MDEV-15764 InnoDB may write uninitialized garbage to redo log

log_sys_init(), log_buffer_extend(): Add TRASH_ALLOC() instrumentation log_write_up_to(): Correctly calculate the byte offset.
MariaDB · May 4, 2018 · d257c42 · d257c42
1 parent da3c5c3
commit d257c42
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/storage/innobase/log/log0log.cc b/storage/innobase/log/log0log.cc
@@ -235,6 +235,8 @@ log_buffer_extend(
 
 	log_sys->buf_ptr = static_cast<byte*>(
 		ut_zalloc_nokey(log_sys->buf_size * 2 + OS_FILE_LOG_BLOCK_SIZE));
+	TRASH_ALLOC(log_sys->buf_ptr,
+		    log_sys->buf_size * 2 + OS_FILE_LOG_BLOCK_SIZE);
 	log_sys->buf = static_cast<byte*>(
 		ut_align(log_sys->buf_ptr, OS_FILE_LOG_BLOCK_SIZE));
 
@@ -726,6 +728,8 @@ log_sys_init()
 
 	log_sys->buf_ptr = static_cast<byte*>(
 		ut_zalloc_nokey(log_sys->buf_size * 2 + OS_FILE_LOG_BLOCK_SIZE));
+	TRASH_ALLOC(log_sys->buf_ptr,
+		    log_sys->buf_size * 2 + OS_FILE_LOG_BLOCK_SIZE);
 	log_sys->buf = static_cast<byte*>(
 		ut_align(log_sys->buf_ptr, OS_FILE_LOG_BLOCK_SIZE));
 
@@ -1243,7 +1247,8 @@ log_write_up_to(
 
 	log_mutex_exit();
 	/* Erase the end of the last log block. */
-	memset(write_buf + end_offset, 0, ~end_offset & OS_FILE_LOG_BLOCK_SIZE);
+	memset(write_buf + end_offset, 0,
+	       ~end_offset & (OS_FILE_LOG_BLOCK_SIZE - 1));
 
 	/* Calculate pad_size if needed. */
 	pad_size = 0;