From 4571c79c57cabd5975fb9d51f78c87675989180b Mon Sep 17 00:00:00 2001 From: Peter Maydell Date: Mon, 13 Jul 2026 12:34:17 +0100 Subject: [PATCH] hw/net/vmxnet3: Correct bounds check on tx queue index MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit In vmxnet3_io_bar0_write(), we try to bounds-check the TX queue index provided by the guest against the total number of queues. However, we have an off-by-one error: the valid indexes are from 0 to txq_num-1, so we need a "<" comparison, not "<=". Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3780 Signed-off-by: Peter Maydell Reviewed-by: Philippe Mathieu-Daudé Message-id: 20260706175408.905362-1-peter.maydell@linaro.org --- hw/net/vmxnet3.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/net/vmxnet3.c b/hw/net/vmxnet3.c index 97156dd33b..8569484b2f 100644 --- a/hw/net/vmxnet3.c +++ b/hw/net/vmxnet3.c @@ -1079,7 +1079,7 @@ vmxnet3_io_bar0_write(void *opaque, hwaddr addr, int tx_queue_idx = VMW_MULTIREG_IDX_BY_ADDR(addr, VMXNET3_REG_TXPROD, VMXNET3_REG_ALIGN); - if (tx_queue_idx <= s->txq_num) { + if (tx_queue_idx < s->txq_num) { vmxnet3_process_tx_queue(s, tx_queue_idx); } else { qemu_log_mask(LOG_GUEST_ERROR, "vmxnet3: Illegal TX queue %d/%d\n",