Fix stack ztest

While ztest does run in user space we run it with the same stack
restrictions it would have in kernel space.  This ensures that any
stack related issues which would be hit in the kernel can be caught
and debugged in user space instead.

This patch is a first pass to limit the stack usage of every ztest
function to 1024 bytes.  Subsequent updates can further reduce this.

Signed-off-by: Brian Behlendorf <[email protected]>

1 files changed, 205 insertions, 87 deletions

diff --git a/cmd/ztest/ztest.c b/cmd/ztest/ztest.c
index 930342d2e..52dec4a02 100644
--- a/cmd/ztest/ztest.c
+++ b/cmd/ztest/ztest.c
@@ -398,9 +398,10 @@ fatal(int do_perror, char *message, ...)
 {
 	va_list args;
 	int save_errno = errno;
-	char buf[FATAL_MSG_SZ];
+	char *buf;
 
 	(void) fflush(stdout);
+	buf = umem_alloc(FATAL_MSG_SZ, UMEM_NOFAIL);
 
 	va_start(args, message);
 	(void) sprintf(buf, "ztest: ");
@@ -665,10 +666,12 @@ ztest_get_ashift(void)
 static nvlist_t *
 make_vdev_file(char *path, char *aux, size_t size, uint64_t ashift)
 {
-	char pathbuf[MAXPATHLEN];
+	char *pathbuf;
 	uint64_t vdev;
 	nvlist_t *file;
 
+	pathbuf = umem_alloc(MAXPATHLEN, UMEM_NOFAIL);
+
 	if (ashift == 0)
 		ashift = ztest_get_ashift();
 
@@ -699,6 +702,7 @@ make_vdev_file(char *path, char *aux, size_t size, uint64_t ashift)
 	VERIFY(nvlist_add_string(file, ZPOOL_CONFIG_TYPE, VDEV_TYPE_FILE) == 0);
 	VERIFY(nvlist_add_string(file, ZPOOL_CONFIG_PATH, path) == 0);
 	VERIFY(nvlist_add_uint64(file, ZPOOL_CONFIG_ASHIFT, ashift) == 0);
+	umem_free(pathbuf, MAXPATHLEN);
 
 	return (file);
 }
@@ -841,7 +845,7 @@ ztest_dsl_prop_set_uint64(char *osname, zfs_prop_t prop, uint64_t value,
 {
 	const char *propname = zfs_prop_to_name(prop);
 	const char *valname;
-	char setpoint[MAXPATHLEN];
+	char *setpoint;
 	uint64_t curval;
 	int error;
 
@@ -855,6 +859,7 @@ ztest_dsl_prop_set_uint64(char *osname, zfs_prop_t prop, uint64_t value,
 	}
 	ASSERT3U(error, ==, 0);
 
+	setpoint = umem_alloc(MAXPATHLEN, UMEM_NOFAIL);
 	VERIFY3U(dsl_prop_get(osname, propname, sizeof (curval),
 	    1, &curval, setpoint), ==, 0);
 
@@ -863,6 +868,7 @@ ztest_dsl_prop_set_uint64(char *osname, zfs_prop_t prop, uint64_t value,
 		(void) printf("%s %s = %s at '%s'\n",
 		    osname, propname, valname, setpoint);
 	}
+	umem_free(setpoint, MAXPATHLEN);
 
 	return (error);
 }
@@ -2249,9 +2255,12 @@ ztest_vdev_aux_add_remove(ztest_ds_t *zd, uint64_t id)
 	vdev_t *rvd = spa->spa_root_vdev;
 	spa_aux_vdev_t *sav;
 	char *aux;
+	char *path;
 	uint64_t guid = 0;
 	int error;
 
+	path = umem_alloc(MAXPATHLEN, UMEM_NOFAIL);
+
 	if (ztest_random(2) == 0) {
 		sav = &spa->spa_spares;
 		aux = ZPOOL_CONFIG_SPARES;
@@ -2275,7 +2284,6 @@ ztest_vdev_aux_add_remove(ztest_ds_t *zd, uint64_t id)
 		 */
 		zs->zs_vdev_aux = 0;
 		for (;;) {
-			char path[MAXPATHLEN];
 			int c;
 			(void) sprintf(path, ztest_aux_template, zopt_dir,
 			    zopt_pool, aux, zs->zs_vdev_aux);
@@ -2317,6 +2325,8 @@ ztest_vdev_aux_add_remove(ztest_ds_t *zd, uint64_t id)
 	}
 
 	mutex_exit(&zs->zs_vdev_lock);
+
+	umem_free(path, MAXPATHLEN);
 }
 
 /*
@@ -2433,13 +2443,16 @@ ztest_vdev_attach_detach(ztest_ds_t *zd, uint64_t id)
 	uint64_t ashift = ztest_get_ashift();
 	uint64_t oldguid, pguid;
 	size_t oldsize, newsize;
-	char oldpath[MAXPATHLEN], newpath[MAXPATHLEN];
+	char *oldpath, *newpath;
 	int replacing;
 	int oldvd_has_siblings = B_FALSE;
 	int newvd_is_spare = B_FALSE;
 	int oldvd_is_log;
 	int error, expected_error;
 
