Re: [PATCH] hw/i2c/pmbus_device: Fix a possible crash when requesting too many bytes
Peter Maydell <[email protected]> Mon, 22 Jun 2026 11:22:45 +0100
| Newsgroups | org.nongnu.qemu-trivial,org.nongnu.qemu-arm,org.nongnu.qemu-devel |
|---|---|
| Message-ID | <CAFEAcA-Te1aK8J-FPdpudm-3tQW9+kDdYgAa69tYXj2_TyLgVQ@mail.gmail.com> |
On Tue, 9 Jun 2026 at 17:00, Titus Rwantare <[email protected]> wrote: > > oops, the patch series that fixes this needs to be upstreamed. I see we have a patch that's been submitted: https://patchew.org/QEMU/[email protected]/ that fixes what the #3388 test case is actually running into (guest writes a 32 byte string to a device register, and so we lose the NUL terminator and strlen() returns a too-large value when the guest reads the string value back). But looking at the code it does also feel to me that there might be a bug in what the issue report description claimed it was testing, where the guest triggers multiple pmbus_send_string() calls without reading back the data, and the data piles up in the buffer and causes the assertion. Is the patch series you want to upstream a fix to the "no NUL terminator" problem, or to the "multiple send_string calls fill the buffer" problem? thanks -- PMM