From: Paolo Bonzini <pbonzini@redhat.com>
Date: Wed, 5 Sep 2012 15:54:36 +0000 (+0200)
Subject: scsi-disk: fix check for out-of-range LBA
X-Git-Tag: v1.2.1~28
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=ff498e4a0dc188d2a441af6111065dd55feab57b;p=thirdparty%2Fqemu.git

scsi-disk: fix check for out-of-range LBA

This fix is needed to correctly handle 0-block read and writes.
Without it, a 0-block access at LBA 0 would underflow.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit 12ca76fc48081b3a0ad1a70546abfcf198aedfc4)

Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
---

diff --git a/hw/scsi-disk.c b/hw/scsi-disk.c
index 3959603b0f8..d6218528578 100644
--- a/hw/scsi-disk.c
+++ b/hw/scsi-disk.c
@@ -1456,9 +1456,13 @@ static inline bool check_lba_range(SCSIDiskState *s,
      * The first line tests that no overflow happens when computing the last
      * sector.  The second line tests that the last accessed sector is in
      * range.
+     *
+     * Careful, the computations should not underflow for nb_sectors == 0,
+     * and a 0-block read to the first LBA beyond the end of device is
+     * valid.
      */
     return (sector_num <= sector_num + nb_sectors &&
-            sector_num + nb_sectors - 1 <= s->qdev.max_lba);
+            sector_num + nb_sectors <= s->qdev.max_lba + 1);
 }
 
 typedef struct UnmapCBData {