+	oldpath = umem_alloc(MAXPATHLEN, UMEM_NOFAIL);
+	newpath = umem_alloc(MAXPATHLEN, UMEM_NOFAIL);
+
 	mutex_enter(&zs->zs_vdev_lock);
 	leaves = MAX(zs->zs_mirrors, 1) * zopt_raidz;
 
@@ -2501,8 +2514,7 @@ ztest_vdev_attach_detach(ztest_ds_t *zd, uint64_t id)
 		if (error != 0 && error != ENODEV && error != EBUSY &&
 		    error != ENOTSUP)
 			fatal(0, "detach (%s) returned %d", oldpath, error);
-		mutex_exit(&zs->zs_vdev_lock);
-		return;
+		goto out;
 	}
 
 	/*
@@ -2593,8 +2605,11 @@ ztest_vdev_attach_detach(ztest_ds_t *zd, uint64_t id)
 		    oldpath, (longlong_t)oldsize, newpath,
 		    (longlong_t)newsize, replacing, error, expected_error);
 	}
-
+out:
 	mutex_exit(&zs->zs_vdev_lock);
+
+	umem_free(oldpath, MAXPATHLEN);
+	umem_free(newpath, MAXPATHLEN);
 }
 
 /*
@@ -2940,14 +2955,17 @@ void
 ztest_dmu_objset_create_destroy(ztest_ds_t *zd, uint64_t id)
 {
 	ztest_shared_t *zs = ztest_shared;
-	ztest_ds_t zdtmp;
+	ztest_ds_t *zdtmp;
 	int iters;
 	int error;
 	objset_t *os, *os2;
-	char name[MAXNAMELEN];
+	char *name;
 	zilog_t *zilog;
 	int i;
 
+	zdtmp = umem_alloc(sizeof (ztest_ds_t), UMEM_NOFAIL);
+	name = umem_alloc(MAXNAMELEN, UMEM_NOFAIL);
+
 	(void) rw_enter(&zs->zs_name_lock, RW_READER);
 
 	(void) snprintf(name, MAXNAMELEN, "%s/temp_%llu",
@@ -2960,9 +2978,9 @@ ztest_dmu_objset_create_destroy(ztest_ds_t *zd, uint64_t id)
 	 */
 	if (ztest_random(2) == 0 &&
 	    dmu_objset_own(name, DMU_OST_OTHER, B_FALSE, FTAG, &os) == 0) {
-		ztest_zd_init(&zdtmp, os);
-		zil_replay(os, &zdtmp, ztest_replay_vector);
-		ztest_zd_fini(&zdtmp);
+		ztest_zd_init(zdtmp, os);
+		zil_replay(os, zdtmp, ztest_replay_vector);
+		ztest_zd_fini(zdtmp);
 		dmu_objset_disown(os, FTAG);
 	}
 
@@ -2986,8 +3004,7 @@ ztest_dmu_objset_create_destroy(ztest_ds_t *zd, uint64_t id)
 	if (error) {
 		if (error == ENOSPC) {
 			ztest_record_enospc(FTAG);
-			(void) rw_exit(&zs->zs_name_lock);
-			return;
+			goto out;
 		}
 		fatal(0, "dmu_objset_create(%s) = %d", name, error);
 	}
@@ -2995,7 +3012,7 @@ ztest_dmu_objset_create_destroy(ztest_ds_t *zd, uint64_t id)
 	VERIFY3U(0, ==,
 	    dmu_objset_own(name, DMU_OST_OTHER, B_FALSE, FTAG, &os));
 
-	ztest_zd_init(&zdtmp, os);
+	ztest_zd_init(zdtmp, os);
 
 	/*
 	 * Open the intent log for it.
@@ -3008,7 +3025,7 @@ ztest_dmu_objset_create_destroy(ztest_ds_t *zd, uint64_t id)
 	 */
 	iters = ztest_random(5);
 	for (i = 0; i < iters; i++) {
-		ztest_dmu_object_alloc_free(&zdtmp, id);
+		ztest_dmu_object_alloc_free(zdtmp, id);
 		if (ztest_random(iters) == 0)
 			(void) ztest_snapshot_create(name, i);
 	}
@@ -3033,9 +3050,12 @@ ztest_dmu_objset_create_destroy(ztest_ds_t *zd, uint64_t id)
 
 	zil_close(zilog);
 	dmu_objset_disown(os, FTAG);
-	ztest_zd_fini(&zdtmp);
-
+	ztest_zd_fini(zdtmp);
+out:
 	(void) rw_exit(&zs->zs_name_lock);
+
+	umem_free(name, MAXNAMELEN);
+	umem_free(zdtmp, sizeof (ztest_ds_t));
 }
 
