| Message ID | 148530022936.13158.7140713668400986309.stgit@bahia |
|---|---|
| State | New |
| Headers | show |
On Wed, 25 Jan 2017, Greg Kurz wrote: > The current code tries to copy `read_count' bytes starting at offset > `offset' from a `read_count`-sized iovec. This causes v9fs_pack() to > fail with ENOBUFS. > > Since the PDU iovec is already partially filled with `offset' bytes, > let's skip them when creating `qiov_full' and have v9fs_pack() to > copy the whole of it. Moreover, this is consistent with the other > places where v9fs_init_qiov_from_pdu() is called. > > This fixes commit "bcb8998fac16 9pfs: call v9fs_init_qiov_from_pdu > before v9fs_pack". > > Signed-off-by: Greg Kurz <groug@kaod.org> Reviewed-by: Stefano Stabellini <sstabellini@kernel.org> > v2: - pass size + skip to the init_in_iov_from_pdu callback > --- > hw/9pfs/9p.c | 6 +++--- > 1 file changed, 3 insertions(+), 3 deletions(-) > > diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c > index fa58877570f6..f22d39064f6b 100644 > --- a/hw/9pfs/9p.c > +++ b/hw/9pfs/9p.c > @@ -1655,7 +1655,7 @@ static void v9fs_init_qiov_from_pdu(QEMUIOVector *qiov, V9fsPDU *pdu, > if (is_write) { > pdu->s->transport->init_out_iov_from_pdu(pdu, &iov, &niov); > } else { > - pdu->s->transport->init_in_iov_from_pdu(pdu, &iov, &niov, size); > + pdu->s->transport->init_in_iov_from_pdu(pdu, &iov, &niov, size + skip); > } > > qemu_iovec_init_external(&elem, iov, niov); > @@ -1685,8 +1685,8 @@ static int v9fs_xattr_read(V9fsState *s, V9fsPDU *pdu, V9fsFidState *fidp, > } > offset += err; > > - v9fs_init_qiov_from_pdu(&qiov_full, pdu, 0, read_count, false); > - err = v9fs_pack(qiov_full.iov, qiov_full.niov, offset, > + v9fs_init_qiov_from_pdu(&qiov_full, pdu, offset, read_count, false); > + err = v9fs_pack(qiov_full.iov, qiov_full.niov, 0, > ((char *)fidp->fs.xattr.value) + off, > read_count); > qemu_iovec_destroy(&qiov_full); >
diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c index fa58877570f6..f22d39064f6b 100644 --- a/hw/9pfs/9p.c +++ b/hw/9pfs/9p.c @@ -1655,7 +1655,7 @@ static void v9fs_init_qiov_from_pdu(QEMUIOVector *qiov, V9fsPDU *pdu, if (is_write) { pdu->s->transport->init_out_iov_from_pdu(pdu, &iov, &niov); } else { - pdu->s->transport->init_in_iov_from_pdu(pdu, &iov, &niov, size); + pdu->s->transport->init_in_iov_from_pdu(pdu, &iov, &niov, size + skip); } qemu_iovec_init_external(&elem, iov, niov); @@ -1685,8 +1685,8 @@ static int v9fs_xattr_read(V9fsState *s, V9fsPDU *pdu, V9fsFidState *fidp, } offset += err; - v9fs_init_qiov_from_pdu(&qiov_full, pdu, 0, read_count, false); - err = v9fs_pack(qiov_full.iov, qiov_full.niov, offset, + v9fs_init_qiov_from_pdu(&qiov_full, pdu, offset, read_count, false); + err = v9fs_pack(qiov_full.iov, qiov_full.niov, 0, ((char *)fidp->fs.xattr.value) + off, read_count); qemu_iovec_destroy(&qiov_full);
The current code tries to copy `read_count' bytes starting at offset `offset' from a `read_count`-sized iovec. This causes v9fs_pack() to fail with ENOBUFS. Since the PDU iovec is already partially filled with `offset' bytes, let's skip them when creating `qiov_full' and have v9fs_pack() to copy the whole of it. Moreover, this is consistent with the other places where v9fs_init_qiov_from_pdu() is called. This fixes commit "bcb8998fac16 9pfs: call v9fs_init_qiov_from_pdu before v9fs_pack". Signed-off-by: Greg Kurz <groug@kaod.org> --- v2: - pass size + skip to the init_in_iov_from_pdu callback --- hw/9pfs/9p.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)