From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [45.144.208.40]) by lore.proxmox.com (Postfix) with ESMTPS id 5137C1FF12C for ; Wed, 05 Aug 2026 16:14:27 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 039272197A; Wed, 05 Aug 2026 16:14:27 +0200 (CEST) From: "Max R. Carrara" To: pve-devel@lists.proxmox.com Subject: [PATCH proxmox-backup 0/2] Fix Undefined Behavior in Tape Block Header Deallocation Date: Wed, 5 Aug 2026 16:13:26 +0200 Message-ID: <20260805141422.4187158-1-m.carrara@proxmox.com> X-Mailer: git-send-email 2.47.3 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1785939248664 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.023 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) RCVD_IN_DNSWL_LOW -0.7 Sender listed at https://www.dnswl.org/, low trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: R436IQY22JPLFZ2ICHJV2UCDOIDQ3I23 X-Message-ID-Hash: R436IQY22JPLFZ2ICHJV2UCDOIDQ3I23 X-MailFrom: m.carrara@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Fix Undefined Behavior in Tape Block Header Deallocation - v1 ============================================================= We allocate `BlockHeader` in `pbs-tape` with an alignment equal to the page size, but because it uses packed / 1-byte alignment (`#[repr(C, packed)]` to be precise), the compiler will treat it as if it was allocated with 1-byte alignment. Miri [0] will flag this as undefined behavior: error: Undefined Behavior: incorrect layout on deallocation: alloc46398 has size 262144 and alignment 4096, but gave size 262144 and alignment 1 This is because Rust cares about a memory region's alignment on deallocation, even if the underlying allocator does not -- hence why this hasn't actually been a problem for us. Still, there is no guarantee that this will not change at some point in the future. This is fixed in patch #1. Patch #2 just renames variables to fit the new implementation better, which I didn't want to include in patch #1, as it didn't really fit (and it would make the diff ugly). If you feel like patch #2 is superfluous, feel free to drop it. Special thanks to @Robert, who brought this to my attention and totally managed to nerd-snipe me with this. I have added a respective git trailer in patch #1. Testing ------- Would be great if somebody with a working tape storage could give this a spin -- miri does not report any UB anymore and the tests we have pass, but some smoke-testing would nevertheless be appreciated. My virtual tape library has unfortunately borked itself, and I haven't come around to un-borking it yet. [0]: https://github.com/rust-lang/miri Summary of Changes ------------------ proxmox-backup: Max R. Carrara (2): pbs-tape: fix undefined behavior in block header deallocation pbs-tape: rename `buffer` to `header` pbs-tape/src/blocked_reader.rs | 58 +++--- pbs-tape/src/blocked_writer.rs | 47 ++--- pbs-tape/src/lib.rs | 352 +++++++++++++++++++++++++++------ 3 files changed, 346 insertions(+), 111 deletions(-) Summary over all repositories: 3 files changed, 346 insertions(+), 111 deletions(-) -- Generated by murpp 0.12.0