 /*
@@ -3058,13 +3078,19 @@ ztest_dmu_snapshot_create_destroy(ztest_ds_t *zd, uint64_t id)
 void
 ztest_dsl_dataset_cleanup(char *osname, uint64_t id)
 {
-	char snap1name[MAXNAMELEN];
-	char clone1name[MAXNAMELEN];
-	char snap2name[MAXNAMELEN];
-	char clone2name[MAXNAMELEN];
-	char snap3name[MAXNAMELEN];
+	char *snap1name;
+	char *clone1name;
+	char *snap2name;
+	char *clone2name;
+	char *snap3name;
 	int error;
 
+	snap1name  = umem_alloc(MAXNAMELEN, UMEM_NOFAIL);
+	clone1name = umem_alloc(MAXNAMELEN, UMEM_NOFAIL);
+	snap2name  = umem_alloc(MAXNAMELEN, UMEM_NOFAIL);
+	clone2name = umem_alloc(MAXNAMELEN, UMEM_NOFAIL);
+	snap3name  = umem_alloc(MAXNAMELEN, UMEM_NOFAIL);
+
 	(void) snprintf(snap1name, MAXNAMELEN, "%s@s1_%llu",
 	    osname, (u_longlong_t)id);
 	(void) snprintf(clone1name, MAXNAMELEN, "%s/c1_%llu",
@@ -3091,6 +3117,12 @@ ztest_dsl_dataset_cleanup(char *osname, uint64_t id)
 	error = dmu_objset_destroy(snap1name, B_FALSE);
 	if (error && error != ENOENT)
 		fatal(0, "dmu_objset_destroy(%s) = %d", snap1name, error);
+
+	umem_free(snap1name, MAXNAMELEN);
+	umem_free(clone1name, MAXNAMELEN);
+	umem_free(snap2name, MAXNAMELEN);
+	umem_free(clone2name, MAXNAMELEN);
+	umem_free(snap3name, MAXNAMELEN);
 }
 
 /*
@@ -3102,14 +3134,20 @@ ztest_dsl_dataset_promote_busy(ztest_ds_t *zd, uint64_t id)
 	ztest_shared_t *zs = ztest_shared;
 	objset_t *clone;
 	dsl_dataset_t *ds;
-	char snap1name[MAXNAMELEN];
-	char clone1name[MAXNAMELEN];
-	char snap2name[MAXNAMELEN];
-	char clone2name[MAXNAMELEN];
-	char snap3name[MAXNAMELEN];
+	char *snap1name;
+	char *clone1name;
+	char *snap2name;
+	char *clone2name;
+	char *snap3name;
 	char *osname = zd->zd_name;
 	int error;
 
+	snap1name  = umem_alloc(MAXNAMELEN, UMEM_NOFAIL);
+	clone1name = umem_alloc(MAXNAMELEN, UMEM_NOFAIL);
+	snap2name  = umem_alloc(MAXNAMELEN, UMEM_NOFAIL);
+	clone2name = umem_alloc(MAXNAMELEN, UMEM_NOFAIL);
+	snap3name  = umem_alloc(MAXNAMELEN, UMEM_NOFAIL);
+
 	(void) rw_enter(&zs->zs_name_lock, RW_READER);
 
 	ztest_dsl_dataset_cleanup(osname, id);
@@ -3196,41 +3234,64 @@ out:
 	ztest_dsl_dataset_cleanup(osname, id);
 
 	(void) rw_exit(&zs->zs_name_lock);
+
+	umem_free(snap1name, MAXNAMELEN);
+	umem_free(clone1name, MAXNAMELEN);
+	umem_free(snap2name, MAXNAMELEN);
+	umem_free(clone2name, MAXNAMELEN);
+	umem_free(snap3name, MAXNAMELEN);
 }
 
+#undef OD_ARRAY_SIZE
+#define OD_ARRAY_SIZE	4
+
 /*
  * Verify that dmu_object_{alloc,free} work as expected.
  */
 void
 ztest_dmu_object_alloc_free(ztest_ds_t *zd, uint64_t id)
 {
-	ztest_od_t od[4];
-	int batchsize = sizeof (od) / sizeof (od[0]);
+	ztest_od_t *od;
+	int batchsize;
+	int size;
 	int b;
 
+	size = sizeof(ztest_od_t) * OD_ARRAY_SIZE;
+	od = umem_alloc(size, UMEM_NOFAIL);
+	batchsize = OD_ARRAY_SIZE;
+
 	for (b = 0; b < batchsize; b++)
-		ztest_od_init(&od[b], id, FTAG, b, DMU_OT_UINT64_OTHER, 0, 0);
+		ztest_od_init(od + b, id, FTAG, b, DMU_OT_UINT64_OTHER, 0, 0);
 
