QEMU's USB MTP device has a guest-triggerable assertion in
usb_mtp_get_data() that fires when a guest declares a large object
size in CMD_SEND_OBJECT_INFO but sends fewer bytes in the
subsequent CMD_SEND_OBJECT. The assertion compares the declared
size against the actual bytes received.

If the guest sends CMD_SEND_OBJECT_INFO with size=1000 and then
CMD_SEND_OBJECT with only 50 bytes (short, non-64-byte-aligned
final USB packet) the assertion fire killing QEMU.

To prevent that is sufficient to remove the assertion, becouse the case
is handled by usb_mtp_write_data() which return RES_INCOMPLETE_TRANSFER.

Resolve: https://gitlab.com/qemu-project/qemu/-/work_items/3993
Signed-off-by: Tommaso Califano <tcalifan@redhat.com>
---
 hw/usb/dev-mtp.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/hw/usb/dev-mtp.c b/hw/usb/dev-mtp.c
index 1d8cfd32dc..406793fc03 100644
--- a/hw/usb/dev-mtp.c
+++ b/hw/usb/dev-mtp.c
@@ -1813,9 +1813,6 @@ static void usb_mtp_get_data(MTPState *s, mtp_container *container,
         d->offset += dlen;
         d->data_offset += dlen;
         if ((p->iov.size % 64) || !p->iov.size) {
-            assert((s->dataset.size == 0xFFFFFFFF) ||
-                   (s->dataset.size == d->offset));
-
             if (d->length == MTP_WRITE_BUF_SZ) {
                 d->write_status = WRITE_END;
             } else {
-- 
2.55.0