From: Tommaso Califano <[email protected]>
In usb_mtp_get_data() there is a guest-triggerable assertion that fires
when a guest declares a large object size in CMD_SEND_OBJECT_INFO but
sends fewer bytes in the subsequent CMD_SEND_OBJECT. The assertion
compares the declared size against the actual bytes received.
If the guest sends CMD_SEND_OBJECT_INFO with size=1000 and then
CMD_SEND_OBJECT with only 50 bytes (short, non-64-byte-aligned
final USB packet) the assertion fires, killing QEMU.
To prevent that is sufficient to remove the assertion, because the case
is handled by usb_mtp_write_data() which returns RES_INCOMPLETE_TRANSFER.
Fixes: 3e096650a64d ("dev-mtp: Add support for > 4GB file transfers")
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3993
Signed-off-by: Tommaso Califano <[email protected]>
Reviewed-by: Luigi Leonardi <[email protected]>
Reviewed-by: Marc-André Lureau <[email protected]>
Message-ID: <[email protected]>
Signed-off-by: Thomas Huth <[email protected]>
---
hw/usb/dev-mtp.c | 3 ---
1 file changed, 3 deletions(-)
diff --git a/hw/usb/dev-mtp.c b/hw/usb/dev-mtp.c
index cbc2be3317f..9048cddaaba 100644
--- a/hw/usb/dev-mtp.c
+++ b/hw/usb/dev-mtp.c
@@ -1813,9 +1813,6 @@ static void usb_mtp_get_data(MTPState *s, mtp_container
*container,
d->offset += dlen;
d->data_offset += dlen;
if ((p->iov.size % 64) || !p->iov.size) {
- assert((s->dataset.size == 0xFFFFFFFF) ||
- (s->dataset.size == d->offset));
-
if (d->length == MTP_WRITE_BUF_SZ) {
d->write_status = WRITE_END;
} else {
--
2.56.0
