Re: [PATCH] mm/zsmalloc: copy KMSAN metadata in zs_page_migrate()

[Andrew Morton]

On Sat, 21 Mar 2026 22:29:11 +0900 Shigeru Yoshida <syoshida@xxxxxxxxxx> wrote:

> zs_page_migrate() uses copy_page() to copy the contents of a zspage
> page during migration. However, copy_page() is not instrumented by
> KMSAN, so the shadow and origin metadata of the destination page are
> not updated.
> 
> As a result, subsequent accesses to the migrated page are reported
> as use-after-free by KMSAN, despite the data being correctly copied.
> 
> Add a kmsan_copy_page_meta() call after copy_page() to propagate the
> KMSAN metadata to the new page, matching what copy_highpage() does
> internally.
> 
> Fixes: afb2d666d025 ("zsmalloc: use copy_page for full page copy")

That's three years old.  Can anyone suggest why this has only now been
discovered?

>
> ...
>
> --- a/mm/zsmalloc.c
> +++ b/mm/zsmalloc.c
> @@ -1741,6 +1741,7 @@ static int zs_page_migrate(struct page *newpage, struct page *page,
>  	 */
>  	d_addr = kmap_local_zpdesc(newzpdesc);
>  	copy_page(d_addr, s_addr);
> +	kmsan_copy_page_meta(zpdesc_page(newzpdesc), zpdesc_page(zpdesc));
>  	kunmap_local(d_addr);
>  
>  	for (addr = s_addr + offset; addr < s_addr + PAGE_SIZE;

I assume we'll want a cc:stable on this.