uma: Enqueue full buckets in FIFO order when KASAN is configured

We want to defer reuse of free objects, and this is a trivial way to
promote that.

Suggested by:	rlibby
Reviewed by:	rlibby, alc
MFC after:	1 month
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D58312

1 files changed, 9 insertions, 1 deletions

diff --git a/sys/vm/uma_core.c b/sys/vm/uma_core.c
index e5f7d92a4f2a..d4a98d0b8463 100644
--- a/sys/vm/uma_core.c
+++ b/sys/vm/uma_core.c
@@ -869,6 +869,8 @@ zone_put_bucket(uma_zone_t zone, int domain, uma_bucket_t bucket, void *udata,
 	 */
 	zdom->uzd_nitems += bucket->ub_cnt;
 	if (__predict_true(zdom->uzd_nitems < zone->uz_bucket_max)) {
+		bool head;
+
 		if (ws) {
 			zone_domain_imax_set(zdom, zdom->uzd_nitems);
 		} else {
@@ -887,8 +889,14 @@ zone_put_bucket(uma_zone_t zone, int domain, uma_bucket_t bucket, void *udata,
 		/*
 		 * Try to promote reuse of recently used items.  For items
 		 * protected by SMR, try to defer reuse to minimize polling.
+		 * If KASAN is configured, try to defer reuse to improve UAF
+		 * detection.
 		 */
-		if (bucket->ub_seq == SMR_SEQ_INVALID)
+		head = bucket->ub_seq == SMR_SEQ_INVALID;
+#ifdef KASAN
+		head = head && (zone->uz_flags & UMA_ZONE_NOKASAN) != 0;
+#endif
+		if (head)
 			STAILQ_INSERT_HEAD(&zdom->uzd_buckets, bucket, ub_link);
 		else
 			STAILQ_INSERT_TAIL(&zdom->uzd_buckets, bucket, ub_link);