Re: [PATCH] hw/usb/hcd-xhci: Check return value of xhci_xfer_create_sgl() for errors

Peter Maydell <[email protected]> Mon, 27 Jul 2026 10:56:46 +0100
Newsgroups org.nongnu.qemu-trivial,org.nongnu.qemu-devel
Message-ID <CAFEAcA8C6vBF_d5VeH23cqU0OjmQNtn9YqALLD_sD+t0YvgG+g@mail.gmail.com>
On Fri, 24 Jul 2026 at 12:10, Thomas Huth <[email protected]> wrote:
>
> From: Thomas Huth <[email protected]>
>
> xhci_xfer_create_sgl() can fail if a guest programmed the XHCI in
> a weird way. The current code ignores this error, and this triggers
> an assert() shortly afterwards:
>
>  hw/usb/core.c:612: usb_packet_copy:
>   Assertion `p->actual_length + bytes <= iov->size' failed.
>
> Fix it by handling the error correctly (i.e. return with an error to
> the caller).
>
> While we're at it, change the DPRINTF statements in xhci_xfer_create_sgl()
> into proper qemu_log_mask() statements, so we have a better way to detect
> this situation.
>
> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3786
> Reported-by: Feifan Qian <[email protected]>
> Signed-off-by: Thomas Huth <[email protected]>

Reviewed-by: Peter Maydell <[email protected]>

thanks
-- PMM