From fa0eb5c512d17a223d9f9bac45da48d78d12f584 Mon Sep 17 00:00:00 2001 From: Greg Kurz Date: Wed, 25 Jan 2017 00:23:49 +0100 Subject: [PATCH] 9pfs: fix offset error in v9fs_xattr_read() The current code tries to copy `read_count' bytes starting at offset `offset' from a `read_count`-sized iovec. This causes v9fs_pack() to fail with ENOBUFS. Since the PDU iovec is already partially filled with `offset' bytes, let's skip them when creating `qiov_full' and have v9fs_pack() to copy the whole of it. Moreover, this is consistent with the other places where v9fs_init_qiov_from_pdu() is called. This fixes commit "bcb8998fac16 9pfs: call v9fs_init_qiov_from_pdu before v9fs_pack". Signed-off-by: Greg Kurz Reviewed-by: Stefano Stabellini --- hw/9pfs/9p.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c index d2d0288282..138d8e825d 100644 --- a/hw/9pfs/9p.c +++ b/hw/9pfs/9p.c @@ -1655,7 +1655,7 @@ static void v9fs_init_qiov_from_pdu(QEMUIOVector *qiov, V9fsPDU *pdu, if (is_write) { pdu->s->transport->init_out_iov_from_pdu(pdu, &iov, &niov); } else { - pdu->s->transport->init_in_iov_from_pdu(pdu, &iov, &niov, size); + pdu->s->transport->init_in_iov_from_pdu(pdu, &iov, &niov, size + skip); } qemu_iovec_init_external(&elem, iov, niov); @@ -1685,8 +1685,8 @@ static int v9fs_xattr_read(V9fsState *s, V9fsPDU *pdu, V9fsFidState *fidp, } offset += err; - v9fs_init_qiov_from_pdu(&qiov_full, pdu, 0, read_count, false); - err = v9fs_pack(qiov_full.iov, qiov_full.niov, offset, + v9fs_init_qiov_from_pdu(&qiov_full, pdu, offset, read_count, false); + err = v9fs_pack(qiov_full.iov, qiov_full.niov, 0, ((char *)fidp->fs.xattr.value) + off, read_count); qemu_iovec_destroy(&qiov_full); -- GitLab