From 87a57bfe88be0ee73b4014830989ff250f6caebd Mon Sep 17 00:00:00 2001
From: Kevin Wolf <kwolf@redhat.com>
Date: Fri, 22 Jan 2010 13:49:12 -0200
Subject: [PATCH 3/3] block-raw-posix: Abort on pread beyond end of file

RH-Author: Kevin Wolf <kwolf@redhat.com>
Message-id: <1264168152-28398-1-git-send-email-kwolf@redhat.com>
Patchwork-id: 6546
O-Subject: [RHEL-5.5 KVM PATCH] block-raw-posix: Abort on pread beyond end of
	file
Bugzilla: 515655
RH-Acked-by: Glauber Costa <glommer@redhat.com>
RH-Acked-by: Juan Quintela <quintela@redhat.com>
RH-Acked-by: Gleb Natapov <gleb@redhat.com>

Bugzilla: 515655
Upstream status: Submitted

This shouldn't happen under any normal circumstances. However, it looks like
it's possible to achieve this with corrupted images. Without this patch
raw_pread is hanging in an endless loop in such cases.

The code change is exactly the same as upstream, however surrounding code has
changed a bit. The most important change is that in RHEL 5, raw_pread/pwrite
are still directly exported as implementation for bdrv_pread/pwrite whereas in
current upstream bdrv_pread/pwrite are always emulated.

For upstream it's critical to allow pread after EOF for growable files because
bdrv_pwrite involves bdrv_pread in a read-modify-write cycle. This is not the
case in RHEL 5 code, where raw_pwrite bypasses raw_pread (which is the function
that could hang/abort).

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 qemu/block-raw-posix.c |    6 +++++-
 1 files changed, 5 insertions(+), 1 deletions(-)

Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
---
 qemu/block-raw-posix.c |    6 +++++-
 1 files changed, 5 insertions(+), 1 deletions(-)

diff --git a/qemu/block-raw-posix.c b/qemu/block-raw-posix.c
index 1e46e03..db7bdb8 100644
--- a/qemu/block-raw-posix.c
+++ b/qemu/block-raw-posix.c
@@ -332,8 +332,12 @@ static int raw_pread(BlockDriverState *bs, int64_t offset,
                     size = ALIGNED_BUFFER_SIZE;
 
                 ret = raw_pread_aligned(bs, offset, s->aligned_buf, size);
-                if (ret < 0)
+                if (ret < 0) {
                     return ret;
+                } else if (ret == 0) {
+                    fprintf(stderr, "raw_pread: read beyond end of file\n");
+                    abort();
+                }
 
                 size = ret;
                 if (size > count)
-- 
1.6.3.rc4.29.g8146