 	/*
 	 * Destroy the previous batch of objects, create a new batch,
 	 * and do some I/O on the new objects.
 	 */
-	if (ztest_object_init(zd, od, sizeof (od), B_TRUE) != 0)
+	if (ztest_object_init(zd, od, size, B_TRUE) != 0)
 		return;
 
 	while (ztest_random(4 * batchsize) != 0)
 		ztest_io(zd, od[ztest_random(batchsize)].od_object,
 		    ztest_random(ZTEST_RANGE_LOCKS) << SPA_MAXBLOCKSHIFT);
+
+	umem_free(od, size);
 }
 
+#undef OD_ARRAY_SIZE
+#define OD_ARRAY_SIZE	2
+
 /*
  * Verify that dmu_{read,write} work as expected.
  */
 void
 ztest_dmu_read_write(ztest_ds_t *zd, uint64_t id)
 {
+	int size;
+	ztest_od_t *od;
+
 	objset_t *os = zd->zd_os;
-	ztest_od_t od[2];
+	size = sizeof(ztest_od_t) * OD_ARRAY_SIZE;
+	od = umem_alloc(size, UMEM_NOFAIL);
 	dmu_tx_t *tx;
 	int i, freeit, error;
 	uint64_t n, s, txg;
@@ -3269,11 +3330,13 @@ ztest_dmu_read_write(ztest_ds_t *zd, uint64_t id)
 	/*
 	 * Read the directory info.  If it's the first time, set things up.
 	 */
-	ztest_od_init(&od[0], id, FTAG, 0, DMU_OT_UINT64_OTHER, 0, chunksize);
-	ztest_od_init(&od[1], id, FTAG, 1, DMU_OT_UINT64_OTHER, 0, chunksize);
+	ztest_od_init(od, id, FTAG, 0, DMU_OT_UINT64_OTHER, 0, chunksize);
+	ztest_od_init(od + 1, id, FTAG, 1, DMU_OT_UINT64_OTHER, 0, chunksize);
 
-	if (ztest_object_init(zd, od, sizeof (od), B_FALSE) != 0)
+	if (ztest_object_init(zd, od, size, B_FALSE) != 0) {
+		umem_free(od, size);
 		return;
+	}
 
 	bigobj = od[0].od_object;
 	packobj = od[1].od_object;
@@ -3337,6 +3400,7 @@ ztest_dmu_read_write(ztest_ds_t *zd, uint64_t id)
 	if (txg == 0) {
 		umem_free(packbuf, packsize);
 		umem_free(bigbuf, bigsize);
+		umem_free(od, size);
 		return;
 	}
 
@@ -3437,6 +3501,7 @@ ztest_dmu_read_write(ztest_ds_t *zd, uint64_t id)
 
 	umem_free(packbuf, packsize);
 	umem_free(bigbuf, bigsize);
+	umem_free(od, size);
 }
 
 void
@@ -3488,14 +3553,18 @@ compare_and_update_pbbufs(uint64_t s, bufwad_t *packbuf, bufwad_t *bigbuf,
 	}
 }
 
+#undef OD_ARRAY_SIZE
+#define OD_ARRAY_SIZE	2
+
 void
 ztest_dmu_read_write_zcopy(ztest_ds_t *zd, uint64_t id)
 {
 	objset_t *os = zd->zd_os;
-	ztest_od_t od[2];
+	ztest_od_t *od;
 	dmu_tx_t *tx;
 	uint64_t i;
 	int error;
+	int size;
 	uint64_t n, s, txg;
 	bufwad_t *packbuf, *bigbuf;
 	uint64_t packobj, packoff, packsize, bigobj, bigoff, bigsize;
@@ -3508,6 +3577,9 @@ ztest_dmu_read_write_zcopy(ztest_ds_t *zd, uint64_t id)
 	arc_buf_t **bigbuf_arcbufs;
 	dmu_object_info_t doi;
 
+	size = sizeof(ztest_od_t) * OD_ARRAY_SIZE;
+	od = umem_alloc(size, UMEM_NOFAIL);
+
 	/*
 	 * This test uses two objects, packobj and bigobj, that are always
 	 * updated together (i.e. in the same tx) so that their contents are
@@ -3527,11 +3599,14 @@ ztest_dmu_read_write_zcopy(ztest_ds_t *zd, uint64_t id)
 	/*
 	 * Read the directory info.  If it's the first time, set things up.
 	 */
-	ztest_od_init(&od[0], id, FTAG, 0, DMU_OT_UINT64_OTHER, blocksize, 0);
-	ztest_od_init(&od[1], id, FTAG, 1, DMU_OT_UINT64_OTHER, 0, chunksize);
+	ztest_od_init(od, id, FTAG, 0, DMU_OT_UINT64_OTHER, blocksize, 0);
+	ztest_od_init(od + 1, id, FTAG, 1, DMU_OT_UINT64_OTHER, 0, chunksize);
 
