diff options
Diffstat (limited to 'hw/s390x/virtio-ccw.c')
| -rw-r--r-- | hw/s390x/virtio-ccw.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/hw/s390x/virtio-ccw.c b/hw/s390x/virtio-ccw.c index 130535c..d32ecaf 100644 --- a/hw/s390x/virtio-ccw.c +++ b/hw/s390x/virtio-ccw.c @@ -266,7 +266,7 @@ static int virtio_ccw_set_vqs(SubchDev *sch, uint64_t addr, uint32_t align, { VirtIODevice *vdev = virtio_ccw_get_vdev(sch); - if (index > VIRTIO_PCI_QUEUE_MAX) { + if (index >= VIRTIO_PCI_QUEUE_MAX) { return -EINVAL; } @@ -549,6 +549,10 @@ static int virtio_ccw_cb(SubchDev *sch, CCW1 ccw) ret = -EFAULT; } else { vq_config.index = lduw_be_phys(&address_space_memory, ccw.cda); + if (vq_config.index >= VIRTIO_PCI_QUEUE_MAX) { + ret = -EINVAL; + break; + } vq_config.num_max = virtio_queue_get_num(vdev, vq_config.index); stw_be_phys(&address_space_memory, |