From f7ebb4b8714551fe91f00bd6742598e7b387f313 Mon Sep 17 00:00:00 2001 From: Anatol Belski Date: Fri, 12 Jun 2026 14:23:00 +0200 Subject: [PATCH] block: Bounds check WriteZeroes before sector multiplication In Request::execute_async the WriteZeroes arm multiplied wz_sector by SECTOR_SIZE before the checked_add of sector and num_sectors. A wz_sector near u64::MAX overflows the multiplication. Reorder the arm to run the checked_add and disk_nsectors check first, matching the Discard arm above. Signed-off-by: Anatol Belski --- block/src/io/request.rs | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/block/src/io/request.rs b/block/src/io/request.rs index 0db5e710f..74e3ba574 100644 --- a/block/src/io/request.rs +++ b/block/src/io/request.rs @@ -428,11 +428,6 @@ impl Request { }); } - let wz_offset = wz_sector * SECTOR_SIZE; - if wz_offset == 0 && disable_sector0_writes { - return Err(ExecuteError::BadRequest(Error::InvalidOffset)); - } - let top = wz_sector .checked_add(wz_num_sectors as u64) .ok_or(ExecuteError::BadRequest(Error::InvalidOffset))?; @@ -440,6 +435,11 @@ impl Request { return Err(ExecuteError::BadRequest(Error::InvalidOffset)); } + let wz_offset = wz_sector * SECTOR_SIZE; + if wz_offset == 0 && disable_sector0_writes { + return Err(ExecuteError::BadRequest(Error::InvalidOffset)); + } + let wz_length = (wz_num_sectors as u64) * SECTOR_SIZE; if wz_flags & VIRTIO_BLK_WRITE_ZEROES_FLAG_UNMAP != 0 {