When documenting the invariant that mode pages need to fit the smallest
output buffer of all callers (which is SCSI_MAX_MODE_LEN), the expression
used by the assertion was incorrect.

Even though SCSI_MAX_MODE_LEN is indeed 256, using "length < 256" had
two issues: 1) it used the wrong operator, since "length < ..." is more
related to having room for extra data; 2) it missed the extra two bytes
for page number and length.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/scsi/scsi-disk.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c
index 85d0bd0b811..1b0cce128c5 100644
--- a/hw/scsi/scsi-disk.c
+++ b/hw/scsi/scsi-disk.c
@@ -1321,7 +1321,7 @@ static int mode_sense_page(SCSIDiskState *s, int page, uint8_t **p_outbuf,
         return -1;
     }
 
-    assert(length < 256);
+    assert(length + 2 <= SCSI_MAX_MODE_LEN);
     (*p_outbuf)[0] = page;
     (*p_outbuf)[1] = length;
     *p_outbuf += length + 2;
-- 
2.55.0

On 7/21/26 19:19, Paolo Bonzini wrote:
> When documenting the invariant that mode pages need to fit the smallest
> output buffer of all callers (which is SCSI_MAX_MODE_LEN), the expression
> used by the assertion was incorrect.
> 
> Even though SCSI_MAX_MODE_LEN is indeed 256, using "length < 256" had
> two issues: 1) it used the wrong operator, since "length < ..." is more
> related to having room for extra data; 2) it missed the extra two bytes
> for page number and length.
> 
> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
> ---
>   hw/scsi/scsi-disk.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)

It hitting this assert possible during normal operations?
I'm picking this up for qemu-stable.
Please let me know if I shoudn't.

Thanks,

/mjt

On 21/7/26 18:19, Paolo Bonzini wrote:
> When documenting the invariant that mode pages need to fit the smallest
> output buffer of all callers (which is SCSI_MAX_MODE_LEN), the expression
> used by the assertion was incorrect.
> 
> Even though SCSI_MAX_MODE_LEN is indeed 256, using "length < 256" had
> two issues: 1) it used the wrong operator, since "length < ..." is more
> related to having room for extra data; 2) it missed the extra two bytes
> for page number and length.
> 
> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
> ---
>   hw/scsi/scsi-disk.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)

Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>