From 5b337b903152d8ee780f36c8f7c8d2a1040ed2b9 Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Tue, 22 Jul 2014 09:16:00 -0500
Subject: [CHANGE 11/17] scsi-disk: fix check for out-of-range LBA
To: rhvirt-patches@redhat.com,
    jen@redhat.com

RH-Author: Markus Armbruster <armbru@redhat.com>
Message-id: <1406020565-25364-7-git-send-email-armbru@redhat.com>
Patchwork-id: 60002
O-Subject: [PATCH 6.6 qemu-kvm v2 06/11] scsi-disk: fix check for out-of-range LBA
Bugzilla: 1064643
RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
RH-Acked-by: Fam Zheng <famz@redhat.com>
RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>

From: Paolo Bonzini <pbonzini@redhat.com>

This fix is needed to correctly handle 0-block read and writes.
Without it, a 0-block access at LBA 0 would underflow.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit 12ca76fc48081b3a0ad1a70546abfcf198aedfc4)
Signed-off-by: Markus Armbruster <armbru@redhat.com>
---
 hw/scsi-disk.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

Signed-off-by: jen <jen@redhat.com>
---
 hw/scsi-disk.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/hw/scsi-disk.c b/hw/scsi-disk.c
index ee48f53..9eaf5b9 100644
--- a/hw/scsi-disk.c
+++ b/hw/scsi-disk.c
@@ -1214,9 +1214,13 @@ static inline bool check_lba_range(SCSIDiskState *s,
      * The first line tests that no overflow happens when computing the last
      * sector.  The second line tests that the last accessed sector is in
      * range.
+     *
+     * Careful, the computations should not underflow for nb_sectors == 0,
+     * and a 0-block read to the first LBA beyond the end of device is
+     * valid.
      */
     return (sector_num <= sector_num + nb_sectors &&
-            sector_num + nb_sectors - 1 <= s->qdev.max_lba);
+            sector_num + nb_sectors <= s->qdev.max_lba + 1);
 }
 
 static int scsi_disk_emulate_command(SCSIDiskReq *r)
-- 
1.9.3

