hw/net/vmxnet3: Correct bounds check on tx queue index

[PATCH] hw/net/vmxnet3: Correct bounds check on tx queue index

Posted by Peter Maydell 2 weeks, 5 days ago

In vmxnet3_io_bar0_write(), we try to bounds-check the TX queue index
provided by the guest against the total number of queues.  However,
we have an off-by-one error: the valid indexes are from 0 to
txq_num-1, so we need a "<" comparison, not "<=".

Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3780
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/net/vmxnet3.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/net/vmxnet3.c b/hw/net/vmxnet3.c
index 97156dd33b..8569484b2f 100644
--- a/hw/net/vmxnet3.c
+++ b/hw/net/vmxnet3.c
@@ -1079,7 +1079,7 @@ vmxnet3_io_bar0_write(void *opaque, hwaddr addr,
         int tx_queue_idx =
             VMW_MULTIREG_IDX_BY_ADDR(addr, VMXNET3_REG_TXPROD,
                                      VMXNET3_REG_ALIGN);
-        if (tx_queue_idx <= s->txq_num) {
+        if (tx_queue_idx < s->txq_num) {
             vmxnet3_process_tx_queue(s, tx_queue_idx);
         } else {
             qemu_log_mask(LOG_GUEST_ERROR, "vmxnet3: Illegal TX queue %d/%d\n",
-- 
2.43.0

Re: [PATCH] hw/net/vmxnet3: Correct bounds check on tx queue index

Posted by Philippe Mathieu-Daudé 2 weeks, 5 days ago

On 6/7/26 19:54, Peter Maydell wrote:
> In vmxnet3_io_bar0_write(), we try to bounds-check the TX queue index
> provided by the guest against the total number of queues.  However,
> we have an off-by-one error: the valid indexes are from 0 to
> txq_num-1, so we need a "<" comparison, not "<=".
> 
> Cc: qemu-stable@nongnu.org
> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3780
> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
> ---
>   hw/net/vmxnet3.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)

Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>

Re: [PATCH] hw/net/vmxnet3: Correct bounds check on tx queue index

Posted by Peter Maydell 1 week, 6 days ago

On Mon, 6 Jul 2026 at 21:44, Philippe Mathieu-Daudé
<philmd@oss.qualcomm.com> wrote:
>
> On 6/7/26 19:54, Peter Maydell wrote:
> > In vmxnet3_io_bar0_write(), we try to bounds-check the TX queue index
> > provided by the guest against the total number of queues.  However,
> > we have an off-by-one error: the valid indexes are from 0 to
> > txq_num-1, so we need a "<" comparison, not "<=".
> >
> > Cc: qemu-stable@nongnu.org
> > Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3780
> > Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
> > ---
> >   hw/net/vmxnet3.c | 2 +-
> >   1 file changed, 1 insertion(+), 1 deletion(-)
>
> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>

Thanks; I'll take this via target-arm.next as I'm putting
together a pullreq.

-- PMM