mirrors
/
qemu
mirror of https://gitlab.com/qemu-project/qemu
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

9pfs: fix offset error in v9fs_xattr_read() 

The current code tries to copy `read_count' bytes starting at offset
`offset' from a `read_count`-sized iovec. This causes v9fs_pack() to
fail with ENOBUFS.

Since the PDU iovec is already partially filled with `offset' bytes,
let's skip them when creating `qiov_full' and have v9fs_pack() to
copy the whole of it. Moreover, this is consistent with the other
places where v9fs_init_qiov_from_pdu() is called.

This fixes commit "bcb8998fac16 9pfs: call v9fs_init_qiov_from_pdu
before v9fs_pack".

Signed-off-by: Greg Kurz <groug@kaod.org>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
This commit is contained in:
Greg Kurz 2017-01-25 00:23:49 +01:00
parent 6fe76acc2d
commit fa0eb5c512
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
hw/9pfs/9p.c
View File

@ -1655,7 +1655,7 @@ static void v9fs_init_qiov_from_pdu(QEMUIOVector *qiov, V9fsPDU *pdu,
if (is_write) { if (is_write) {
pdu->s->transport->init_out_iov_from_pdu(pdu, &iov, &niov); pdu->s->transport->init_out_iov_from_pdu(pdu, &iov, &niov);
} else { } else {
pdu->s->transport->init_in_iov_from_pdu(pdu, &iov, &niov, size); pdu->s->transport->init_in_iov_from_pdu(pdu, &iov, &niov, size + skip);
} }
qemu_iovec_init_external(&elem, iov, niov); qemu_iovec_init_external(&elem, iov, niov);
@ -1685,8 +1685,8 @@ static int v9fs_xattr_read(V9fsState *s, V9fsPDU *pdu, V9fsFidState *fidp,
} }
offset += err; offset += err;
v9fs_init_qiov_from_pdu(&qiov_full, pdu, 0, read_count, false); v9fs_init_qiov_from_pdu(&qiov_full, pdu, offset, read_count, false);
err = v9fs_pack(qiov_full.iov, qiov_full.niov, offset, err = v9fs_pack(qiov_full.iov, qiov_full.niov, 0,
((char *)fidp->fs.xattr.value) + off, ((char *)fidp->fs.xattr.value) + off,
read_count); read_count);
qemu_iovec_destroy(&qiov_full); qemu_iovec_destroy(&qiov_full);