friedkiwi/qemu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

hw/net/vmxnet3: Correct bounds check on tx queue index

Browse Source 
In vmxnet3_io_bar0_write(), we try to bounds-check the TX queue index
provided by the guest against the total number of queues.  However,
we have an off-by-one error: the valid indexes are from 0 to
txq_num-1, so we need a "<" comparison, not "<=".

Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3780
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Message-id: 20260706175408.905362-1-peter.maydell@linaro.org
This commit is contained in:
Peter Maydell
2026-07-13 12:34:17 +01:00
parent f7f742beb6
commit 4571c79c57
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
hw/net/vmxnet3.c
View File

@@ -1079,7 +1079,7 @@ vmxnet3_io_bar0_write(void *opaque, hwaddr addr,
int tx_queue_idx =
VMW_MULTIREG_IDX_BY_ADDR(addr, VMXNET3_REG_TXPROD,
VMXNET3_REG_ALIGN);
if (tx_queue_idx <= s->txq_num) {
if (tx_queue_idx < s->txq_num) {
vmxnet3_process_tx_queue(s, tx_queue_idx);
} else {
qemu_log_mask(LOG_GUEST_ERROR, "vmxnet3: Illegal TX queue %d/%d\n",