[PATCH] vhost: fix null dereference in async packed dequeue

[Maxime Coquelin]

Hello Anton,

On Tue, Jul 7, 2026 at 3:59 PM Anton Vanda <avanda at ptsecurity.com> wrote:
>
> In the batch path of the asynchronous packed ring dequeue, the address
> of the virtio net header is obtained from vhost_iova_to_vva(), which
> returns 0 when a guest-provided descriptor address cannot be fully
> translated.  The batch check only validates that the descriptor address
> is non-zero and that the length is consistent. A malicious or buggy
> guest could therefore trigger a NULL pointer dereference and crash the
> vhost application (denial of service).
>
> Check the translation result and leave the batch fast path with an error
> on failure, so the single-packet path handles the invalid descriptor, as
> is already done for the non-batch async dequeue path.
>
> Perform the header translation before the DMA iovec setup so that the
> early return cannot leave the async iterator state partially updated.
>
> Fixes: c2fa52bf1e5d ("vhost: add batch dequeue in async vhost packed ring")
> Cc: stable at dpdk.org
>
> Signed-off-by: Anton Vanda <avanda at ptsecurity.com>
> ---
>  .mailmap               |  1 +
>  lib/vhost/virtio_net.c | 26 +++++++++++++++++---------
>  2 files changed, 18 insertions(+), 9 deletions(-)
>

Thanks for your contribution, but since async support is being removed
in v26.11,
your patch is no longer necessary.

Maxime