Project

General

Profile

Bug #12054

spa_load_l2cache() can zero-length allocate

Added by Dan McDonald 4 months ago. Updated 4 months ago.

Status:
New
Priority:
Normal
Assignee:
-
Category:
zfs - Zettabyte File System
Start date:
Due date:
% Done:

0%

Estimated time:
Difficulty:
Medium
Tags:

Description

Discovered during nfs-zone testing, there appears to be a case in spa_load_l2cache() where a zero-length kmem_alloc() with KM_SLEEP can occur:

    if (sav->sav_config != NULL) {
        VERIFY(nvlist_lookup_nvlist_array(sav->sav_config,
            ZPOOL_CONFIG_L2CACHE, &l2cache, &nl2cache) == 0);
        /* XXX KEBE ASKS - what if 'nl2cache' is 0 ? */
        newvdevs = kmem_alloc(nl2cache * sizeof (void *), KM_SLEEP);
    } else {
        nl2cache = 0;
        newvdevs = NULL;
    }
1733

Observations so far are that this appears to only happen on the distro that boots from ZFS at boot time.

History

#1

Updated by Dan McDonald 4 months ago

One possible suggested fix:

    if (sav->sav_config != NULL) {
        VERIFY(nvlist_lookup_nvlist_array(sav->sav_config,
            ZPOOL_CONFIG_L2CACHE, &l2cache, &nl2cache) == 0);
        newvdevs = (nl2cache == 0) ? NULL :
            kmem_alloc(nl2cache * sizeof (void *), KM_SLEEP);
    } else {
        nl2cache = 0;
        newvdevs = NULL;
    }

Also available in: Atom PDF