block: Fix WriteZeroes sector arithmetic overflow - #8388
Merged
rbradford merged 2 commits intoJun 15, 2026
Conversation
In Request::execute_async the WriteZeroes arm multiplied wz_sector by SECTOR_SIZE before the checked_add of sector and num_sectors. A wz_sector near u64::MAX overflows the multiplication. Reorder the arm to run the checked_add and disk_nsectors check first, matching the Discard arm above. Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
sboeuf
approved these changes
Jun 15, 2026
phip1611
approved these changes
Jun 15, 2026
| }; | ||
| let mut disk = PanicAsyncIo(EventFd::new(0).unwrap()); | ||
|
|
||
| match request.execute_async(mem, 1024, &mut disk, &[], false, 0) { |
Member
There was a problem hiding this comment.
nit: I think this can be a let Err(ExecuteError::BadRequest(Error::InvalidOffset) = request.execute_async() ... else {panic}
Please try to check if it improves the code. I'm also fine with keeping the match
Member
Author
There was a problem hiding this comment.
Applied as suggested. Match would print the actual value on mismatch, but this form is shorter and the panic message names the expected variant.
Thanks
Cover the prior commit by constructing a Request directly and a stub AsyncIo whose backend methods are unreachable, then submit a payload with sector + num_sectors past u64::MAX and assert BadRequest. Assisted-by: Claude:Opus-4.7 Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
weltling
force-pushed
the
blk-write-zeroes-overflow
branch
from
June 15, 2026 10:36
d947179 to
e1cd6cb
Compare
Member
Author
|
Thanks for the reviews! |
rbradford
approved these changes
Jun 15, 2026
rbradford
enabled auto-merge
June 15, 2026 11:08
github-merge-queue
Bot
removed this pull request from the merge queue due to no response for status checks
Jun 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The
WriteZeroesarm ofRequest::execute_asynccomputedwz_sector * SECTOR_SIZEbefore thechecked_addofsectorandnum_sectors. A guestwz_sectornearu64::MAXoverflows the multiplication. TheDiscardarm above already runs the bounds check first;WriteZeroesnow matches.Found with virtio-villain B0018.