-	if (ztest_object_init(zd, od, sizeof (od), B_FALSE) != 0)
+
+	if (ztest_object_init(zd, od, size, B_FALSE) != 0) {
+		umem_free(od, size);
 		return;
+	}
 
 	bigobj = od[0].od_object;
 	packobj = od[1].od_object;
@@ -3617,6 +3692,7 @@ ztest_dmu_read_write_zcopy(ztest_ds_t *zd, uint64_t id)
 				}
 			}
 			umem_free(bigbuf_arcbufs, 2 * s * sizeof (arc_buf_t *));
+			umem_free(od, size);
 			dmu_buf_rele(bonus_db, FTAG);
 			return;
 		}
@@ -3713,13 +3789,16 @@ ztest_dmu_read_write_zcopy(ztest_ds_t *zd, uint64_t id)
 	umem_free(packbuf, packsize);
 	umem_free(bigbuf, bigsize);
 	umem_free(bigbuf_arcbufs, 2 * s * sizeof (arc_buf_t *));
+	umem_free(od, size);
 }
 
 /* ARGSUSED */
 void
 ztest_dmu_write_parallel(ztest_ds_t *zd, uint64_t id)
 {
-	ztest_od_t od[1];
+	ztest_od_t *od;
+
+	od = umem_alloc(sizeof(ztest_od_t), UMEM_NOFAIL);
 	uint64_t offset = (1ULL << (ztest_random(20) + 43)) +
 	    (ztest_random(ZTEST_RANGE_LOCKS) << SPA_MAXBLOCKSHIFT);
 
@@ -3728,47 +3807,56 @@ ztest_dmu_write_parallel(ztest_ds_t *zd, uint64_t id)
 	 * to verify that parallel writes to an object -- even to the
 	 * same blocks within the object -- doesn't cause any trouble.
 	 */
-	ztest_od_init(&od[0], ID_PARALLEL, FTAG, 0, DMU_OT_UINT64_OTHER, 0, 0);
+	ztest_od_init(od, ID_PARALLEL, FTAG, 0, DMU_OT_UINT64_OTHER, 0, 0);
 
-	if (ztest_object_init(zd, od, sizeof (od), B_FALSE) != 0)
+	if (ztest_object_init(zd, od, sizeof (ztest_od_t), B_FALSE) != 0)
 		return;
 
 	while (ztest_random(10) != 0)
-		ztest_io(zd, od[0].od_object, offset);
+		ztest_io(zd, od->od_object, offset);
+
+	umem_free(od, sizeof(ztest_od_t));
 }
 
 void
 ztest_dmu_prealloc(ztest_ds_t *zd, uint64_t id)
 {
-	ztest_od_t od[1];
+	ztest_od_t *od;
 	uint64_t offset = (1ULL << (ztest_random(4) + SPA_MAXBLOCKSHIFT)) +
 	    (ztest_random(ZTEST_RANGE_LOCKS) << SPA_MAXBLOCKSHIFT);
 	uint64_t count = ztest_random(20) + 1;
 	uint64_t blocksize = ztest_random_blocksize();
 	void *data;
 
-	ztest_od_init(&od[0], id, FTAG, 0, DMU_OT_UINT64_OTHER, blocksize, 0);
+	od = umem_alloc(sizeof(ztest_od_t), UMEM_NOFAIL);
+
+	ztest_od_init(od, id, FTAG, 0, DMU_OT_UINT64_OTHER, blocksize, 0);
 
-	if (ztest_object_init(zd, od, sizeof (od), !ztest_random(2)) != 0)
+	if (ztest_object_init(zd, od, sizeof (ztest_od_t), !ztest_random(2)) != 0) {
+		umem_free(od, sizeof(ztest_od_t));
 		return;
+	}
 
-	if (ztest_truncate(zd, od[0].od_object, offset, count * blocksize) != 0)
+	if (ztest_truncate(zd, od->od_object, offset, count * blocksize) != 0) {
+		umem_free(od, sizeof(ztest_od_t));
 		return;
+	}
 
-	ztest_prealloc(zd, od[0].od_object, offset, count * blocksize);
+	ztest_prealloc(zd, od->od_object, offset, count * blocksize);
 
 	data = umem_zalloc(blocksize, UMEM_NOFAIL);
 
 	while (ztest_random(count) != 0) {
 		uint64_t randoff = offset + (ztest_random(count) * blocksize);
-		if (ztest_write(zd, od[0].od_object, randoff, blocksize,
+		if (ztest_write(zd, od->od_object, randoff, blocksize,
 		    data) != 0)
 			break;
 		while (ztest_random(4) != 0)
-			ztest_io(zd, od[0].od_object, randoff);
+			ztest_io(zd, od->od_object, randoff);
 	}
 
 	umem_free(data, blocksize);
+	umem_free(od, sizeof(ztest_od_t));
 }
 
 /*
@@ -3782,7 +3870,7 @@ void
 ztest_zap(ztest_ds_t *zd, uint64_t id)
 {
 	objset_t *os = zd->zd_os;
-	ztest_od_t od[1];
+	ztest_od_t *od;
 	uint64_t object;
 	uint64_t txg, last_txg;
 	uint64_t value[ZTEST_ZAP_MAX_INTS];
@@ -3793,12 +3881,14 @@ ztest_zap(ztest_ds_t *zd, uint64_t id)
 	int error;
 	char *hc[2] = { "s.acl.h", ".s.open.h.hyLZlg" };
 
