reset. */ if (__predict_false(uz_flags & UMA_ZFLAG_LIMIT) && - atomic_load_32(&zone->uz_sleepers) > 0) - goto zfree_item; - - if (cache_free_item(zone, uz_flags, item, udata)) + atomic_load_32(&zone->uz_sleepers) > 0) { + /* We will free directly to the zone. */ + } +#ifdef KASAN + else if ((uz_flags & UMA_ZONE_NOKASAN) == 0) { + if (cache_free_defer(zone, item, udata)) + return; + } +#endif + else if (cache_free_reuse(zone, uz_flags, item, udata)) { return; + } /* * If nothing else caught this, we'll just do an internal free. */ -zfree_item: zone_free_item(zone, item, udata, SKIP_DTOR); }