Index: share/man/man9/malloc.9
===================================================================
--- share/man/man9/malloc.9
+++ share/man/man9/malloc.9
@@ -29,7 +29,7 @@
 .\" $NetBSD: malloc.9,v 1.3 1996/11/11 00:05:11 lukem Exp $
 .\" $FreeBSD$
 .\"
-.Dd January 16, 2014
+.Dd November 17, 2015
 .Dt MALLOC 9
 .Os
 .Sh NAME
@@ -223,10 +223,19 @@
 .Fn realloc
 and
 .Fn reallocf
-may sleep when called with
+may sleep for an unbounded period of time when called with
 .Dv M_WAITOK .
 .Fn free
-never sleeps.
+will not sleep for an unbounded period of time.
+.Pp
+.Fn malloc ,
+.Fn realloc,
+.Fn reallocf
+and
+.Fn free
+may acquire a sleepable lock.
+Therefore, these functions may not be called in a critical section or while
+holding a spin lock.
 .Pp
 Any calls to
 .Fn malloc
Index: sys/kern/kern_malloc.c
===================================================================
--- sys/kern/kern_malloc.c
+++ sys/kern/kern_malloc.c
@@ -476,6 +476,9 @@
 		KASSERT(curthread->td_intr_nesting_level == 0,
 		   ("malloc(M_WAITOK) in interrupt context"));
 
+	KASSERT(curthread->td_critnest == 0,
+	    ("malloc: called with spinlock or critical section held"));
+
 #ifdef DEBUG_MEMGUARD
 	if (memguard_cmp_mtp(mtp, size)) {
 		va = memguard_alloc(size, flags);
@@ -542,6 +545,9 @@
 
 	KASSERT(mtp->ks_magic == M_MAGIC, ("free: bad malloc type magic"));
 
+	KASSERT(curthread->td_critnest == 0,
+	    ("free: called with spinlock or critical section held"));
+
 	/* free(NULL, ...) does nothing */
 	if (addr == NULL)
 		return;
@@ -605,6 +611,9 @@
 	KASSERT(mtp->ks_magic == M_MAGIC,
 	    ("realloc: bad malloc type magic"));
 
+	KASSERT(curthread->td_critnest == 0,
+	    ("realloc: called with spinlock or critical section held"));
+
 	/* realloc(NULL, ...) is equivalent to malloc(...) */
 	if (addr == NULL)
 		return (malloc(size, mtp, flags));
Index: sys/vm/uma_core.c
===================================================================
--- sys/vm/uma_core.c
+++ sys/vm/uma_core.c
@@ -2149,6 +2149,10 @@
 		WITNESS_WARN(WARN_GIANTOK | WARN_SLEEPOK, NULL,
 		    "uma_zalloc_arg: zone \"%s\"", zone->uz_name);
 	}
+
+	KASSERT(curthread->td_critnest == 0,
+	    ("uma_zalloc_arg: called with spinlock or critical section held"));
+
 #ifdef DEBUG_MEMGUARD
 	if (memguard_cmp_zone(zone)) {
 		item = memguard_alloc(zone->uz_size, flags);
@@ -2686,6 +2690,9 @@
 	CTR2(KTR_UMA, "uma_zfree_arg thread %x zone %s", curthread,
 	    zone->uz_name);
 
+	KASSERT(curthread->td_critnest == 0,
+	    ("uma_zfree_arg: called with spinlock or critical section held"));
+
         /* uma_zfree(..., NULL) does nothing, to match free(9). */
         if (item == NULL)
                 return;