zs_page_migrate() uses copy_page() to copy the contents of a zspage
page during migration. However, copy_page() is not instrumented by
KMSAN, so the shadow and origin metadata of the destination page are
not updated.

As a result, subsequent accesses to the migrated page are reported
as use-after-free by KMSAN, despite the data being correctly copied.

Add a kmsan_copy_page_meta() call after copy_page() to propagate the
KMSAN metadata to the new page, matching what copy_highpage() does
internally.

Fixes: afb2d666d025 ("zsmalloc: use copy_page for full page copy")
Signed-off-by: Shigeru Yoshida <syoshida@redhat.com>
---
 mm/zsmalloc.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/mm/zsmalloc.c b/mm/zsmalloc.c
index 2c1430bf8d57..79ef9d57f2e1 100644
--- a/mm/zsmalloc.c
+++ b/mm/zsmalloc.c
@@ -1741,6 +1741,7 @@ static int zs_page_migrate(struct page *newpage, struct page *page,
 	 */
 	d_addr = kmap_local_zpdesc(newzpdesc);
 	copy_page(d_addr, s_addr);
+	kmsan_copy_page_meta(zpdesc_page(newzpdesc), zpdesc_page(zpdesc));
 	kunmap_local(d_addr);
 
 	for (addr = s_addr + offset; addr < s_addr + PAGE_SIZE;
-- 
2.52.0

On Sat, 21 Mar 2026 22:29:11 +0900 Shigeru Yoshida <syoshida@redhat.com> wrote:

> zs_page_migrate() uses copy_page() to copy the contents of a zspage
> page during migration. However, copy_page() is not instrumented by
> KMSAN, so the shadow and origin metadata of the destination page are
> not updated.
> 
> As a result, subsequent accesses to the migrated page are reported
> as use-after-free by KMSAN, despite the data being correctly copied.
> 
> Add a kmsan_copy_page_meta() call after copy_page() to propagate the
> KMSAN metadata to the new page, matching what copy_highpage() does
> internally.
> 
> Fixes: afb2d666d025 ("zsmalloc: use copy_page for full page copy")

That's three years old.  Can anyone suggest why this has only now been
discovered?

>
> ...
>
> --- a/mm/zsmalloc.c
> +++ b/mm/zsmalloc.c
> @@ -1741,6 +1741,7 @@ static int zs_page_migrate(struct page *newpage, struct page *page,
>  	 */
>  	d_addr = kmap_local_zpdesc(newzpdesc);
>  	copy_page(d_addr, s_addr);
> +	kmsan_copy_page_meta(zpdesc_page(newzpdesc), zpdesc_page(zpdesc));
>  	kunmap_local(d_addr);
>  
>  	for (addr = s_addr + offset; addr < s_addr + PAGE_SIZE;

I assume we'll want a cc:stable on this.

Andrew Morton <akpm@linux-foundation.org> writes:

> On Sat, 21 Mar 2026 22:29:11 +0900 Shigeru Yoshida <syoshida@redhat.com> wrote:
>
>> zs_page_migrate() uses copy_page() to copy the contents of a zspage
>> page during migration. However, copy_page() is not instrumented by
>> KMSAN, so the shadow and origin metadata of the destination page are
>> not updated.
>> 
>> As a result, subsequent accesses to the migrated page are reported
>> as use-after-free by KMSAN, despite the data being correctly copied.
>> 
>> Add a kmsan_copy_page_meta() call after copy_page() to propagate the
>> KMSAN metadata to the new page, matching what copy_highpage() does
>> internally.
>> 
>> Fixes: afb2d666d025 ("zsmalloc: use copy_page for full page copy")
>
> That's three years old.  Can anyone suggest why this has only now been
> discovered?

I think it's because KMSAN is clang and x86-64-only, so very few people
run it. Also, this only triggers when compaction actually migrates a
zspage page, which needs significant memory pressure.

Shigeru