Commit 58ac3211 authored by Markus Armbruster's avatar Markus Armbruster Committed by Kevin Wolf
Browse files

ide: Treat read/write beyond end as invalid 



The block layer fails such reads and writes just fine.  However, they
then get treated like valid operations that fail: the error action
gets executed.  Unwanted; reporting the error to the guest is the only
sensible action.

Reject them before passing them to the block layer.  This bypasses the
error action and I/O accounting.  Not quite correct for DMA, because
DMA can fail after some success, and when that happens, the part that
succeeded isn't counted.  Tolerable, because I/O accounting is an
inconsistent mess anyway.

Signed-off-by: default avatarMarkus Armbruster <armbru@redhat.com>
Signed-off-by: default avatarKevin Wolf <kwolf@redhat.com>
parent 3c2daac0

hw/ide/core.c

+28 −0
Original line number Diff line number Diff line
@@ -499,6 +499,18 @@ static void ide_rw_error(IDEState *s) { 
    ide_set_irq(s->bus);

}



static bool ide_sect_range_ok(IDEState *s,

                              uint64_t sector, uint64_t nb_sectors)

{

    uint64_t total_sectors;



    bdrv_get_geometry(s->bs, &total_sectors);

    if (sector > total_sectors || nb_sectors > total_sectors - sector) {

        return false;

    }

    return true;

}



static void ide_sector_read_cb(void *opaque, int ret)

{

    IDEState *s = opaque;
@@ -554,6 +566,11 @@ void ide_sector_read(IDEState *s) 
    printf("sector=%" PRId64 "\n", sector_num);

#endif



    if (!ide_sect_range_ok(s, sector_num, n)) {

        ide_rw_error(s);

        return;

    }



    s->iov.iov_base = s->io_buffer;

    s->iov.iov_len  = n * BDRV_SECTOR_SIZE;

    qemu_iovec_init_external(&s->qiov, &s->iov, 1);
@@ -671,6 +688,12 @@ void ide_dma_cb(void *opaque, int ret) 
           sector_num, n, s->dma_cmd);

#endif



    if (!ide_sect_range_ok(s, sector_num, n)) {

        dma_buf_commit(s);

        ide_dma_error(s);

        return;

    }



    switch (s->dma_cmd) {

    case IDE_DMA_READ:

        s->bus->dma->aiocb = dma_bdrv_read(s->bs, &s->sg, sector_num,
@@ -790,6 +813,11 @@ void ide_sector_write(IDEState *s) 
        n = s->req_nb_sectors;

    }



    if (!ide_sect_range_ok(s, sector_num, n)) {

        ide_rw_error(s);

        return;

    }



    s->iov.iov_base = s->io_buffer;

    s->iov.iov_len  = n * BDRV_SECTOR_SIZE;

    qemu_iovec_init_external(&s->qiov, &s->iov, 1);