From: Vladimir Sementsov-Ogievskiy <vsement...@virtuozzo.com>
Prior to 1143ec5ebf4 it was OK to qemu_iovec_from_buf() from aligned-up
buffer to original qiov, as qemu_iovec_from_buf() will stop at qiov end
anyway.
But after 1143ec5ebf4 we assume that bdrv_co_do_copy_on_readv works on
part of original qiov, defined by qiov_offset and bytes. So we must not
touch qiov behind qiov_offset+bytes bound. Fix it.
Cc: qemu-sta...@nongnu.org # v4.2
Fixes: 1143ec5ebf4
Signed-off-by: Vladimir Sementsov-Ogievskiy <vsement...@virtuozzo.com>
Reviewed-by: John Snow <js...@redhat.com>
Message-id: 20200312081949.5350-1-vsement...@virtuozzo.com
Signed-off-by: Stefan Hajnoczi <stefa...@redhat.com>
(cherry picked from commit 4ab78b19189a81038e744728ed949d09aa477550)
Signed-off-by: Michael Roth <mdr...@linux.vnet.ibm.com>
---
block/io.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/block/io.c b/block/io.c
index f75777f5ea..949932d6cc 100644
--- a/block/io.c
+++ b/block/io.c
@@ -1395,7 +1395,7 @@ static int coroutine_fn
bdrv_co_do_copy_on_readv(BdrvChild *child,
if (!(flags & BDRV_REQ_PREFETCH)) {
qemu_iovec_from_buf(qiov, qiov_offset + progress,
bounce_buffer + skip_bytes,
- pnum - skip_bytes);
+ MIN(pnum - skip_bytes, bytes - progress));
}
} else if (!(flags & BDRV_REQ_PREFETCH)) {
/* Read directly into the destination */
--
2.17.1
