From 837b039ab821e95da57449c254b4f903815e56b6 Mon Sep 17 00:00:00 2001
From: Jason Dillaman <dillaman@redhat.com>
Date: Mon, 27 Feb 2017 20:24:48 -0500
Subject: [PATCH] librbd: image-extent cache needs to clip out-of-bounds read
 buffers

Signed-off-by: Jason Dillaman <dillaman@redhat.com>
---
 src/librbd/io/ImageRequest.cc | 17 ++++++++++++++++-
 src/librbd/io/ImageRequest.h  |  2 ++
 2 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/src/librbd/io/ImageRequest.cc b/src/librbd/io/ImageRequest.cc
index e2b873d067318..4ad28fe4cbd2f 100644
--- a/src/librbd/io/ImageRequest.cc
+++ b/src/librbd/io/ImageRequest.cc
@@ -203,6 +203,22 @@ ImageReadRequest<I>::ImageReadRequest(I &image_ctx, AioCompletion *aio_comp,
   aio_comp->read_result = std::move(read_result);
 }
 
+template <typename I>
+int ImageReadRequest<I>::clip_request() {
+  int r = ImageRequest<I>::clip_request();
+  if (r < 0) {
+    return r;
+  }
+
+  uint64_t buffer_length = 0;
+  auto &image_extents = this->m_image_extents;
+  for (auto &image_extent : image_extents) {
+    buffer_length += image_extent.second;
+  }
+  this->m_aio_comp->read_result.set_clip_length(buffer_length);
+  return 0;
+}
+
 template <typename I>
 void ImageReadRequest<I>::send_request() {
   I &image_ctx = this->m_image_ctx;
@@ -236,7 +252,6 @@ void ImageReadRequest<I>::send_request() {
       buffer_ofs += extent.second;
     }
   }
-  aio_comp->read_result.set_clip_length(buffer_ofs);
 
   // pre-calculate the expected number of read requests
   uint32_t request_count = 0;
diff --git a/src/librbd/io/ImageRequest.h b/src/librbd/io/ImageRequest.h
index 0bdca22e63b25..96629b81636ad 100644
--- a/src/librbd/io/ImageRequest.h
+++ b/src/librbd/io/ImageRequest.h
@@ -83,6 +83,8 @@ public:
                    int op_flags);
 
 protected:
+  int clip_request() override;
+
   void send_request() override;
   void send_image_cache_request() override;
 
-- 
2.39.5