[Qemu-devel] [PATCH 2/2] virtio-blk: fix length calculations for write operations.

[Rusty Russell]

We only fill in the 'req->qiov.size' bytes on a (successful) read,
not on a write.

Signed-off-by: Rusty Russell <ru...@rustcorp.com.au>
---
 hw/block/virtio-blk.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
index 258bb4c..98d87a9 100644
--- a/hw/block/virtio-blk.c
+++ b/hw/block/virtio-blk.c
@@ -50,11 +50,19 @@ static void virtio_blk_complete_request(VirtIOBlockReq *req,
 {
     VirtIOBlock *s = req->dev;
     VirtIODevice *vdev = VIRTIO_DEVICE(s);
+    int type = virtio_ldl_p(VIRTIO_DEVICE(req->dev), &req->out.type);
 
     trace_virtio_blk_req_complete(req, status);
 
     stb_p(&req->in->status, status);
-    virtqueue_push(s->vq, &req->elem, req->qiov.size + sizeof(*req->in));
+
+    /* If we didn't succeed, we *may* have written more, but don't
+     * count on it. */
+    if (type == VIRTIO_BLK_T_IN && status == VIRTIO_BLK_S_OK) {
+        virtqueue_push(s->vq, &req->elem, req->qiov.size + sizeof(*req->in));
+    } else {
+        virtqueue_push(s->vq, &req->elem, sizeof(*req->in));
+    }
     virtio_notify(vdev, s->vq);
 }
 
-- 
2.1.0