git: ea7d35526878 - main - uma: Fix KMSAN integration with malloc zones

The branch main has been updated by markj:

URL: https://cgit.FreeBSD.org/src/commit/?id=ea7d35526878ebf82f10080795e462d007485bf1

commit ea7d35526878ebf82f10080795e462d007485bf1
Author:     Mark Johnston <markj@FreeBSD.org>
AuthorDate: 2026-07-31 19:47:10 +0000
Commit:     Mark Johnston <markj@FreeBSD.org>
CommitDate: 2026-07-31 19:47:10 +0000

    uma: Fix KMSAN integration with malloc zones
    
    In commit 459aa032e872 I dropped kmsan_mark() calls from malloc() on the
    basis that UMA and kmem_malloc() would handle updates of the KMSAN
    shadow map.  However, I missed that UMA explicitly does not handle this.
    
    Modify UMA to only omit origin map updates for malloc zones.
    
    Fixes:          459aa032e872 ("malloc: Refactor redzone and sanitizer handling")
    Reviewed by:    rlibby
    Differential Revision:  https://reviews.freebsd.org/D58574
---
 sys/vm/uma_core.c | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/sys/vm/uma_core.c b/sys/vm/uma_core.c
index fefb90b497b0..cfb111d5bde8 100644
--- a/sys/vm/uma_core.c
+++ b/sys/vm/uma_core.c
@@ -635,8 +635,7 @@ kmsan_mark_item_uninitialized(uma_zone_t zone, void *item)
 	size_t sz;
 	int i;
 
-	if ((zone->uz_flags &
-	    (UMA_ZFLAG_CACHE | UMA_ZONE_SECONDARY | UMA_ZONE_MALLOC)) != 0) {
+	if ((zone->uz_flags & (UMA_ZFLAG_CACHE | UMA_ZONE_SECONDARY)) != 0) {
 		/*
 		 * Cache zones should not be instrumented by default, as UMA
 		 * does not have enough information to do so correctly.
@@ -645,9 +644,6 @@ kmsan_mark_item_uninitialized(uma_zone_t zone, void *item)
 		 *
 		 * Items from secondary zones are initialized by the parent
 		 * zone and thus cannot safely be marked by UMA.
-		 *
-		 * malloc zones are handled directly by malloc(9) and friends,
-		 * since they can provide more precise origin tracking.
 		 */
 		return;
 	}
@@ -662,7 +658,9 @@ kmsan_mark_item_uninitialized(uma_zone_t zone, void *item)
 
 	sz = zone->uz_size;
 	if ((zone->uz_flags & UMA_ZONE_PCPU) == 0) {
-		kmsan_orig(item, sz, KMSAN_TYPE_UMA, KMSAN_RET_ADDR);
+		/* malloc(9) updates the origin map itself. */
+		if ((zone->uz_flags & UMA_ZONE_MALLOC) == 0)
+			kmsan_orig(item, sz, KMSAN_TYPE_UMA, KMSAN_RET_ADDR);
 		kmsan_mark(item, sz, KMSAN_STATE_UNINIT);
 	} else {
 		pcpu_item = zpcpu_base_to_offset(item);