[John Starks (jstarks)]

Concurrent partial writes can both observe an unallocated differencing block. The allocation-lock recheck misses the transition to PartiallyPresent, so a queued writer replaces the payload and loses earlier writes and parent inheritance. Handle that state explicitly and reuse the existing allocation.

Harden the related publication and rollback paths: keep zero-fill initialization ahead of payload publication, initialize each partial block’s bitmap range through the WAL, and establish safe recycled payload contents before logging the allocation. Preserve deferred-release and soft-anchor ownership on abort, and make allocation, completion, and cache acquisition cancellation-safe. Safe partial payloads avoid recurring data-flush barriers when additional sectors become present.

Add deterministic concurrency and selective-persistence regressions, first-touch flush-count checks, and a bounded sector model covering writes, trim, abort, flush, and recovery with both logical sector sizes. Each seeded configuration runs independently to stay within the test runner’s per-test timeout.

Validated on Linux after rebasing onto current main: compilation checks for vhdx and disklayer_vhdx, all-target Clippy and documentation for vhdx, 483 passing tests across both packages with the agent nextest profile, and cargo xtask fmt --fix. Native Windows cross-validation was not run.

[github-actions]

⚠️ Unsafe Code Detected

This PR modifies files containing unsafe Rust code. Extra scrutiny is required during review.

For more on why we check whole files, instead of just diffs, check out the Rustonomicon

[Copilot]

🟡 Changes recommended

Cancelling zero-fill can release a region while its initialization write is still running, allowing another writer to reuse it before the outstanding write erases the new data.

1 open issue

• Cancelled zero-fill frees the region before its write completes · New

What changed in this PR

This PR fixes concurrent VHDX allocation so queued partial writes reuse existing payloads without losing earlier writes or parent inheritance. It also hardens metadata publication and rollback in the storage backend.

Changes:

• Order payload initialization and sector-bitmap logging before publication.
• Track allocation ownership during rollback and add cancellation cleanup for writes and cache acquisition.
• Add deterministic concurrency, selective-persistence, flush-count, and seeded recovery tests.

File	Description
vm/​devices/​storage/​vhdx/​src/​trim.rs	Clarifies bitmap initialization responsibility in comments.
vm/​devices/​storage/​vhdx/​src/​tests/​transition_tests.rs	Adds cancellation, persistence, and sector-model regressions.
vm/​devices/​storage/​vhdx/​src/​tests/​support.rs	Adds controlled I/O pauses, failures, and persistence scheduling.
vm/​devices/​storage/​vhdx/​src/​tests/​mod.rs	Registers transition tests.
vm/​devices/​storage/​vhdx/​src/​tests/​io_tests.rs	Tests concurrent allocation, rollback ownership, and bitmap preservation.
vm/​devices/​storage/​vhdx/​src/​tests/​crash_tests.rs	Updates comments describing publication and flush dependencies.
vm/​devices/​storage/​vhdx/​src/​space.rs	Prevents reclaiming transitioning soft anchors and adds coverage.
vm/​devices/​storage/​vhdx/​src/​sector_bitmap.rs	Ensures bitmap initialization zeros are logged.
vm/​devices/​storage/​vhdx/​src/​io.rs	Fixes allocation rechecks and revises publication and rollback handling.
vm/​devices/​storage/​vhdx/​src/​cache.rs	Adds cancellation cleanup and pins pending page loads.

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Cancelling resolve_write can release an extent while its zeroing I/O is still running, allowing another writer to reuse the range and have its data overwritten by the unfinished zero write.

1 open issue

• Cancelled zero-fill frees the region before its write completes

_{Review effort: Balanced}