runtime/src/storage/iouring.rs derives per-operation offsets with unchecked u64 arithmetic. If a caller can supply an offset near u64::MAX, these additions can wrap on subsequent loop iterations (short read/write), redirecting I/O to unintended earlier positions:
-
let offset = offset + bytes_read as u64; [1]
-
offset += op_bytes_written as u64; in single-buffer write (runtime/src/storage/iouring.rs:324) [2]
-
offset += op_bytes_written as u64; in vectored write [3]