Commit 15700a66ec for qemu.org

commit 15700a66ecb53c52717c913c2c4501372c0115ab
Author: Thomas Huth <thuth@redhat.com>
Date:   Thu Jul 30 18:39:01 2026 +0200

    hw/usb/dev-uas: Don't abort if guest provided an undersized buffer for status

    QEMU currently aborts if the guest provides an undersized buffer
    for the status packet (8 bytes):

     hw/usb/core.c:623: usb_packet_copy:
      Assertion `p->actual_length + bytes <= iov->size' failed.

    If we hit this situation, log a guest error and continue by simply
    only providing the bytes that the guest asked for.
    (Note: This is e.g. similar to the UAS_PIPE_ID_COMMAND case that
    also clamps the length with: length = MIN(sizeof(iu), p->iov.size))

    Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3900
    Reported-by: Feifan Qian <bea1e@proton.me>
    Signed-off-by: Thomas Huth <thuth@redhat.com>
    Message-ID: <20260730163901.1154791-1-thuth@redhat.com>

diff --git a/hw/usb/dev-uas.c b/hw/usb/dev-uas.c
index 963c0433b3..be8c3667e8 100644
--- a/hw/usb/dev-uas.c
+++ b/hw/usb/dev-uas.c
@@ -359,6 +359,7 @@ static void usb_uas_send_status_bh(void *opaque)
     UASDevice *uas = opaque;
     UASStatus *st;
     USBPacket *p;
+    uint32_t length;

     while ((st = QTAILQ_FIRST(&uas->results)) != NULL) {
         if (uas_using_streams(uas)) {
@@ -373,7 +374,14 @@ static void usb_uas_send_status_bh(void *opaque)
             break;
         }

-        usb_packet_copy(p, &st->status, st->length);
+        length = st->length;
+        if (length > p->iov.size) {
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "usb uas: packet (%zd) too small for status (%d)\n",
+                          p->iov.size, length);
+            length = p->iov.size;
+        }
+        usb_packet_copy(p, &st->status, length);
         QTAILQ_REMOVE(&uas->results, st, next);
         g_free(st);

@@ -875,7 +883,14 @@ static void usb_uas_handle_data(USBDevice *dev, USBPacket *p)
                 break;
             }
         }
-        usb_packet_copy(p, &st->status, st->length);
+        length = st->length;
+        if (length > p->iov.size) {
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "usb uas: packet (%zd) too small for status (%d)\n",
+                          p->iov.size, length);
+            length = p->iov.size;
+        }
+        usb_packet_copy(p, &st->status, length);
         QTAILQ_REMOVE(&uas->results, st, next);
         g_free(st);
         break;