0.31.0: hardening and correctness pass across mux, codec, AACS/CSS, UDF/MPLS/CLPI, recovery, drive/SCSI, labels, and I/O

Library-wide review-and-fix pass: tightened AACS keydb/handshake/variant
handling and trailing-partial-unit policy, corrected MPLS mark offset and
added UDF allocation bounds, hardened the mux/codec framing and M2TS paths,
guarded SCSI READ CAPACITY short transfers and unified error mapping, added
overflow guards on untrusted disc input, and made prefetch shutdown
deterministic. Release profile now builds with thin LTO + single codegen unit.

src/io/byte_prefetcher.rs

@@ -10,11 +10,12 @@
 //!
 //! This is the byte-stream half of the freemkv mux highway —
 //! `BytePrefetcher` feeds [`crate::mux::demux_thread::DemuxThread`]
-//! for `m2ts://`, `network://`, `stdio://`, and any other stream
-//! whose source is an `io::Read` rather than a `SectorSource`.
+//! for `m2ts://` (the only in-tree caller today, via
+//! [`crate::mux::resolve`]), and works for any stream whose source is
+//! an `io::Read` rather than a `SectorSource`.
 
-use crate::halt::Halt;
-use crossbeam_channel::{Receiver, Sender, bounded};
+use crate::halt::{Halt, POLL_INTERVAL};
+use crossbeam_channel::{Receiver, RecvTimeoutError, SendTimeoutError, Sender, bounded};
 use std::io::Read;
 use std::thread::JoinHandle;
 
@@ -38,6 +39,13 @@ pub const DEFAULT_CHUNK_BYTES: usize = 16 * 1024 * 1024;
 /// Returned from [`BytePrefetcher::into_channels`]. Owns the
 /// producer-thread join handle so dropping the shell joins the
 /// producer.
+///
+/// Drop blocks the calling thread until the producer exits. To
+/// guarantee a prompt exit, drop the forward receiver and the recycle
+/// sender first so the producer observes channel disconnection (or
+/// cancel the [`Halt`] passed to [`BytePrefetcher::new`], which the
+/// producer polls at [`POLL_INTERVAL`] granularity even while parked
+/// on a channel op).
 pub struct PrefetchShell {
     producer: Option<JoinHandle<()>>,
 }
@@ -66,7 +74,13 @@ impl BytePrefetcher {
         mut reader: R,
         chunk_bytes: usize,
         halt: Option<Halt>,
-    ) -> Self {
+    ) -> std::io::Result<Self> {
+        // A zero-length chunk makes every recycled buffer an empty
+        // slice; `reader.read(&mut [])` returns Ok(0), which the loop
+        // below treats as EOF — the consumer would see a clean,
+        // silent zero-byte stream. Callers pass the downstream
+        // demuxer's batch size, which is always > 0.
+        debug_assert!(chunk_bytes > 0, "BytePrefetcher chunk_bytes must be > 0");
         let (tx, rx) = bounded::<Batch>(FORWARD_DEPTH);
         let (recycle_tx, recycle_rx) = bounded::<Vec<u8>>(RECYCLE_DEPTH);
 
@@ -80,16 +94,32 @@ impl BytePrefetcher {
         let producer = std::thread::Builder::new()
             .name("freemkv-byte-prefetch".into())
             .spawn(move || {
+                let cancelled = || halt.as_ref().map(|h| h.is_cancelled()).unwrap_or(false);
                 loop {
-                    if halt.as_ref().map(|h| h.is_cancelled()).unwrap_or(false) {
+                    if cancelled() {
                         return;
                     }
-                    let mut buf = match recycle_rx.recv() {
-                        Ok(b) => b,
-                        Err(_) => return, // consumer dropped both channels
+                    // Park on the recycle channel, but re-poll halt
+                    // every POLL_INTERVAL: a pure-AtomicBool Halt does
+                    // not disconnect the channel, so a blocking recv()
+                    // would never re-reach the cancel check.
+                    let mut buf = loop {
+                        match recycle_rx.recv_timeout(POLL_INTERVAL) {
+                            Ok(b) => break b,
+                            Err(RecvTimeoutError::Timeout) => {
+                                if cancelled() {
+                                    return;
+                                }
+                            }
+                            // Consumer dropped both channels.
+                            Err(RecvTimeoutError::Disconnected) => return,
+                        }
                     };
-                    // Re-expose the full extent (previous iteration
-                    // may have truncated after a short read).
+                    // Re-expose the full extent. After a short read the
+                    // prior iteration truncated to n < chunk_bytes, so
+                    // this regrows the length back to chunk_bytes
+                    // without reallocating (capacity was fixed at
+                    // construction and never shrinks).
                     if buf.len() < chunk_bytes {
                         buf.resize(chunk_bytes, 0);
                     } else {
@@ -109,18 +139,31 @@ impl BytePrefetcher {
                         }
                     };
                     buf.truncate(n);
-                    if tx.send(Ok(buf)).is_err() {
-                        return; // consumer dropped
+                    // Hand off the filled buffer, re-polling halt on
+                    // each timeout slice so a cancel can interrupt a
+                    // producer parked on a saturated forward channel.
+                    let mut pending = Ok(buf);
+                    loop {
+                        match tx.send_timeout(pending, POLL_INTERVAL) {
+                            Ok(()) => break,
+                            Err(SendTimeoutError::Timeout(returned)) => {
+                                if cancelled() {
+                                    return;
+                                }
+                                pending = returned;
+                            }
+                            // Consumer dropped.
+                            Err(SendTimeoutError::Disconnected(_)) => return,
+                        }
                     }
                 }
-            })
-            .expect("freemkv-byte-prefetch thread spawn failed");
+            })?;
 
