Page MenuHomeFreeBSD
Files F162810602

D58269.diff
No OneTemporary
Actions

D58269.diff
View Options

diff --git a/sys/vm/uma_core.c b/sys/vm/uma_core.c
--- a/sys/vm/uma_core.c
+++ b/sys/vm/uma_core.c
@@ -4447,20 +4447,15 @@
return (NULL);
}
+/*
+ * Try to free an item to the per-CPU cache, promoting its quick reuse.
+ */
static __always_inline bool
-cache_free_item(uma_zone_t zone, int uz_flags, void *item, void *udata)
+cache_free_reuse(uma_zone_t zone, int uz_flags, void *item, void *udata)
{
uma_cache_t cache;
int itemdomain;
- /*
- * The race here is acceptable. If we miss it we'll just have to wait
- * a little longer for the limits to be reset.
- */
- if (__predict_false(uz_flags & UMA_ZFLAG_LIMIT) &&
- atomic_load_32(&zone->uz_sleepers))
- return (false);
-
/*
* If possible, free to the per-CPU cache. There are two
* requirements for safe access to the per-CPU cache: (1) the thread
@@ -4512,8 +4507,14 @@
return (false);
}
+/*
+ * Try to free an object to the per-CPU cache, deferring its reuse. This is
+ * used by the SMR-protected allocator, which cannot reuse the item until
+ * smr_poll() guarantees that no threads are still accessing it, and by
+ * sanitizers, which wish to defer reuse to make UAF detection more effective.
+ */
static __always_inline bool
-cache_free_smr(uma_zone_t zone, void *item, void *udata)
+cache_free_defer(uma_zone_t zone, void *item, void *udata)
{
uma_cache_t cache;
int itemdomain;
@@ -4532,7 +4533,6 @@
uma_cache_bucket_t bucket;
cache = &zone->uz_cpu[curcpu];
- /* SMR Zones must free to the free bucket. */
bucket = &cache->uc_freebucket;
#ifdef NUMA
if ((uz_flags & UMA_ZONE_FIRSTTOUCH) != 0 &&
@@ -4567,7 +4567,7 @@
return;
#endif
- if (cache_free_smr(zone, item, NULL))
+ if (cache_free_defer(zone, item, NULL))
return;
/*
@@ -4611,7 +4611,21 @@
__predict_false((uz_flags & UMA_ZFLAG_CTORDTOR) != 0))
item_dtor(zone, item, cache_uz_size(cache), udata, SKIP_NONE);
- if (cache_free_item(zone, uz_flags, item, udata))
+ /*
+ * The race here is acceptable. If we miss it we'll just have to wait
+ * a little longer for the limits to be reset.
+ */
+ if (__predict_false(uz_flags & UMA_ZFLAG_LIMIT) &&
+ atomic_load_32(&zone->uz_sleepers))
+ /* We will free directly to the zone. */
+ ;
+#ifdef KASAN
+ else if ((zone->uz_flags & UMA_ZONE_NOKASAN) == 0) {
+ if (cache_free_defer(zone, item, udata))
+ return;
+ }
+#endif
+ else if (cache_free_reuse(zone, uz_flags, item, udata))
return;
/*

File Metadata

Mime Type
text/plain
Expires
Sat, Jul 18, 3:29 AM (6 h, 14 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
35148819
Default Alt Text
D58269.diff (2 KB)

Event Timeline