@samitouri / QOSamiQemu / commits / 443e024106

hw/ide: replace assert with proper error handling

In ide_dma_cb(), the call to prepare_buf() might return a negative result and cause an assertion failure. This was found during fuzzing and can be triggered with some qtest commands. Replace the assert with proper error handling in case the result is negative, but keep the assert for failing to respect the limit upon success. If that happens, it is an implementation error. Found by Linux Verification Center (linuxtesting.org) with libFuzzer. Cc: qemu-stable@nongnu.org Fixes: ed78352a59 ("ide: Fix incorrect handling of some PRDTs in ide_dma_cb()") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/2777 Signed-off-by: Artem Nasonov <anasonov@astralinux.ru> Link: https://lore.kernel.org/qemu-devel/20250116111600.2570490-1-anasonov@astralinux.ru [FE: improve commit message keep assert for failing to respect the limit] Signed-off-by: Fiona Ebner <f.ebner@proxmox.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>

Artem Nasonov committed Jul 22, 2026 at 12:41 UTC 443e02410695b35a27fad18217424b6370358be7

1 file changed +6 -2

hw/ide/core.c

+6 -2

@@ -921,8 +921,12 @@ static void ide_dma_cb(void *opaque, int ret)

921 s->io_buffer_index = 0;

922 s->io_buffer_size = n * 512;

923 prep_size = s->bus->dma->ops->prepare_buf(s->bus->dma, s->io_buffer_size);

924 - /* prepare_buf() must succeed and respect the limit */

925 - assert(prep_size >= 0 && prep_size <= n * 512);

924 + if (prep_size < 0) {

925 + ide_dma_error(s);

926 + return;

927 + }

928 + /* If prepare_buf() succeeds, it must respect the limit. */

929 + assert(prep_size <= n * 512);

930

931 /*

932 * Now prep_size stores the number of bytes in the sglist, and