[PATCH 10/14] vhost: check number of queues for VDPA

[Maxime Coquelin]

From: David Marchand <david.marchand at redhat.com>

The vhost library was not enforcing any limit on the number of queue a
guest could allocate, which could result in out of bound accesses in the
driver or other nasty bugs.

CVE-2026-86856
Bugzilla ID: 2027

Fixes: 10421b0d9075 ("vdpa/nfp: add interrupt logic of vring relay")
Cc: stable at dpdk.org

Acked-by: Kevin Traynor <ktraynor at redhat.com>
Signed-off-by: David Marchand <david.marchand at redhat.com>
---
 lib/vhost/vhost_user.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/lib/vhost/vhost_user.c b/lib/vhost/vhost_user.c
index 15f13ef443..6efe8fe860 100644
--- a/lib/vhost/vhost_user.c
+++ b/lib/vhost/vhost_user.c
@@ -3280,6 +3280,7 @@ vhost_user_check_and_alloc_queue_pair(struct virtio_net *dev,
 			struct vhu_msg_context *ctx)
 {
 	uint32_t vring_idx;
+	uint32_t queue_num;
 
 	switch (ctx->msg.request.frontend) {
 	case VHOST_USER_SET_VRING_KICK:
@@ -3303,7 +3304,12 @@ vhost_user_check_and_alloc_queue_pair(struct virtio_net *dev,
 		return 0;
 	}
 
-	if (vring_idx >= VHOST_MAX_VRING) {
+	if (rte_vhost_driver_get_queue_num(dev->ifname, &queue_num) < 0) {
+		VHOST_CONFIG_LOG(dev->ifname, ERR, "failed to get queue num");
+		return -1;
+	}
+
+	if (vring_idx >= queue_num * 2) {
 		VHOST_CONFIG_LOG(dev->ifname, ERR, "invalid vring index: %u", vring_idx);
 		return -1;
 	}
-- 
2.56.0