Re: [PATCH] hw/i2c/pmbus_device: Fix a possible crash when requesting too many bytes

Peter Maydell <[email protected]> Mon, 22 Jun 2026 11:22:45 +0100
Newsgroups org.nongnu.qemu-trivial,org.nongnu.qemu-arm,org.nongnu.qemu-devel
Message-ID <CAFEAcA-Te1aK8J-FPdpudm-3tQW9+kDdYgAa69tYXj2_TyLgVQ@mail.gmail.com>
On Tue, 9 Jun 2026 at 17:00, Titus Rwantare <[email protected]> wrote:
>
> oops, the patch series that fixes this needs to be upstreamed.

I see we have a patch that's been submitted:
https://patchew.org/QEMU/[email protected]/
that fixes what the #3388 test case is actually running into
(guest writes a 32 byte string to a device register, and so
we lose the NUL terminator and strlen() returns a too-large
value when the guest reads the string value back).

But looking at the code it does also feel to me that there
might be a bug in what the issue report description claimed
it was testing, where the guest triggers multiple
pmbus_send_string() calls without reading back the data,
and the data piles up in the buffer and causes the assertion.

Is the patch series you want to upstream a fix to the "no NUL
terminator" problem, or to the "multiple send_string calls
fill the buffer" problem?

thanks
-- PMM