-        Self {
+        Ok(Self {
             rx,
             recycle_tx,
             producer: Some(producer),
-        }
+        })
     }
 
     /// Peel off the channels for zero-copy pipeline consumption. The
@@ -128,11 +171,30 @@ impl BytePrefetcher {
     /// drains `rx`, runs the demuxer in place on each filled buffer,
     /// and recycles back through `recycle_tx`.
     pub fn into_channels(self) -> (Receiver<Batch>, Sender<Vec<u8>>, PrefetchShell) {
-        let mut me = self;
-        let producer = me.producer.take();
-        let rx = me.rx.clone();
-        let recycle = me.recycle_tx.clone();
-        std::mem::forget(me);
+        // MOVE the three fields out cleanly — never clone. Each of
+        // `rx` and `recycle_tx` ends up with exactly ONE live copy:
+        // the one in the returned tuple. The pre-1.0.0 implementation
+        // cloned both and then `mem::forget`-ed `self`, leaking the
+        // originals so an extra live receiver + sender survived
+        // forever. That defeated the channel-disconnection shutdown:
+        // when the demux consumer exited early (halt, or a `tx.send`
+        // error in `demux_thread`), the producer's `recycle_rx.recv()`
+        // and `tx.send()` never saw all-peers-dropped, so the producer
+        // never returned and `PrefetchShell::drop`'s `join()` hung.
+        //
+        // `ManuallyDrop` + `ptr::read` reads each field out by value
+        // and suppresses `self`'s own `Drop` (which would otherwise
+        // double-`join`), leaving NO extra live endpoint behind. This
+        // is the panic-free equivalent of the `Option::take` approach
+        // and mirrors `sector::prefetched::into_channels`.
+        let me = std::mem::ManuallyDrop::new(self);
+        // SAFETY: `me` is `ManuallyDrop`, so none of these fields will
+        // be dropped by `me`. Each `ptr::read` performs exactly one
+        // bitwise move out; every field is read exactly once and never
+        // touched again, so there are no double-frees and no aliasing.
+        let producer = unsafe { std::ptr::read(&me.producer) };
+        let rx = unsafe { std::ptr::read(&me.rx) };
+        let recycle = unsafe { std::ptr::read(&me.recycle_tx) };
         (rx, recycle, PrefetchShell { producer })
     }
 }
@@ -144,3 +206,72 @@ impl Drop for BytePrefetcher {
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// Endless reader: every `read` fills the whole buffer and never
+    /// hits EOF, so the producer keeps trying to push batches forward
+    /// until the forward channel disconnects. Exactly the shape that
+    /// wedged the pre-1.0.0 `clone + mem::forget` `into_channels`.
+    struct EndlessReader;
+    impl Read for EndlessReader {
+        fn read(&mut self, buf: &mut [u8]) -> std::io::Result<usize> {
+            buf.fill(0);
+            Ok(buf.len())
+        }
+    }
+
+    /// Run `f` on a helper thread and fail if it does not finish within
+    /// `secs`. Turns a join-deadlock into a test failure instead of a
+    /// hung CI run.
+    fn within<F: FnOnce() + Send + 'static>(secs: u64, f: F) {
+        let (done_tx, done_rx) = bounded::<()>(1);
+        std::thread::spawn(move || {
+            f();
+            let _ = done_tx.send(());
+        });
+        assert!(
+            done_rx
+                .recv_timeout(std::time::Duration::from_secs(secs))
+                .is_ok(),
+            "operation did not complete within {secs}s (deadlock)"
+        );
+    }
+
+    /// The CRITICAL regression: after `into_channels`, dropping the
+    /// returned forward receiver + recycle sender must let the producer
+    /// observe disconnection and exit, so dropping the `PrefetchShell`
+    /// (which joins the producer) returns promptly. With the old
+    /// clone+forget the leaked endpoints kept the producer blocked and
+    /// this join hung forever.
+    #[test]
+    fn into_channels_drop_releases_producer() {
+        within(10, || {
+            // Small chunk so the producer cycles quickly and fills the
+            // forward channel without allocating much.
+            let pf = BytePrefetcher::new(EndlessReader, 4096, None).expect("spawn");
+            let (rx, recycle_tx, shell) = pf.into_channels();
+            // Consumer goes away early (halt / abort analogue): drop
+            // both channel endpoints without draining to EOF.
+            drop(rx);
+            drop(recycle_tx);
+            // Joining the producer must not hang.
+            drop(shell);
+        });
+    }
+
+    /// Same property via the halt path: cancel the token, then the
+    /// producer must exit and the shell join must complete.
+    #[test]
+    fn halt_releases_producer() {
+        within(10, || {
+            let halt = Halt::new();
+            let pf = BytePrefetcher::new(EndlessReader, 4096, Some(halt.clone())).expect("spawn");
+            let (_rx, _recycle_tx, shell) = pf.into_channels();
+            halt.cancel();
+            drop(shell);
+        });
+    }
+}