Page MenuHomeFreeBSD

D58312.diff
No OneTemporary

D58312.diff

diff --git a/sys/vm/uma_core.c b/sys/vm/uma_core.c
--- a/sys/vm/uma_core.c
+++ b/sys/vm/uma_core.c
@@ -869,6 +869,8 @@
*/
zdom->uzd_nitems += bucket->ub_cnt;
if (__predict_true(zdom->uzd_nitems < zone->uz_bucket_max)) {
+ bool head;
+
if (ws) {
zone_domain_imax_set(zdom, zdom->uzd_nitems);
} else {
@@ -887,8 +889,14 @@
/*
* Try to promote reuse of recently used items. For items
* protected by SMR, try to defer reuse to minimize polling.
+ * If KASAN is configured, try to defer reuse to improve UAF
+ * detection.
*/
- if (bucket->ub_seq == SMR_SEQ_INVALID)
+ head = bucket->ub_seq == SMR_SEQ_INVALID;
+#ifdef KASAN
+ head = head && (zone->uz_flags & UMA_ZONE_NOKASAN) != 0;
+#endif
+ if (head)
STAILQ_INSERT_HEAD(&zdom->uzd_buckets, bucket, ub_link);
else
STAILQ_INSERT_TAIL(&zdom->uzd_buckets, bucket, ub_link);

File Metadata

Mime Type
text/plain
Expires
Wed, Jul 22, 8:46 PM (16 h, 39 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
35203753
Default Alt Text
D58312.diff (872 B)

Event Timeline