virtio-ccw: fix range check for SET_VQ

VIRTIO_PCI_QUEUE_MAX is already too big; a malicious guest would be
able to trigger a write beyond the VirtQueue structure.

Cc: [email protected]
Reviewed-by: David Hildenbrand <[email protected]>
Acked-by: Christian Borntraeger <[email protected]>
Signed-off-by: Cornelia Huck <[email protected]>

diff --git a/hw/s390x/virtio-ccw.c b/hw/s390x/virtio-ccw.c
index 130535cdc311bf9d6633268dc138fa01e374c1a2..ceb6a457035024e629728bd55f7edd637e00c9dc 100644 (file)
--- a/hw/s390x/virtio-ccw.c
+++ b/hw/s390x/virtio-ccw.c
@@ -266,7 +266,7 @@ static int virtio_ccw_set_vqs(SubchDev *sch, uint64_t addr, uint32_t align,
 {
     VirtIODevice *vdev = virtio_ccw_get_vdev(sch);
 
-    if (index > VIRTIO_PCI_QUEUE_MAX) {
+    if (index >= VIRTIO_PCI_QUEUE_MAX) {
         return -EINVAL;
     }