diff options
| author | Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com> | 2020-03-12 11:19:49 +0300 |
|---|---|---|
| committer | Stefan Hajnoczi <stefanha@redhat.com> | 2020-03-16 11:46:11 +0000 |
| commit | 4ab78b19189a81038e744728ed949d09aa477550 (patch) | |
| tree | 0991e518dd75257fb71d4098e478b3a849fe62a3 /block/io.c | |
| parent | 61c265f0660ee476985808c8aa7915617c44fd53 (diff) | |
block/io: fix bdrv_co_do_copy_on_readv
Prior to 1143ec5ebf4 it was OK to qemu_iovec_from_buf() from aligned-up
buffer to original qiov, as qemu_iovec_from_buf() will stop at qiov end
anyway.
But after 1143ec5ebf4 we assume that bdrv_co_do_copy_on_readv works on
part of original qiov, defined by qiov_offset and bytes. So we must not
touch qiov behind qiov_offset+bytes bound. Fix it.
Cc: qemu-stable@nongnu.org # v4.2
Fixes: 1143ec5ebf4
Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: John Snow <jsnow@redhat.com>
Message-id: 20200312081949.5350-1-vsementsov@virtuozzo.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Diffstat (limited to 'block/io.c')
| -rw-r--r-- | block/io.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/block/io.c b/block/io.c index 7e4cb74cf4..aba67f66b9 100644 --- a/block/io.c +++ b/block/io.c @@ -1399,7 +1399,7 @@ static int coroutine_fn bdrv_co_do_copy_on_readv(BdrvChild *child, if (!(flags & BDRV_REQ_PREFETCH)) { qemu_iovec_from_buf(qiov, qiov_offset + progress, bounce_buffer + skip_bytes, - pnum - skip_bytes); + MIN(pnum - skip_bytes, bytes - progress)); } } else if (!(flags & BDRV_REQ_PREFETCH)) { /* Read directly into the destination */ |