diff --git a/0001-block-Don-t-check-permissions-for-copy-on-read.patch b/0001-block-Don-t-check-permissions-for-copy-on-read.patch
new file mode 100644
index 0000000..9403ec5
--- /dev/null
+++ b/0001-block-Don-t-check-permissions-for-copy-on-read.patch
@@ -0,0 +1,40 @@
+From 1bf03e66fd03af46ff0f98dd04b6e28f432ac1e3 Mon Sep 17 00:00:00 2001
+From: Kevin Wolf <kwolf@redhat.com>
+Date: Fri, 7 Apr 2017 12:29:05 +0200
+Subject: [PATCH] block: Don't check permissions for copy on read
+
+The assertion is currently failing. We can't require callers to have
+write permissions when all they are doing is a read, so comment it out.
+Add a FIXME comment in the code so that the check is re-enabled when
+copy on read is refactored into its own filter driver.
+
+Reported-by: Richard W.M. Jones <rjones@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+Reviewed-by: Richard W.M. Jones <rjones@redhat.com>
+---
+ block/io.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/block/io.c b/block/io.c
+index 2709a7007f..7321ddab3d 100644
+--- a/block/io.c
++++ b/block/io.c
+@@ -945,7 +945,14 @@ static int coroutine_fn bdrv_co_do_copy_on_readv(BdrvChild *child,
+     size_t skip_bytes;
+     int ret;
+ 
+-    assert(child->perm & (BLK_PERM_WRITE_UNCHANGED | BLK_PERM_WRITE));
++    /* FIXME We cannot require callers to have write permissions when all they
++     * are doing is a read request. If we did things right, write permissions
++     * would be obtained anyway, but internally by the copy-on-read code. As
++     * long as it is implemented here rather than in a separat filter driver,
++     * the copy-on-read code doesn't have its own BdrvChild, however, for which
++     * it could request permissions. Therefore we have to bypass the permission
++     * system for the moment. */
++    // assert(child->perm & (BLK_PERM_WRITE_UNCHANGED | BLK_PERM_WRITE));
+ 
+     /* Cover entire cluster so no additional backing file I/O is required when
+      * allocating cluster in the image file.
+-- 
+2.12.0
+
diff --git a/qemu.spec b/qemu.spec
index 5d9e0f9..fb494b3 100644
--- a/qemu.spec
+++ b/qemu.spec
@@ -92,7 +92,7 @@ Requires: %{name}-block-ssh = %{epoch}:%{version}-%{release}
 Summary: QEMU is a FAST! processor emulator
 Name: qemu
 Version: 2.9.0
-Release: 0.1%{?rcrel}%{?dist}
+Release: 0.2%{?rcrel}%{?dist}
 Epoch: 2
 License: GPLv2+ and LGPLv2+ and BSD
 Group: Development/Tools
@@ -126,6 +126,9 @@ Source21: 50-kvm-s390x.conf
 # /etc/security/limits.d/95-kvm-ppc64-memlock.conf
 Source22: 95-kvm-ppc64-memlock.conf
 
+# Upstream commit 1bf03e66fd03af46ff0f98dd04b6e28f432ac1e3.
+Patch1: 0001-block-Don-t-check-permissions-for-copy-on-read.patch
+
 # documentation deps
 BuildRequires: texinfo
 # For /usr/bin/pod2man
@@ -2000,6 +2003,9 @@ getent passwd qemu >/dev/null || \
 
 
 %changelog
+* Sat Apr 08 2017 Richard W.M. Jones <rjones@redhat.com> - 2:2.9.0-0.2-rc3
+- Backport upstream fix for assertion when copy-on-read=true (RHBZ#1439922).
+
 * Tue Apr 04 2017 Cole Robinson <crobinso@redhat.com> - 2:2.9.0-0.1-rc3
 - Rebase to qemu-2.9.0-rc3