From nobody Fri Jul 24 22:36:25 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4h6NBf0cP1z6mrJx for ; Fri, 24 Jul 2026 22:36:26 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4h6NBd6FqVz3r3x for ; Fri, 24 Jul 2026 22:36:25 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1784932585; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=T/P6RhgtXBdKUnUXDYK+YV6nEBk4HphV/c+r6Dc4yuc=; b=l/mdUdXDE3+QPTzXyrNu/Fh4vdpMySIuBmr8Nw1odVbOw77XBT9dm12bJlvSzjUq9sEsWn +ijm4MvuEooYToMFqzEuImN0Jl5y+XvMXyco7iXi7bFbrxRkvkHlHDkEgwpws6RVDof+Lf sWceoJKGZGwMzL4O9mbNBD1mPYs/QogKwr2yJm2oiUpHwWWhFaBj9Vc+wC/3M2jMBoz6A0 IOp2XKcz5ioQdqCL7+rAT9zOADAkelnfqSjcy+GPt0JM0QEPzPUQ94xQDJ77d4fh7TiN3e wbIFa3jIdwP7WZYTe7eJz2T3pTDAq8eCibyJGrqQc5pTgP1m3JjEU1oooZG0Sg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1784932585; a=rsa-sha256; cv=none; b=bro+NAXZRaW4cHIc2XWaUR6XM2hPW3uSOtCt4qvB36RbUNbBBzb+2PW5XFss7WPD5imKp7 p5vEm8U+OZyQLcWPuFxDFHzHDwDk0SKdq0qACyzbU1Ocycd2gSDbbrhOPDiQQTWw7sLola w0KGztVB/3YQPeeJ/B8wapILZD6RmrZqd2xQuwNZkXLmrnatV79TF8TzejfaagqMpM0RbS qzGxy1ydXRmHYqiXZtBVonS3KCdNNpnh6JpWMHWFwSdWY9GPvnp4Qp4W+ZZKYjn/EjxVo3 OZQcV7bfbV9zRwWILMk7T8HiY0rFd2HDhLDdzAcRVwiEV1DGbJj81dcOkuGiHA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1784932585; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=T/P6RhgtXBdKUnUXDYK+YV6nEBk4HphV/c+r6Dc4yuc=; b=a2ocG//tEuNmzDIMYmLc7DCU9Vfykqlrt7tZuXHcrMoeGZzgUOWVN/+zdsX5OdZ/Bw/tMd tCNPV7HMwjEBiIEZTui/Hgr4j3q1xxhJMUJ+of5AFf0CThuoCv4JAqxA7lqXEtg0SBSqQJ R8B4PWQcuV590q9Hxek5gXgoX5AOq7kXqXrQi/v6kO98sEwi5VRj1JLsegBAiHE6BBW0rT RPhFAZZuwdsQEYnd7rETC0i4kg6YoYBsqFZqWbNtoX9CB3B/WBV3tzFyYY21RlPpR96+R2 J+IOlWGy0oqFJ4i8NiguRe3WL6SLDYbTPWE95IlKqSdW8y08KZ9pXCFuOOV4Xw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4h6NBd4cBZz19c6 for ; Fri, 24 Jul 2026 22:36:25 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 189b3 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Fri, 24 Jul 2026 22:36:25 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Mark Johnston Subject: git: 666eab3afc52 - main - uma: Avoid allocating from free buckets when KASAN is enabled List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 666eab3afc52bf20d57c24e98a6aa667433fb7c2 Auto-Submitted: auto-generated Date: Fri, 24 Jul 2026 22:36:25 +0000 Message-Id: <6a63e8e9.189b3.7fcf0923@gitrepo.freebsd.org> The branch main has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=666eab3afc52bf20d57c24e98a6aa667433fb7c2 commit 666eab3afc52bf20d57c24e98a6aa667433fb7c2 Author: Mark Johnston AuthorDate: 2026-07-24 21:12:21 +0000 Commit: Mark Johnston CommitDate: 2026-07-24 21:12:21 +0000 uma: Avoid allocating from free buckets when KASAN is enabled When uma_zalloc_arg() hits an empty alloc bucket in the per-CPU cache, it tries swapping the alloc and free buckets in the hope that the free bucket has some items available. If not, it has to lock the zone. Disable this behaviour when KASAN is configured in order to further defer reuse of freed items. This forces a free item to go to the per-domain full bucket cache before it becomes accessible to the allocator. Reviewed by: rlibby MFC after: 1 month Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D58270 --- sys/vm/uma_core.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/sys/vm/uma_core.c b/sys/vm/uma_core.c index fb72fafe9abc..e5f7d92a4f2a 100644 --- a/sys/vm/uma_core.c +++ b/sys/vm/uma_core.c @@ -3782,6 +3782,7 @@ static __noinline bool cache_alloc(uma_zone_t zone, uma_cache_t cache, void *udata, int flags) { uma_bucket_t bucket; + uint32_t zflags; int curdomain, domain; bool new; @@ -3791,10 +3792,15 @@ cache_alloc(uma_zone_t zone, uma_cache_t cache, void *udata, int flags) * If we have run out of items in our alloc bucket see * if we can switch with the free bucket. * - * SMR Zones can't re-use the free bucket until the sequence has - * expired. + * SMR zones can't re-use the free bucket until the sequence has + * expired. When KASAN is enabled, we want to avoid re-using free + * items in order to improve reliability of use-after-free detection. */ - if ((cache_uz_flags(cache) & UMA_ZONE_SMR) == 0 && + zflags = cache_uz_flags(cache); + if ((zflags & UMA_ZONE_SMR) == 0 && +#ifdef KASAN + (zflags & UMA_ZONE_NOKASAN) != 0 && +#endif cache->uc_freebucket.ucb_cnt != 0) { cache_bucket_swap(&cache->uc_freebucket, &cache->uc_allocbucket); @@ -3823,8 +3829,7 @@ cache_alloc(uma_zone_t zone, uma_cache_t cache, void *udata, int flags) * the critical section. */ domain = PCPU_GET(domain); - if ((cache_uz_flags(cache) & UMA_ZONE_ROUNDROBIN) != 0 || - VM_DOMAIN_EMPTY(domain)) + if ((zflags & UMA_ZONE_ROUNDROBIN) != 0 || VM_DOMAIN_EMPTY(domain)) domain = zone_domain_highest(zone, domain); bucket = cache_fetch_bucket(zone, cache, domain); if (bucket == NULL && zone->uz_bucket_size != 0 && !bucketdisable) { @@ -3849,7 +3854,7 @@ cache_alloc(uma_zone_t zone, uma_cache_t cache, void *udata, int flags) critical_enter(); cache = &zone->uz_cpu[curcpu]; if (cache->uc_allocbucket.ucb_bucket == NULL && - ((cache_uz_flags(cache) & UMA_ZONE_FIRSTTOUCH) == 0 || + ((zflags & UMA_ZONE_FIRSTTOUCH) == 0 || (curdomain = PCPU_GET(domain)) == domain || VM_DOMAIN_EMPTY(curdomain))) { if (new)