Re: [Qemu-devel] virtio-9p.c:401: v9fs_string_sprintf: Assertion `!(err == -1)' failed.

[Stefan Hajnoczi]

On a related note, there are more uses of BUG_ON() in hw/virtio-9p.c
which can be triggered from the guest:

submit_pdu():
    BUG_ON(pdu->id >= ARRAY_SIZE(pdu_handlers));
    BUG_ON(handler == NULL);

handle_9p_output():
        BUG_ON(pdu->elem.out_num == 0 || pdu->elem.in_num == 0);
        BUG_ON(pdu->elem.out_sg[0].iov_len < 7);

These should be handled by skipping the bad virtqueue element.  We
could also reset the device but that may freak out the (bad) guest.

Stefan