[PATCH] hw/usb: Fix guest-triggerable assert crash via short CMD_SEND_OBJECT

[PATCH] hw/usb: Fix guest-triggerable assert crash via short CMD_SEND_OBJECT

[Tommaso Califano]

QEMU's USB MTP device has a guest-triggerable assertion in
usb_mtp_get_data() that fires when a guest declares a large object
size in CMD_SEND_OBJECT_INFO but sends fewer bytes in the
subsequent CMD_SEND_OBJECT. The assertion compares the declared
size against the actual bytes received.

If the guest sends CMD_SEND_OBJECT_INFO with size=1000 and then
CMD_SEND_OBJECT with only 50 bytes (short, non-64-byte-aligned
final USB packet) the assertion fire killing QEMU.

To prevent that is sufficient to remove the assertion, becouse the case
is handled by usb_mtp_write_data() which return RES_INCOMPLETE_TRANSFER.

Resolve: https://gitlab.com/qemu-project/qemu/-/work_items/3993
Signed-off-by: Tommaso Califano <tcalifan@redhat.com>
---
 hw/usb/dev-mtp.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/hw/usb/dev-mtp.c b/hw/usb/dev-mtp.c
index 1d8cfd32dc..406793fc03 100644
--- a/hw/usb/dev-mtp.c
+++ b/hw/usb/dev-mtp.c
@@ -1813,9 +1813,6 @@ static void usb_mtp_get_data(MTPState *s, mtp_container *container,
         d->offset += dlen;
         d->data_offset += dlen;
         if ((p->iov.size % 64) || !p->iov.size) {
-            assert((s->dataset.size == 0xFFFFFFFF) ||
-                   (s->dataset.size == d->offset));
-
             if (d->length == MTP_WRITE_BUF_SZ) {
                 d->write_status = WRITE_END;
             } else {
-- 
2.55.0

Re: [PATCH] hw/usb: Fix guest-triggerable assert crash via short CMD_SEND_OBJECT

[Luigi Leonardi]

Ciao Tommaso,

On Thu, Sep 17, 2026 at 05:05:03PM +0200, Tommaso Califano wrote:
>QEMU's USB MTP device has a guest-triggerable assertion in
>usb_mtp_get_data() that fires when a guest declares a large object
>size in CMD_SEND_OBJECT_INFO but sends fewer bytes in the
>subsequent CMD_SEND_OBJECT. The assertion compares the declared
>size against the actual bytes received.
>
>If the guest sends CMD_SEND_OBJECT_INFO with size=1000 and then
>CMD_SEND_OBJECT with only 50 bytes (short, non-64-byte-aligned
>final USB packet) the assertion fire killing QEMU.
>
>To prevent that is sufficient to remove the assertion, becouse the case

/s/becouse/because

>is handled by usb_mtp_write_data() which return RES_INCOMPLETE_TRANSFER.
>

Fixes tag and CC qemu stable?

>Resolve: https://gitlab.com/qemu-project/qemu/-/work_items/3993

/s/Resolve/Resolves

>Signed-off-by: Tommaso Califano <tcalifan@redhat.com>
>---
> hw/usb/dev-mtp.c | 3 ---
> 1 file changed, 3 deletions(-)
>
>diff --git a/hw/usb/dev-mtp.c b/hw/usb/dev-mtp.c
>index 1d8cfd32dc..406793fc03 100644
>--- a/hw/usb/dev-mtp.c
>+++ b/hw/usb/dev-mtp.c
>@@ -1813,9 +1813,6 @@ static void usb_mtp_get_data(MTPState *s, mtp_container *container,
>         d->offset += dlen;
>         d->data_offset += dlen;
>         if ((p->iov.size % 64) || !p->iov.size) {
>-            assert((s->dataset.size == 0xFFFFFFFF) ||
>-                   (s->dataset.size == d->offset));
>-
>             if (d->length == MTP_WRITE_BUF_SZ) {
>                 d->write_status = WRITE_END;
>             } else {
>-- 
>2.55.0
>
>

That said, code LGTM, with the changes i suggested:

Reviewed-by: Luigi Leonardi <leonardi@redhat.com>

Thanks,
Luigi