c/mirror_zfs
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_zfs.git synced 2024-12-27 03:19:35 +03:00
Code Issues Packages Projects Releases Wiki Activity

Fix 0 byte memory leak in zfs receive

Browse Source 
Currently, when a DRR_OBJECT record is read into memory in
receive_read_record(), memory is allocated for the bonus buffer.
However, if the object doesn't have a bonus buffer the code will
still "allocate" the zero bytes, but the memory will not be passed
to the processing thread for cleanup later. This causes the spl
kmem tracking code to report a leak. This patch simply changes the
code so that it only allocates this memory if it has a non-zero
length.

Reviewed by: Matt Ahrens <mahrens@delphix.com>
Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov>
Signed-off-by: Tom Caputi <tcaputi@datto.com>
Closes #8266
This commit is contained in:
Tom Caputi 2019-01-18 14:06:48 -05:00 committed by Brian Behlendorf
parent 1a759200e5
commit 960347d3a6
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
module/zfs/dmu_recv.c
View File

@ -1785,6 +1785,8 @@ receive_read_payload_and_next_header(struct receive_arg *ra, int len, void *buf)
ra->rrd->payload_size = len; ra->rrd->payload_size = len;
ra->rrd->bytes_read = ra->bytes_read; ra->rrd->bytes_read = ra->bytes_read;
} }
} else {
ASSERT3P(buf, ==, NULL);
} }
ra->prev_cksum = ra->cksum; ra->prev_cksum = ra->cksum;
@ -1936,9 +1938,12 @@ receive_read_record(struct receive_arg *ra)
{ {
struct drr_object *drro = &ra->rrd->header.drr_u.drr_object; struct drr_object *drro = &ra->rrd->header.drr_u.drr_object;
uint32_t size = DRR_OBJECT_PAYLOAD_SIZE(drro); uint32_t size = DRR_OBJECT_PAYLOAD_SIZE(drro);
void *buf = kmem_zalloc(size, KM_SLEEP); void *buf = NULL;
dmu_object_info_t doi; dmu_object_info_t doi;
if (size != 0)
buf = kmem_zalloc(size, KM_SLEEP);
err = receive_read_payload_and_next_header(ra, size, buf); err = receive_read_payload_and_next_header(ra, size, buf);
if (err != 0) { if (err != 0) {
kmem_free(buf, size); kmem_free(buf, size);