Skip to content

Commit a902d19

Browse files
markjdbtonyhutter
authored andcommitted
Zero pad bytes when allocating a ZIL record
When allocating a record, we round up the allocation size to a multiple of 8. In this case, any padding bytes should be zeroed, otherwise the contents of uninitialized memory are written to the ZIL. This was found using KMSAN. Reviewed-by: Brian Behlendorf <[email protected]> Reviewed-by: Alexander Motin <[email protected]> Signed-off-by: Mark Johnston <[email protected]> Closes #12383
1 parent cb53d08 commit a902d19

File tree

1 file changed

+4
-3
lines changed

1 file changed

+4
-3
lines changed

module/zfs/zil.c

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1783,18 +1783,19 @@ zil_lwb_commit(zilog_t *zilog, itx_t *itx, lwb_t *lwb)
17831783
}
17841784

17851785
itx_t *
1786-
zil_itx_create(uint64_t txtype, size_t lrsize)
1786+
zil_itx_create(uint64_t txtype, size_t olrsize)
17871787
{
1788-
size_t itxsize;
1788+
size_t itxsize, lrsize;
17891789
itx_t *itx;
17901790

1791-
lrsize = P2ROUNDUP_TYPED(lrsize, sizeof (uint64_t), size_t);
1791+
lrsize = P2ROUNDUP_TYPED(olrsize, sizeof (uint64_t), size_t);
17921792
itxsize = offsetof(itx_t, itx_lr) + lrsize;
17931793

17941794
itx = zio_data_buf_alloc(itxsize);
17951795
itx->itx_lr.lrc_txtype = txtype;
17961796
itx->itx_lr.lrc_reclen = lrsize;
17971797
itx->itx_lr.lrc_seq = 0; /* defensive */
1798+
bzero((char *)&itx->itx_lr + olrsize, lrsize - olrsize);
17981799
itx->itx_sync = B_TRUE; /* default is synchronous */
17991800
itx->itx_callback = NULL;
18001801
itx->itx_callback_data = NULL;

0 commit comments

Comments
 (0)