diff options
| author | Greg Kurz <groug@kaod.org> | 2017-01-25 00:23:49 +0100 |
|---|---|---|
| committer | Greg Kurz <groug@kaod.org> | 2017-01-25 09:34:35 +0100 |
| commit | fa0eb5c512d17a223d9f9bac45da48d78d12f584 (patch) | |
| tree | 2f4ad581dbc2e494ec8840e76380a8e5202d8c82 /hw/9pfs | |
| parent | 6fe76acc2d0fcadb1d827cffffab81d6c8d66704 (diff) | |
| download | qemu-fa0eb5c512d17a223d9f9bac45da48d78d12f584.tar.gz | |
9pfs: fix offset error in v9fs_xattr_read()
The current code tries to copy `read_count' bytes starting at offset
`offset' from a `read_count`-sized iovec. This causes v9fs_pack() to
fail with ENOBUFS.
Since the PDU iovec is already partially filled with `offset' bytes,
let's skip them when creating `qiov_full' and have v9fs_pack() to
copy the whole of it. Moreover, this is consistent with the other
places where v9fs_init_qiov_from_pdu() is called.
This fixes commit "bcb8998fac16 9pfs: call v9fs_init_qiov_from_pdu
before v9fs_pack".
Signed-off-by: Greg Kurz <groug@kaod.org>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
Diffstat (limited to 'hw/9pfs')
| -rw-r--r-- | hw/9pfs/9p.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c index d2d0288282..138d8e825d 100644 --- a/hw/9pfs/9p.c +++ b/hw/9pfs/9p.c @@ -1655,7 +1655,7 @@ static void v9fs_init_qiov_from_pdu(QEMUIOVector *qiov, V9fsPDU *pdu, if (is_write) { pdu->s->transport->init_out_iov_from_pdu(pdu, &iov, &niov); } else { - pdu->s->transport->init_in_iov_from_pdu(pdu, &iov, &niov, size); + pdu->s->transport->init_in_iov_from_pdu(pdu, &iov, &niov, size + skip); } qemu_iovec_init_external(&elem, iov, niov); @@ -1685,8 +1685,8 @@ static int v9fs_xattr_read(V9fsState *s, V9fsPDU *pdu, V9fsFidState *fidp, } offset += err; - v9fs_init_qiov_from_pdu(&qiov_full, pdu, 0, read_count, false); - err = v9fs_pack(qiov_full.iov, qiov_full.niov, offset, + v9fs_init_qiov_from_pdu(&qiov_full, pdu, offset, read_count, false); + err = v9fs_pack(qiov_full.iov, qiov_full.niov, 0, ((char *)fidp->fs.xattr.value) + off, read_count); qemu_iovec_destroy(&qiov_full); |