-	ztest_od_init(&od[0], id, FTAG, 0, DMU_OT_ZAP_OTHER, 0, 0);
+	od = umem_alloc(sizeof(ztest_od_t), UMEM_NOFAIL);
+	ztest_od_init(od, id, FTAG, 0, DMU_OT_ZAP_OTHER, 0, 0);
 
-	if (ztest_object_init(zd, od, sizeof (od), !ztest_random(2)) != 0)
-		return;
+	if (ztest_object_init(zd, od, sizeof (ztest_od_t),
+			!ztest_random(2)) != 0)
+		goto out;
 
-	object = od[0].od_object;
+	object = od->od_object;
 
 	/*
 	 * Generate a known hash collision, and verify that
@@ -3808,7 +3898,7 @@ ztest_zap(ztest_ds_t *zd, uint64_t id)
 	dmu_tx_hold_zap(tx, object, B_TRUE, NULL);
 	txg = ztest_tx_assign(tx, TXG_MIGHTWAIT, FTAG);
 	if (txg == 0)
-		return;
+		goto out;
 	for (i = 0; i < 2; i++) {
 		value[i] = i;
 		VERIFY3U(0, ==, zap_add(os, object, hc[i], sizeof (uint64_t),
@@ -3876,7 +3966,7 @@ ztest_zap(ztest_ds_t *zd, uint64_t id)
 	dmu_tx_hold_zap(tx, object, B_TRUE, NULL);
 	txg = ztest_tx_assign(tx, TXG_MIGHTWAIT, FTAG);
 	if (txg == 0)
-		return;
+		goto out;
 
 	if (last_txg > txg)
 		fatal(0, "zap future leak: old %llu new %llu", last_txg, txg);
@@ -3901,7 +3991,7 @@ ztest_zap(ztest_ds_t *zd, uint64_t id)
 	error = zap_length(os, object, txgname, &zl_intsize, &zl_ints);
 
 	if (error == ENOENT)
-		return;
+		goto out;
 
 	ASSERT3U(error, ==, 0);
 
@@ -3909,10 +3999,12 @@ ztest_zap(ztest_ds_t *zd, uint64_t id)
 	dmu_tx_hold_zap(tx, object, B_TRUE, NULL);
 	txg = ztest_tx_assign(tx, TXG_MIGHTWAIT, FTAG);
 	if (txg == 0)
-		return;
+		goto out;
 	VERIFY3U(0, ==, zap_remove(os, object, txgname, tx));
 	VERIFY3U(0, ==, zap_remove(os, object, propname, tx));
 	dmu_tx_commit(tx);
+out:
+	umem_free(od, sizeof(ztest_od_t));
 }
 
 /*
@@ -3922,16 +4014,17 @@ void
 ztest_fzap(ztest_ds_t *zd, uint64_t id)
 {
 	objset_t *os = zd->zd_os;
-	ztest_od_t od[1];
+	ztest_od_t *od;
 	uint64_t object, txg;
 	int i;
 
-	ztest_od_init(&od[0], id, FTAG, 0, DMU_OT_ZAP_OTHER, 0, 0);
-
-	if (ztest_object_init(zd, od, sizeof (od), !ztest_random(2)) != 0)
-		return;
+	od = umem_alloc(sizeof(ztest_od_t), UMEM_NOFAIL);
+	ztest_od_init(od, id, FTAG, 0, DMU_OT_ZAP_OTHER, 0, 0);
 
-	object = od[0].od_object;
+	if (ztest_object_init(zd, od, sizeof (ztest_od_t),
+				!ztest_random(2)) != 0)
+		goto out;
+	object = od->od_object;
 
 	/*
 	 * Add entries to this ZAP and make sure it spills over
@@ -3951,12 +4044,14 @@ ztest_fzap(ztest_ds_t *zd, uint64_t id)
 		dmu_tx_hold_zap(tx, object, B_TRUE, name);
 		txg = ztest_tx_assign(tx, TXG_MIGHTWAIT, FTAG);
 		if (txg == 0)
-			return;
+			goto out;
 		error = zap_add(os, object, name, sizeof (uint64_t), 1,
 		    &value, tx);
 		ASSERT(error == 0 || error == EEXIST);
 		dmu_tx_commit(tx);
 	}
+out:
+	umem_free(od, sizeof(ztest_od_t));
 }
 
 /* ARGSUSED */
@@ -3964,7 +4059,7 @@ void
 ztest_zap_parallel(ztest_ds_t *zd, uint64_t id)
 {
 	objset_t *os = zd->zd_os;
-	ztest_od_t od[1];
+	ztest_od_t *od;
 	uint64_t txg, object, count, wsize, wc, zl_wsize, zl_wc;
 	dmu_tx_t *tx;
 	int i, namelen, error;
@@ -3972,12 +4067,15 @@ ztest_zap_parallel(ztest_ds_t *zd, uint64_t id)
 	char name[20], string_value[20];
 	void *data;
 
