scsi-disk: fix off by one in assertion
When documenting the invariant that mode pages need to fit the smallest output buffer of all callers (which is SCSI_MAX_MODE_LEN), the expression used by the assertion was incorrect. Even though SCSI_MAX_MODE_LEN is indeed 256, using "length < 256" had two issues: 1) it used the wrong operator, since "length < ..." is more related to having room for extra data; 2) it missed the extra two bytes for page number and length. Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Paolo Bonzini committed
Jul 21, 2026 at 17:56 UTC
e2da3d92744d12b0c2e554ed533a4c9011dbd975
1 file changed
+1
-1
hw/scsi/scsi-disk.c
+1
-1
@@ -1321,7 +1321,7 @@ static int mode_sense_page(SCSIDiskState *s, int page, uint8_t **p_outbuf,
1321
return -1;
1322
}
1323
1324
- assert(length < 256);
1324
+ assert(length + 2 <= SCSI_MAX_MODE_LEN);
1325
(*p_outbuf)[0] = page;
1326
(*p_outbuf)[1] = length;
1327
*p_outbuf += length + 2;