From: Vladimir Sementsov-Ogievskiy Date: Thu, 12 Mar 2020 08:19:49 +0000 (+0300) Subject: block/io: fix bdrv_co_do_copy_on_readv X-Git-Tag: v4.2.1~100 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=8fc4aa4822c55c9dbf7061a6fa4d9b3b8471800d;p=thirdparty%2Fqemu.git block/io: fix bdrv_co_do_copy_on_readv Prior to 1143ec5ebf4 it was OK to qemu_iovec_from_buf() from aligned-up buffer to original qiov, as qemu_iovec_from_buf() will stop at qiov end anyway. But after 1143ec5ebf4 we assume that bdrv_co_do_copy_on_readv works on part of original qiov, defined by qiov_offset and bytes. So we must not touch qiov behind qiov_offset+bytes bound. Fix it. Cc: qemu-stable@nongnu.org # v4.2 Fixes: 1143ec5ebf4 Signed-off-by: Vladimir Sementsov-Ogievskiy Reviewed-by: John Snow Message-id: 20200312081949.5350-1-vsementsov@virtuozzo.com Signed-off-by: Stefan Hajnoczi (cherry picked from commit 4ab78b19189a81038e744728ed949d09aa477550) Signed-off-by: Michael Roth --- diff --git a/block/io.c b/block/io.c index f75777f5ea7..949932d6cc2 100644 --- a/block/io.c +++ b/block/io.c @@ -1395,7 +1395,7 @@ static int coroutine_fn bdrv_co_do_copy_on_readv(BdrvChild *child, if (!(flags & BDRV_REQ_PREFETCH)) { qemu_iovec_from_buf(qiov, qiov_offset + progress, bounce_buffer + skip_bytes, - pnum - skip_bytes); + MIN(pnum - skip_bytes, bytes - progress)); } } else if (!(flags & BDRV_REQ_PREFETCH)) { /* Read directly into the destination */