In vmxnet3_io_bar0_write(), we try to bounds-check the TX queue index provided by the guest against the total number of queues. However, we have an off-by-one error: the valid indexes are from 0 to txq_num-1, so we need a "<" comparison, not "<=".
Cc: [email protected] Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3780 Signed-off-by: Peter Maydell <[email protected]> --- hw/net/vmxnet3.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/net/vmxnet3.c b/hw/net/vmxnet3.c index 97156dd33b..8569484b2f 100644 --- a/hw/net/vmxnet3.c +++ b/hw/net/vmxnet3.c @@ -1079,7 +1079,7 @@ vmxnet3_io_bar0_write(void *opaque, hwaddr addr, int tx_queue_idx = VMW_MULTIREG_IDX_BY_ADDR(addr, VMXNET3_REG_TXPROD, VMXNET3_REG_ALIGN); - if (tx_queue_idx <= s->txq_num) { + if (tx_queue_idx < s->txq_num) { vmxnet3_process_tx_queue(s, tx_queue_idx); } else { qemu_log_mask(LOG_GUEST_ERROR, "vmxnet3: Illegal TX queue %d/%d\n", -- 2.43.0
