From nobody Fri Jul 31 13:29:23 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hBRkK047mz6mnj0 for ; Fri, 31 Jul 2026 13:29:28 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hBRkJ4xgbz3SgP for ; Fri, 31 Jul 2026 13:29:28 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1785504568; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=pzG3zqCOPeAvyuEpuwztBMovGrk+2G4BzPP2Lba9FJY=; b=T8IBIkthXpU3qPFKk6F/GUm/h8JssmxJVz4sNT0eGnQnEe2OFdz/EJyG8DOWltPMrMz4+V WPgMVbe6ndfoGwJR3REgE6yddu8QJ1sVP9ffpXQ2zv64dYyuyzTiFv/zF9Vz3bFKHqKWDm BPyRNSwmEiqS12AxVr3aD+x7HZH6MLKbxkxPpn3qRW8AH9WEwPmh7Juu5GoZo9BVxC7uSm uneO9WWOFka9m5RV9MfC0Hm7wTOwXKtjtY73Auf2tX5b+RPb5slyPPZSxraa5tA0YTHGj+ IC5dS3n3Sm9FtuFV9oaxVpLEktAUsWc6CuO+iRCqZnfJFw/E56ubz2QPcEzKeA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1785504568; a=rsa-sha256; cv=none; b=ul1HZxnqH68GwVFR8kDWXjO2Rwo3AlsXRpLb1bKu4trmbM7sw+jbW0QwHOJFcmg+p6L6FX oQQ11X6M2ZVDEikP9wR7ZszGhB2qESkwoV8dykxbaggfZlca+sukvc1VWn3wXI3DNjCpWi oqX1YMWiVqETU33HqI5Oq8eqLsSaK9OMlcliu+B9TgJrWdkEY/WM/Yb17fSr9icfQMPOfi Nfw8jHiwALEHSnjxV3dzUIiC0tVBrEf1Nn3X8PQvERKadUURpHmZM3RHQjL+z0LDd+2+o9 rf5spOoLSDVBnXqSa23s7fy1EjsG8sbuRR7u7Ip5h1n3Q+9Vx3aX1/gt4u7i7A== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1785504568; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=pzG3zqCOPeAvyuEpuwztBMovGrk+2G4BzPP2Lba9FJY=; b=mhh+mRvMHYHYaCYJuonf8TARMzEWrtwhNoQO/Am1dpsBi8XKwt9gVYiNgXUJjYWw6iZSgf XKLGww0F9ThZ47whr576fvP7FGiSJEyw/1S4My+a3fWyB806EJxnu+uvcPfraGn4883WIk DsGgbfst2CJ5UXqs+jrv0OXZPCBTD2GXmX3GYq7u37WbyZxamDpY3gw9Ksb5HsVzzGA1HT vMMTa6zGeqZg2PgHZuMTSltSHLboTeWTwH2QAj+3R7TTiFfDMxKxljBRhZLf+6d+FBWraX kjUJYwO8jYpzf3t0qV9Cxy2q5Ubg7zfZI/StBO8/77C8zDjlAbuQP+pKGbn2Xw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hBRkJ3pPnz11lr for ; Fri, 31 Jul 2026 13:29:28 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 18c68 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Fri, 31 Jul 2026 13:29:23 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Mark Johnston Subject: git: f51a5e1d9c41 - main - uma: Insert KASAN redzones after slab-allocated items List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: f51a5e1d9c415d97b86f0f2c8da9cc9ad9dc683b Auto-Submitted: auto-generated Date: Fri, 31 Jul 2026 13:29:23 +0000 Message-Id: <6a6ca333.18c68.7ef35e24@gitrepo.freebsd.org> The branch main has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=f51a5e1d9c415d97b86f0f2c8da9cc9ad9dc683b commit f51a5e1d9c415d97b86f0f2c8da9cc9ad9dc683b Author: Mark Johnston AuthorDate: 2026-07-31 12:55:48 +0000 Commit: Mark Johnston CommitDate: 2026-07-31 12:55:48 +0000 uma: Insert KASAN redzones after slab-allocated items Without this, KASAN has the deficiency that inter-object overflows are not detected most of the time[*] when keg_layout() is able to perfectly pack a slab. Try to overcome this by adjusting the allocation size to include a redzone following the object. With this change, we automatically get a redzone following each item, so any overflow into the redzone will trigger a panic. Most of UMA doesn't need to know about this: at slab allocation time, the whole slab is poisoned, and then kasan_mark_item_valid() will unpoison only the buffer that is available to the consumer. Note that in most zones, most objects will follow another object's redzone, so there is some protection against underflow as well. It might be worthwhile to provide a stronger guarantee here. Add an assertion to item_ctor() that the returned item is properly aligned. I couldn't see any pre-existing checks which verify this. Reviewed by: rlibby MFC after: 2 weeks Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D58271 --- sys/vm/uma_core.c | 60 ++++++++++++++++++++++++++++++++++--------------------- 1 file changed, 37 insertions(+), 23 deletions(-) diff --git a/sys/vm/uma_core.c b/sys/vm/uma_core.c index d4a98d0b8463..fefb90b497b0 100644 --- a/sys/vm/uma_core.c +++ b/sys/vm/uma_core.c @@ -538,9 +538,6 @@ bucket_zone_drain(int domain) } #ifdef KASAN -_Static_assert(UMA_SMALLEST_UNIT % KASAN_SHADOW_SCALE == 0, - "Base UMA allocation size not a