hw/usb/hcd-xhci: Fix guest-triggerable assert() in xhci_find_stream()
The assert() statement in xhci_find_stream() can be triggered by the guest (see bug tickets #273, #3895 and #3988 on gitlab.com). Turn it into a qemu_log_mask() instead to fix this problem. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/273 Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Thomas Huth <thuth@redhat.com> Message-ID: <20260715203357.424556-1-thuth@redhat.com>
Thomas Huth committed
Jul 15, 2026 at 22:33 UTC
4daeaa2fe0f979b70fb3e54cc5661aadbffcd311
1 file changed
+6
-1
hw/usb/hcd-xhci.c
+6
-1
@@ -1009,7 +1009,12 @@ static XHCIStreamContext *xhci_find_stream(XHCIEPContext *epctx,
1009
dma_addr_t base;
1010
uint32_t ctx[2], sct;
1011
1012
- assert(streamid != 0);
1012
+ if (!streamid) {
1013
+ qemu_log_mask(LOG_GUEST_ERROR, "xhci: stream ID is zero\n");
1014
+ *cc_error = CC_INVALID_STREAM_ID_ERROR;
1015
+ return NULL;
1016
+ }
1017
+
1018
if (epctx->lsa) {
1019
if (streamid >= epctx->nr_pstreams) {
1020
*cc_error = CC_INVALID_STREAM_ID_ERROR;