From: David Marchand <[email protected]>
The vhost library was not enforcing any limit on the number of queue a
guest could allocate, which could result in out of bound accesses in the
driver or other nasty bugs.
CVE-2026-86856
Bugzilla ID: 2027
Fixes: 10421b0d9075 ("vdpa/nfp: add interrupt logic of vring relay")
Cc: [email protected]
Acked-by: Kevin Traynor <[email protected]>
Signed-off-by: David Marchand <[email protected]>
---
lib/vhost/vhost_user.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/lib/vhost/vhost_user.c b/lib/vhost/vhost_user.c
index 15f13ef443..6efe8fe860 100644
--- a/lib/vhost/vhost_user.c
+++ b/lib/vhost/vhost_user.c
@@ -3280,6 +3280,7 @@ vhost_user_check_and_alloc_queue_pair(struct virtio_net
*dev,
struct vhu_msg_context *ctx)
{
uint32_t vring_idx;
+ uint32_t queue_num;
switch (ctx->msg.request.frontend) {
case VHOST_USER_SET_VRING_KICK:
@@ -3303,7 +3304,12 @@ vhost_user_check_and_alloc_queue_pair(struct virtio_net
*dev,
return 0;
}
- if (vring_idx >= VHOST_MAX_VRING) {
+ if (rte_vhost_driver_get_queue_num(dev->ifname, &queue_num) < 0) {
+ VHOST_CONFIG_LOG(dev->ifname, ERR, "failed to get queue num");
+ return -1;
+ }
+
+ if (vring_idx >= queue_num * 2) {
VHOST_CONFIG_LOG(dev->ifname, ERR, "invalid vring index: %u",
vring_idx);
return -1;
}
--
2.56.0