multiple of the KASAN scale factor"); - static void kasan_mark_item_valid(uma_zone_t zone, void *item) { @@ -605,7 +602,7 @@ kasan_mark_slab_invalid(uma_keg_t keg, void *mem) sz = keg->uk_ppera * PAGE_SIZE; else sz = keg->uk_pgoff; - kasan_mark(mem, 0, sz, KASAN_UMA_FREED); + kasan_mark(mem, 0, sz, KASAN_GENERIC_REDZONE); } } #else /* !KASAN */ @@ -2261,8 +2258,8 @@ struct keg_layout_result { }; static void -keg_layout_one(uma_keg_t keg, u_int rsize, u_int slabsize, u_int fmt, - struct keg_layout_result *kl) +keg_layout_one(uma_keg_t keg, u_int size, u_int rsize, u_int slabsize, + u_int fmt, struct keg_layout_result *kl) { u_int total; @@ -2275,7 +2272,7 @@ keg_layout_one(uma_keg_t keg, u_int rsize, u_int slabsize, u_int fmt, kl->slabsize += PAGE_SIZE; } - kl->ipers = slab_ipers_hdr(keg->uk_size, rsize, kl->slabsize, + kl->ipers = slab_ipers_hdr(size, rsize, kl->slabsize, (fmt & UMA_ZFLAG_OFFPAGE) == 0); /* Account for memory used by an offpage slab header. */ @@ -2304,7 +2301,7 @@ keg_layout(uma_keg_t keg) u_int alignsize; u_int nfmt; u_int pages; - u_int rsize; + u_int size, rsize; u_int slabsize; u_int i, j; @@ -2320,21 +2317,33 @@ keg_layout(uma_keg_t keg) PRINT_UMA_ZFLAGS)); alignsize = keg->uk_align + 1; -#ifdef KASAN + /* - * ASAN requires that each allocation be aligned to the shadow map - * scale factor. + * Calculate the size of each allocation. uk_size is the originally + * requested item size that the consumer expects to use. "size" is the + * requested size after adjusting for an optional redzone after each + * item (currently used only by KASAN). rsize is the final size between + * item start addresses after adjusting for alignment and minimum + * allocation size requirements. + * + * The padding given by the difference rsize - size may not be present + * for the last item in a slab. */ - if (alignsize < KASAN_SHADOW_SCALE) - alignsize = KASAN_SHADOW_SCALE; + size = keg->uk_size; + +#ifdef KASAN + if ((keg->uk_flags & UMA_ZONE_NOKASAN) == 0) { + /* + * kasan_mark() requires that each allocation be aligned to the + * shadow map scale factor. + */ + if (alignsize < KASAN_SHADOW_SCALE) + alignsize = KASAN_SHADOW_SCALE; + size += KASAN_SHADOW_SCALE; + } #endif - /* - * Calculate the size of each allocation (rsize) according to - * alignment. If the requested size is smaller than we have - * allocation bits for we round it up. - */ - rsize = MAX(keg->uk_size, UMA_SMALLEST_UNIT); + rsize = MAX(size, UMA_SMALLEST_UNIT); rsize = roundup2(rsize, alignsize); if ((keg->uk_flags & UMA_ZONE_CACHESPREAD) != 0) { @@ -2356,7 +2365,7 @@ keg_layout(uma_keg_t keg) * represent a single item. We will try to fit as many * additional items into the slab as possible. */ - slabsize = round_page(keg->uk_size); + slabsize = round_page(size); } /* Build a list of all of the available formats for this keg. */ @@ -2393,13 +2402,13 @@ keg_layout(uma_keg_t keg) * for small items (up to PAGE_SIZE), the iteration increment is one * page; and for large items, the increment is one item. */ - i = (slabsize + rsize - keg->uk_size) / MAX(PAGE_SIZE, rsize); + i = (slabsize + rsize - size) / MAX(PAGE_SIZE, rsize); KASSERT(i >= 1, ("keg %s(%p) flags=0x%b slabsize=%u, rsize=%u, i=%u", keg->uk_name, keg, keg->uk_flags, PRINT_UMA_ZFLAGS, slabsize, rsize, i)); for ( ; ; i++) { slabsize = (rsize <= PAGE_SIZE) ? ptoa(i) : - round_page(rsize * (i - 1) + keg->uk_size); + round_page(rsize * (i - 1) + size); for (j = 0; j < nfmt; j++) { /* Only if we have no viable format yet. */ @@ -2407,7 +2416,8 @@ keg_layout(uma_keg_t keg) kl.ipers > 0) continue; - keg_layout_one(keg, rsize, slabsize, fmts[j], &kl_tmp); + keg_layout_one(keg, size, rsize, slabsize, fmts[j], + &kl_tmp); if (kl_tmp.eff <= kl.eff) continue; @@ -3500,6 +3510,10 @@ item_ctor(uma_zone_t zone, int uz_flags, int size, void *udata, int flags, bool skipdbg; #endif + KASSERT(zone->uz_keg == NULL || + ((uintptr_t)item & zone->uz_keg->uk_align) == 0, + ("item_ctor: underaligned item %p from %s", item, zone->uz_name)); + kasan_mark_item_valid(zone, item); kmsan_mark_item_uninitialized(zone, item);