[PATCH v2] hw/usb/dev-mtp: Fix assert crash on short CMD_SEND_OBJECT

[PATCH v2] hw/usb/dev-mtp: Fix assert crash on short CMD_SEND_OBJECT

[Tommaso Califano]

In usb_mtp_get_data() there is a guest-triggerable assertion that fires
when a guest declares a large object size in CMD_SEND_OBJECT_INFO but
sends fewer bytes in the subsequent CMD_SEND_OBJECT. The assertion
compares the declared size against the actual bytes received.

If the guest sends CMD_SEND_OBJECT_INFO with size=1000 and then
CMD_SEND_OBJECT with only 50 bytes (short, non-64-byte-aligned
final USB packet) the assertion fires, killing QEMU.

To prevent that is sufficient to remove the assertion, because the case
is handled by usb_mtp_write_data() which returns RES_INCOMPLETE_TRANSFER.

Fixes: 3e096650a64d ("dev-mtp: Add support for > 4GB file transfers")
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3993
Signed-off-by: Tommaso Califano <tcalifano@redhat.com>
---
V2:
 - Add Fixes tag.
 - Correct and improve commit message readability.

hw/usb/dev-mtp.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/hw/usb/dev-mtp.c b/hw/usb/dev-mtp.c
index 1d8cfd32dc..406793fc03 100644
--- a/hw/usb/dev-mtp.c
+++ b/hw/usb/dev-mtp.c
@@ -1813,9 +1813,6 @@ static void usb_mtp_get_data(MTPState *s, mtp_container *container,
         d->offset += dlen;
         d->data_offset += dlen;
         if ((p->iov.size % 64) || !p->iov.size) {
-            assert((s->dataset.size == 0xFFFFFFFF) ||
-                   (s->dataset.size == d->offset));
-
             if (d->length == MTP_WRITE_BUF_SZ) {
                 d->write_status = WRITE_END;
             } else {
-- 
2.56.0

Re: [PATCH v2] hw/usb/dev-mtp: Fix assert crash on short CMD_SEND_OBJECT

[Marc-André Lureau]

On Thu, Oct 8, 2026 at 4:30 PM Tommaso Califano <tcalifano@redhat.com> wrote:
>
> In usb_mtp_get_data() there is a guest-triggerable assertion that fires
> when a guest declares a large object size in CMD_SEND_OBJECT_INFO but
> sends fewer bytes in the subsequent CMD_SEND_OBJECT. The assertion
> compares the declared size against the actual bytes received.
>
> If the guest sends CMD_SEND_OBJECT_INFO with size=1000 and then
> CMD_SEND_OBJECT with only 50 bytes (short, non-64-byte-aligned
> final USB packet) the assertion fires, killing QEMU.
>
> To prevent that is sufficient to remove the assertion, because the case
> is handled by usb_mtp_write_data() which returns RES_INCOMPLETE_TRANSFER.
>
> Fixes: 3e096650a64d ("dev-mtp: Add support for > 4GB file transfers")
> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3993
> Signed-off-by: Tommaso Califano <tcalifano@redhat.com>

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>

> ---
> V2:
>  - Add Fixes tag.
>  - Correct and improve commit message readability.
>
> hw/usb/dev-mtp.c | 3 ---
>  1 file changed, 3 deletions(-)
>
> diff --git a/hw/usb/dev-mtp.c b/hw/usb/dev-mtp.c
> index 1d8cfd32dc..406793fc03 100644
> --- a/hw/usb/dev-mtp.c
> +++ b/hw/usb/dev-mtp.c
> @@ -1813,9 +1813,6 @@ static void usb_mtp_get_data(MTPState *s, mtp_container *container,
>          d->offset += dlen;
>          d->data_offset += dlen;
>          if ((p->iov.size % 64) || !p->iov.size) {
> -            assert((s->dataset.size == 0xFFFFFFFF) ||
> -                   (s->dataset.size == d->offset));
> -
>              if (d->length == MTP_WRITE_BUF_SZ) {
>                  d->write_status = WRITE_END;
>              } else {
> --
> 2.56.0
>
>


-- 
Marc-André Lureau

Re: [PATCH v2] hw/usb/dev-mtp: Fix assert crash on short CMD_SEND_OBJECT

[Luigi Leonardi]

On Thu, Oct 08, 2026 at 02:29:36PM +0200, Tommaso Califano wrote:
>In usb_mtp_get_data() there is a guest-triggerable assertion that fires
>when a guest declares a large object size in CMD_SEND_OBJECT_INFO but
>sends fewer bytes in the subsequent CMD_SEND_OBJECT. The assertion
>compares the declared size against the actual bytes received.
>
>If the guest sends CMD_SEND_OBJECT_INFO with size=1000 and then
>CMD_SEND_OBJECT with only 50 bytes (short, non-64-byte-aligned
>final USB packet) the assertion fires, killing QEMU.
>
>To prevent that is sufficient to remove the assertion, because the case
>is handled by usb_mtp_write_data() which returns RES_INCOMPLETE_TRANSFER.
>
>Fixes: 3e096650a64d ("dev-mtp: Add support for > 4GB file transfers")
>Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3993
>Signed-off-by: Tommaso Califano <tcalifano@redhat.com>

Reviewed-by: Luigi Leonardi <leonardi@redhat.com>

Re: [PATCH v2] hw/usb/dev-mtp: Fix assert crash on short CMD_SEND_OBJECT

[Philippe Mathieu-Daudé]

On 8/10/26 14:29, Tommaso Califano wrote:
> In usb_mtp_get_data() there is a guest-triggerable assertion that fires
> when a guest declares a large object size in CMD_SEND_OBJECT_INFO but
> sends fewer bytes in the subsequent CMD_SEND_OBJECT. The assertion
> compares the declared size against the actual bytes received.
> 
> If the guest sends CMD_SEND_OBJECT_INFO with size=1000 and then
> CMD_SEND_OBJECT with only 50 bytes (short, non-64-byte-aligned
> final USB packet) the assertion fires, killing QEMU.
> 
> To prevent that is sufficient to remove the assertion, because the case
> is handled by usb_mtp_write_data() which returns RES_INCOMPLETE_TRANSFER.
> 
> Fixes: 3e096650a64d ("dev-mtp: Add support for > 4GB file transfers")
> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3993
> Signed-off-by: Tommaso Califano <tcalifano@redhat.com>
> ---
> V2:
>   - Add Fixes tag.
>   - Correct and improve commit message readability.
> 
> hw/usb/dev-mtp.c | 3 ---
>   1 file changed, 3 deletions(-)

Queued via hw-misc, thanks!