The branch main has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=492cfbe9e2f831fff290e019dae66345146978bd
commit 492cfbe9e2f831fff290e019dae66345146978bd Author: Mark Johnston <[email protected]> AuthorDate: 2026-07-24 21:12:33 +0000 Commit: Mark Johnston <[email protected]> CommitDate: 2026-07-24 21:18:49 +0000 uma: Enqueue full buckets in FIFO order when KASAN is configured We want to defer reuse of free objects, and this is a trivial way to promote that. Suggested by: rlibby Reviewed by: rlibby, alc MFC after: 1 month Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D58312 --- sys/vm/uma_core.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/sys/vm/uma_core.c b/sys/vm/uma_core.c index e5f7d92a4f2a..d4a98d0b8463 100644 --- a/sys/vm/uma_core.c +++ b/sys/vm/uma_core.c @@ -869,6 +869,8 @@ zone_put_bucket(uma_zone_t zone, int domain, uma_bucket_t bucket, void *udata, */ zdom->uzd_nitems += bucket->ub_cnt; if (__predict_true(zdom->uzd_nitems < zone->uz_bucket_max)) { + bool head; + if (ws) { zone_domain_imax_set(zdom, zdom->uzd_nitems); } else { @@ -887,8 +889,14 @@ zone_put_bucket(uma_zone_t zone, int domain, uma_bucket_t bucket, void *udata, /* * Try to promote reuse of recently used items. For items * protected by SMR, try to defer reuse to minimize polling. + * If KASAN is configured, try to defer reuse to improve UAF + * detection. */ - if (bucket->ub_seq == SMR_SEQ_INVALID) + head = bucket->ub_seq == SMR_SEQ_INVALID; +#ifdef KASAN + head = head && (zone->uz_flags & UMA_ZONE_NOKASAN) != 0; +#endif + if (head) STAILQ_INSERT_HEAD(&zdom->uzd_buckets, bucket, ub_link); else STAILQ_INSERT_TAIL(&zdom->uzd_buckets, bucket, ub_link);
