hw/net/vmxnet3: Correct bounds check on tx queue index
In vmxnet3_io_bar0_write(), we try to bounds-check the TX queue index provided by the guest against the total number of queues. However, we have an off-by-one error: the valid indexes are from 0 to txq_num-1, so we need a "<" comparison, not "<=". Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3780 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Message-id: 20260706175408.905362-1-peter.maydell@linaro.org
Peter Maydell committed
Jul 13, 2026 at 12:34 UTC
4571c79c57cabd5975fb9d51f78c87675989180b
1 file changed
+1
-1
hw/net/vmxnet3.c
+1
-1
@@ -1079,7 +1079,7 @@ vmxnet3_io_bar0_write(void *opaque, hwaddr addr,
1079
int tx_queue_idx =
1080
VMW_MULTIREG_IDX_BY_ADDR(addr, VMXNET3_REG_TXPROD,
1081
VMXNET3_REG_ALIGN);
1082
- if (tx_queue_idx <= s->txq_num) {
1082
+ if (tx_queue_idx < s->txq_num) {
1083
vmxnet3_process_tx_queue(s, tx_queue_idx);
1084
} else {
1085
qemu_log_mask(LOG_GUEST_ERROR, "vmxnet3: Illegal TX queue %d/%d\n",