Re: [PATCH] hw/usb/dev-mtp: Fix assert crash on undersized BULK IN

[Luigi Leonardi <leonardi@redhat.com>]

On Mon, Oct 12, 2026 at 04:08:38PM +0200, Tommaso Califano wrote:
>The EP_DATA_IN result path serializes the queued response as a 12
>byte MTP container header followed by one 4 byte word per result
>argument (12 + 4 * argc bytes).  The entry check at the top of the
>function only verifies that the guest-provided transfer buffer holds
>at least the 12 byte header.
>
>If the queued result carries arguments, e.g. RES_SESSION_ALREADY_OPEN
>which returns the existing session ID, the second usb_packet_copy()
>writes past the end of the guest-declared buffer and trips the
>p->actual_length + bytes <= iov->size assertion, aborting QEMU.  A
>guest can control the transfer size freely, e.g. TBYTES in the qTD
>of an EHCI BULK IN.
>
>A device must not send more data than the initiator signaled it would
>accept. Stall the transfer instead, and keep the result queued so that
>a subsequent BULK IN with a sufficient buffer size delivers the full
>response.
>
>Fixes: 840a178c94db ("usb: mtp filesharing")
>Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3386
>Signed-off-by: Tommaso Califano <tcalifano@redhat.com>
>---

code LGTM!

Reviewed-by: Luigi Leonardi <leonardi@redhat.com>

Thanks,
Luigi