Ciao Tommaso,
On Thu, Sep 17, 2026 at 05:05:03PM +0200, Tommaso Califano wrote:
QEMU's USB MTP device has a guest-triggerable assertion in
usb_mtp_get_data() that fires when a guest declares a large object
size in CMD_SEND_OBJECT_INFO but sends fewer bytes in the
subsequent CMD_SEND_OBJECT. The assertion compares the declared
size against the actual bytes received.
If the guest sends CMD_SEND_OBJECT_INFO with size=1000 and then
CMD_SEND_OBJECT with only 50 bytes (short, non-64-byte-aligned
final USB packet) the assertion fire killing QEMU.
To prevent that is sufficient to remove the assertion, becouse the case
/s/becouse/because
is handled by usb_mtp_write_data() which return RES_INCOMPLETE_TRANSFER.
Fixes tag and CC qemu stable?
Resolve: https://gitlab.com/qemu-project/qemu/-/work_items/3993
/s/Resolve/Resolves
Signed-off-by: Tommaso Califano <[email protected]>
---
hw/usb/dev-mtp.c | 3 ---
1 file changed, 3 deletions(-)
diff --git a/hw/usb/dev-mtp.c b/hw/usb/dev-mtp.c
index 1d8cfd32dc..406793fc03 100644
--- a/hw/usb/dev-mtp.c
+++ b/hw/usb/dev-mtp.c
@@ -1813,9 +1813,6 @@ static void usb_mtp_get_data(MTPState *s, mtp_container
*container,
d->offset += dlen;
d->data_offset += dlen;
if ((p->iov.size % 64) || !p->iov.size) {
- assert((s->dataset.size == 0xFFFFFFFF) ||
- (s->dataset.size == d->offset));
-
if (d->length == MTP_WRITE_BUF_SZ) {
d->write_status = WRITE_END;
} else {
--
2.55.0
That said, code LGTM, with the changes i suggested:
Reviewed-by: Luigi Leonardi <[email protected]>
Thanks,
Luigi