-	ztest_od_init(&od[0], ID_PARALLEL, FTAG, micro, DMU_OT_ZAP_OTHER, 0, 0);
+	od = umem_alloc(sizeof(ztest_od_t), UMEM_NOFAIL);
+	ztest_od_init(od, ID_PARALLEL, FTAG, micro, DMU_OT_ZAP_OTHER, 0, 0);
 
-	if (ztest_object_init(zd, od, sizeof (od), B_FALSE) != 0)
+	if (ztest_object_init(zd, od, sizeof (ztest_od_t), B_FALSE) != 0) {
+		umem_free(od, sizeof(ztest_od_t));
 		return;
+	}
 
-	object = od[0].od_object;
+	object = od->od_object;
 
 	/*
 	 * Generate a random name of the form 'xxx.....' where each
@@ -4066,6 +4164,8 @@ ztest_zap_parallel(ztest_ds_t *zd, uint64_t id)
 
 	if (tx != NULL)
 		dmu_tx_commit(tx);
+
+	umem_free(od, sizeof(ztest_od_t));
 }
 
 /*
@@ -4150,23 +4250,26 @@ void
 ztest_dmu_commit_callbacks(ztest_ds_t *zd, uint64_t id)
 {
 	objset_t *os = zd->zd_os;
-	ztest_od_t od[1];
+	ztest_od_t *od;
 	dmu_tx_t *tx;
 	ztest_cb_data_t *cb_data[3], *tmp_cb;
 	uint64_t old_txg, txg;
 	int i, error = 0;
 
-	ztest_od_init(&od[0], id, FTAG, 0, DMU_OT_UINT64_OTHER, 0, 0);
+	od = umem_alloc(sizeof(ztest_od_t), UMEM_NOFAIL);
+	ztest_od_init(od, id, FTAG, 0, DMU_OT_UINT64_OTHER, 0, 0);
 
-	if (ztest_object_init(zd, od, sizeof (od), B_FALSE) != 0)
+	if (ztest_object_init(zd, od, sizeof (ztest_od_t), B_FALSE) != 0) {
+		umem_free(od, sizeof(ztest_od_t));
 		return;
+	}
 
 	tx = dmu_tx_create(os);
 
 	cb_data[0] = ztest_create_cb_data(os, 0);
 	dmu_tx_callback_register(tx, ztest_commit_callback, cb_data[0]);
 
-	dmu_tx_hold_write(tx, od[0].od_object, 0, sizeof (uint64_t));
+	dmu_tx_hold_write(tx, od->od_object, 0, sizeof (uint64_t));
 
 	/* Every once in a while, abort the transaction on purpose */
 	if (ztest_random(100) == 0)
@@ -4200,6 +4303,7 @@ ztest_dmu_commit_callbacks(ztest_ds_t *zd, uint64_t id)
 			umem_free(cb_data[i], sizeof (ztest_cb_data_t));
 		}
 
+		umem_free(od, sizeof(ztest_od_t));
 		return;
 	}
 
@@ -4209,14 +4313,14 @@ ztest_dmu_commit_callbacks(ztest_ds_t *zd, uint64_t id)
 	/*
 	 * Read existing data to make sure there isn't a future leak.
 	 */
-	VERIFY(0 == dmu_read(os, od[0].od_object, 0, sizeof (uint64_t),
+	VERIFY(0 == dmu_read(os, od->od_object, 0, sizeof (uint64_t),
 	    &old_txg, DMU_READ_PREFETCH));
 
 	if (old_txg > txg)
 		fatal(0, "future leak: got %" PRIu64 ", open txg is %" PRIu64,
 		    old_txg, txg);
 
-	dmu_write(os, od[0].od_object, 0, sizeof (uint64_t), &txg, tx);
+	dmu_write(os, od->od_object, 0, sizeof (uint64_t), &txg, tx);
 
 	(void) mutex_enter(&zcl.zcl_callbacks_lock);
 
@@ -4270,6 +4374,8 @@ ztest_dmu_commit_callbacks(ztest_ds_t *zd, uint64_t id)
 	(void) mutex_exit(&zcl.zcl_callbacks_lock);
 
 	dmu_tx_commit(tx);
+
+	umem_free(od, sizeof(ztest_od_t));
 }
 
 /* ARGSUSED */
@@ -4445,8 +4551,8 @@ ztest_fault_inject(ztest_ds_t *zd, uint64_t id)
 	uint64_t leaves;
 	uint64_t bad = 0x1990c0ffeedecadeull;
 	uint64_t top, leaf;
-	char path0[MAXPATHLEN];
-	char pathrand[MAXPATHLEN];
+	char *path0;
+	char *pathrand;
 	size_t fsize;
 	int bshift = SPA_MAXBLOCKSHIFT + 2;	/* don't scrog all labels */
 	int iters = 1000;
@@ -4456,6 +4562,9 @@ ztest_fault_inject(ztest_ds_t *zd, uint64_t id)
 	uint64_t guid0 = 0;
 	boolean_t islog = B_FALSE;
 
