objcache_destroy() purges remote CPUs' per-cpu magazines under only a local critical section — no cross-CPU exclusion (contract-reliant teardown; KKASSERT panic / magazine UAF if any in-flight get/put exists)

Summary

percpu_objcache is documented as "protected by crit_enter()" on ITS OWN cpu, yet objcache_destroy() iterates ALL cpus and calls mag_purge(freeit=TRUE) on each cpucache's magazines with only a crit_enter() on the DESTROYER's cpu — zero protection against a get/put in flight on the remote cpu. mag_purge's "mag ripped out" defense is neutralized for freeit=TRUE: the KKASSERT panics INVARIANTS kernels, and on stock kernels *magp=NULL + kfree(mag) leaves cpucache->previous_magazine pointing at freed memory → magazine UAF on the next get/put. In-tree destroy callers audited all quiesce via module refcounts/mount locks first — speculative/defense-in-depth; if any future caller races: panic or magazine UAF.

Recommended fix

Quiesce remote CPUs before purging their magazines (IPI-run the mag_purge pair on the owning cpu), or add an explicit per-cache dying flag checked under crit in get/put that diverts to the depot/free path once teardown begins.

Timeline

• 2026-08-31 Discovered during pass-2 audit of kern_objcache.c (GLM 5.3).