From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4C18919C566 for ; Sat, 21 Mar 2026 17:48:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774115326; cv=none; b=hxUb9/Wgl+mTzKuXsbyDdha+hCzJZPlRczgZg1bZ+8w4cP4zvmI5rnh94oe6bm0GMcqWwypWE8f7Eh4lT7Sx2tncUGe8aM3Ae2KokuCOJ6xMmq9Cxsys+UAaZFqxrpCP26Yzzx0GT5jDvaOssr0/SZkFXpNDcW1TWojE5Z98tTM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774115326; c=relaxed/simple; bh=Qn4P7Wc4x9kE+8cjSdoyrRePaM836rZYOOkl0UskwA8=; h=Date:From:To:Cc:Subject:Message-Id:In-Reply-To:References: Mime-Version:Content-Type; b=eM3A5zPvAJyC5fReTsBo1tu0Df0/hAnHCQjtJuf0mED5SV6SN1ncugb/Z7ocLjoJerYUTypUn8fU3S3WaWvZC4lhSRQmRzj7gJTP/sS/2VVbST7finnWITMN1Qwe9jea4srHVakA3f35swNm+qreNuzWoZFyu853ttZazB823bE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux-foundation.org header.i=@linux-foundation.org header.b=Sx6HnV4i; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux-foundation.org header.i=@linux-foundation.org header.b="Sx6HnV4i" Received: by smtp.kernel.org (Postfix) with ESMTPSA id D067BC19421; Sat, 21 Mar 2026 17:48:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linux-foundation.org; s=korg; t=1774115326; bh=Qn4P7Wc4x9kE+8cjSdoyrRePaM836rZYOOkl0UskwA8=; h=Date:From:To:Cc:Subject:In-Reply-To:References:From; b=Sx6HnV4ikhL/5tAaZfzi6fJisvDZEYEM5Rrzj6ruCxcBze/Pc+Wi4CFBK+cBCy3Dk /Vamp1P92kLM0RtY0+xRv4W7fZpWQ7bpQwG433W1oIykfKFVeBjAxnoQx3guPYIzI8 0OC910ouGJjPsbhuSVs39aStHV3ESa1nNtykqlaA= Date: Sat, 21 Mar 2026 10:48:45 -0700 From: Andrew Morton To: Shigeru Yoshida Cc: Minchan Kim , Sergey Senozhatsky , Mark-PK Tsai , linux-mm@kvack.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH] mm/zsmalloc: copy KMSAN metadata in zs_page_migrate() Message-Id: <20260321104845.452d0f903a52d45d3b76894e@linux-foundation.org> In-Reply-To: <20260321132912.93434-1-syoshida@redhat.com> References: <20260321132912.93434-1-syoshida@redhat.com> X-Mailer: Sylpheed 3.8.0beta1 (GTK+ 2.24.33; x86_64-pc-linux-gnu) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit On Sat, 21 Mar 2026 22:29:11 +0900 Shigeru Yoshida wrote: > zs_page_migrate() uses copy_page() to copy the contents of a zspage > page during migration. However, copy_page() is not instrumented by > KMSAN, so the shadow and origin metadata of the destination page are > not updated. > > As a result, subsequent accesses to the migrated page are reported > as use-after-free by KMSAN, despite the data being correctly copied. > > Add a kmsan_copy_page_meta() call after copy_page() to propagate the > KMSAN metadata to the new page, matching what copy_highpage() does > internally. > > Fixes: afb2d666d025 ("zsmalloc: use copy_page for full page copy") That's three years old. Can anyone suggest why this has only now been discovered? > > ... > > --- a/mm/zsmalloc.c > +++ b/mm/zsmalloc.c > @@ -1741,6 +1741,7 @@ static int zs_page_migrate(struct page *newpage, struct page *page, > */ > d_addr = kmap_local_zpdesc(newzpdesc); > copy_page(d_addr, s_addr); > + kmsan_copy_page_meta(zpdesc_page(newzpdesc), zpdesc_page(zpdesc)); > kunmap_local(d_addr); > > for (addr = s_addr + offset; addr < s_addr + PAGE_SIZE; I assume we'll want a cc:stable on this.