From nobody Sat Jul 25 08:30:36 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1784717387140721.3337454254545; Wed, 22 Jul 2026 03:49:47 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wmUVY-0006OK-Qn; Wed, 22 Jul 2026 06:49:00 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wmUVW-0006NN-TB; Wed, 22 Jul 2026 06:48:58 -0400 Received: from proxmox-new.maurer-it.com ([94.136.29.106]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wmUVU-0000Ku-Ss; Wed, 22 Jul 2026 06:48:58 -0400 Received: from proxmox-new.maurer-it.com (localhost.localdomain [127.0.0.1]) by proxmox-new.maurer-it.com (Proxmox) with ESMTP id CB570C6E99; Wed, 22 Jul 2026 12:48:43 +0200 (CEST) From: Fiona Ebner To: qemu-devel@nongnu.org Cc: jsnow@redhat.com, qemu-block@nongnu.org, qemu-stable@nongnu.org, thuth@redhat.com Subject: [PATCH v2] hw/ide: replace assert with proper error handling Date: Wed, 22 Jul 2026 12:41:11 +0200 Message-ID: <20260722104836.351387-1-f.ebner@proxmox.com> X-Mailer: git-send-email 2.47.3 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1784717294998 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=94.136.29.106; envelope-from=f.ebner@proxmox.com; helo=proxmox-new.maurer-it.com X-Spam_score_int: -25 X-Spam_score: -2.6 X-Spam_bar: -- X-Spam_report: (-2.6 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZM-MESSAGEID: 1784717391783158500 Content-Type: text/plain; charset="utf-8" From: Artem Nasonov In ide_dma_cb(), the call to prepare_buf() might return a negative result and cause an assertion failure. This was found during fuzzing and can be triggered with some qtest commands. Replace the assert with proper error handling in case the result is negative, but keep the assert for failing to respect the limit upon success. If that happens, it is an implementation error. Found by Linux Verification Center (linuxtesting.org) with libFuzzer. Cc: qemu-stable@nongnu.org Fixes: ed78352a59 ("ide: Fix incorrect handling of some PRDTs in ide_dma_cb= ()") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/2777 Signed-off-by: Artem Nasonov Link: https://lore.kernel.org/qemu-devel/20250116111600.2570490-1-anasonov@= astralinux.ru [FE: improve commit message keep assert for failing to respect the limit] Signed-off-by: Fiona Ebner Reviewed-by: Thomas Huth --- Changes in v2: * Update the code comment accordingly. * Keep the assert() when the limit is not respected upon success. hw/ide/core.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/hw/ide/core.c b/hw/ide/core.c index f78b00220b..4c1ee19d8e 100644 --- a/hw/ide/core.c +++ b/hw/ide/core.c @@ -921,8 +921,12 @@ static void ide_dma_cb(void *opaque, int ret) s->io_buffer_index =3D 0; s->io_buffer_size =3D n * 512; prep_size =3D s->bus->dma->ops->prepare_buf(s->bus->dma, s->io_buffer_= size); - /* prepare_buf() must succeed and respect the limit */ - assert(prep_size >=3D 0 && prep_size <=3D n * 512); + if (prep_size < 0) { + ide_dma_error(s); + return; + } + /* If prepare_buf() succeeds, it must respect the limit. */ + assert(prep_size <=3D n * 512); =20 /* * Now prep_size stores the number of bytes in the sglist, and --=20 2.47.3