+	path0 = umem_alloc(MAXPATHLEN, UMEM_NOFAIL);
+	pathrand = umem_alloc(MAXPATHLEN, UMEM_NOFAIL);
+
 	mutex_enter(&zs->zs_vdev_lock);
 	maxfaults = MAXFAULTS();
 	leaves = MAX(zs->zs_mirrors, 1) * zopt_raidz;
@@ -4522,7 +4631,7 @@ ztest_fault_inject(ztest_ds_t *zd, uint64_t id)
 
 		if (sav->sav_count == 0) {
 			spa_config_exit(spa, SCL_STATE, FTAG);
-			return;
+			goto out;
 		}
 		vd0 = sav->sav_vdevs[ztest_random(sav->sav_count)];
 		guid0 = vd0->vdev_guid;
@@ -4567,7 +4676,7 @@ ztest_fault_inject(ztest_ds_t *zd, uint64_t id)
 	}
 
 	if (maxfaults == 0)
-		return;
+		goto out;
 
 	/*
 	 * We have at least single-fault tolerance, so inject data corruption.
@@ -4575,7 +4684,7 @@ ztest_fault_inject(ztest_ds_t *zd, uint64_t id)
 	fd = open(pathrand, O_RDWR);
 
 	if (fd == -1)	/* we hit a gap in the device namespace */
-		return;
+		goto out;
 
 	fsize = lseek(fd, 0, SEEK_END);
 
@@ -4591,7 +4700,7 @@ ztest_fault_inject(ztest_ds_t *zd, uint64_t id)
 		if (mirror_save != zs->zs_mirrors) {
 			mutex_exit(&zs->zs_vdev_lock);
 			(void) close(fd);
-			return;
+			goto out;
 		}
 
 		if (pwrite(fd, &bad, sizeof (bad), offset) != sizeof (bad))
@@ -4606,6 +4715,9 @@ ztest_fault_inject(ztest_ds_t *zd, uint64_t id)
 	}
 
 	(void) close(fd);
+out:
+	umem_free(path0, MAXPATHLEN);
+	umem_free(pathrand, MAXPATHLEN);
 }
 
 /*
@@ -4617,7 +4729,7 @@ ztest_ddt_repair(ztest_ds_t *zd, uint64_t id)
 	ztest_shared_t *zs = ztest_shared;
 	spa_t *spa = zs->zs_spa;
 	objset_t *os = zd->zd_os;
-	ztest_od_t od[1];
+	ztest_od_t *od;
 	uint64_t object, blocksize, txg, pattern, psize;
 	enum zio_checksum checksum = spa_dedup_checksum(spa);
 	dmu_buf_t *db;
@@ -4630,10 +4742,13 @@ ztest_ddt_repair(ztest_ds_t *zd, uint64_t id)
 	blocksize = ztest_random_blocksize();
 	blocksize = MIN(blocksize, 2048);	/* because we write so many */
 
-	ztest_od_init(&od[0], id, FTAG, 0, DMU_OT_UINT64_OTHER, blocksize, 0);
+	od = umem_alloc(sizeof(ztest_od_t), UMEM_NOFAIL);
+	ztest_od_init(od, id, FTAG, 0, DMU_OT_UINT64_OTHER, blocksize, 0);
 
-	if (ztest_object_init(zd, od, sizeof (od), B_FALSE) != 0)
+	if (ztest_object_init(zd, od, sizeof (ztest_od_t), B_FALSE) != 0) {
+		umem_free(od, sizeof(ztest_od_t));
 		return;
+	}
 
 	/*
 	 * Take the name lock as writer to prevent anyone else from changing
@@ -4646,6 +4761,7 @@ ztest_ddt_repair(ztest_ds_t *zd, uint64_t id)
 	    ztest_dsl_prop_set_uint64(zd->zd_name, ZFS_PROP_COPIES, 1,
 	    B_FALSE) != 0) {
 		(void) rw_exit(&zs->zs_name_lock);
+		umem_free(od, sizeof(ztest_od_t));
 		return;
 	}
 
@@ -4660,6 +4776,7 @@ ztest_ddt_repair(ztest_ds_t *zd, uint64_t id)
 	txg = ztest_tx_assign(tx, TXG_WAIT, FTAG);
 	if (txg == 0) {
 		(void) rw_exit(&zs->zs_name_lock);
+		umem_free(od, sizeof(ztest_od_t));
 		return;
 	}
 
@@ -4704,6 +4821,7 @@ ztest_ddt_repair(ztest_ds_t *zd, uint64_t id)
 	zio_buf_free(buf, psize);
 
 	(void) rw_exit(&zs->zs_name_lock);
+	umem_free(od, sizeof(ztest_od_t));
 }
 
 /*