On 22/7/26 12:41, Fiona Ebner wrote:
From: Artem Nasonov <[email protected]>
In ide_dma_cb(), the call to prepare_buf() might return a negative
result and cause an assertion failure. This was found during fuzzing
and can be triggered with some qtest commands. Replace the assert with
proper error handling in case the result is negative, but keep the
assert for failing to respect the limit upon success. If that happens,
it is an implementation error.
Found by Linux Verification Center (linuxtesting.org) with libFuzzer.
Cc: [email protected]
Fixes: ed78352a59 ("ide: Fix incorrect handling of some PRDTs in ide_dma_cb()")
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/2777
Signed-off-by: Artem Nasonov <[email protected]>
Link:
https://lore.kernel.org/qemu-devel/[email protected]
[FE: improve commit message
keep assert for failing to respect the limit]
Signed-off-by: Fiona Ebner <[email protected]>
---
Changes in v2:
* Update the code comment accordingly.
* Keep the assert() when the limit is not respected upon success.
hw/ide/core.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
Merged as 443e02410695b35a27fad18217424b6370358be7.
