patch 'vhost: fix virtqueue array size for control queue' has been queued to stable release 23.11.7

[Shani Peretz]

Hi,

FYI, your patch has been queued to stable release 23.11.7

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 04/05/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/shanipr/dpdk-stable

This queued commit can be viewed at:
https://github.com/shanipr/dpdk-stable/commit/622e817ecf51f0e2130fd9273f3684ae1215f58f

Thanks.

Shani

---
>From 622e817ecf51f0e2130fd9273f3684ae1215f58f Mon Sep 17 00:00:00 2001
From: Maxime Coquelin <maxime.coquelin at redhat.com>
Date: Wed, 14 Jan 2026 16:34:43 +0100
Subject: [PATCH] vhost: fix virtqueue array size for control queue

[ upstream commit 7cc4f260bf1c01ff717b6490f6c0ca205cb08953 ]

When max_queue_pairs is set to VHOST_MAX_QUEUE_PAIRS (128), VDUSE
calculates total_queues as max_queue_pairs * 2 + 1 = 257 to account
for the control queue. However, the virtqueue array was sized as
VHOST_MAX_QUEUE_PAIRS * 2, causing an out-of-bounds array access.

Fix by defining VHOST_MAX_VRING to explicitly account for the control
queue (VHOST_MAX_QUEUE_PAIRS * 2 + 1) and using it for the virtqueue
array size.

Fixes: 653327e191f0 ("vhost: add multiqueue support to VDUSE")

Signed-off-by: Maxime Coquelin <maxime.coquelin at redhat.com>
Reviewed-by: David Marchand <david.marchand at redhat.com>
Reviewed-by: Chenbo Xia <chenbox at nvidia.com>
---
 lib/vhost/vhost.h | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/lib/vhost/vhost.h b/lib/vhost/vhost.h
index f8624fba3d..17a9ba66ca 100644
--- a/lib/vhost/vhost.h
+++ b/lib/vhost/vhost.h
@@ -360,8 +360,9 @@ struct vhost_virtqueue {
 #define VIRTIO_DEVICE_STATUS_DEV_NEED_RESET	0x40
 #define VIRTIO_DEVICE_STATUS_FAILED		0x80
 
-#define VHOST_MAX_VRING			0x100
 #define VHOST_MAX_QUEUE_PAIRS		0x80
+/* Max vring count: 2 per queue pair plus 1 control queue */
+#define VHOST_MAX_VRING                        (VHOST_MAX_QUEUE_PAIRS * 2 + 1)
 
 /* Declare IOMMU related bits for older kernels */
 #ifndef VIRTIO_F_IOMMU_PLATFORM
@@ -492,7 +493,7 @@ struct virtio_net {
 
 	int			extbuf;
 	int			linearbuf;
-	struct vhost_virtqueue	*virtqueue[VHOST_MAX_QUEUE_PAIRS * 2];
+	struct vhost_virtqueue	*virtqueue[VHOST_MAX_VRING];
 
 	rte_rwlock_t	iotlb_pending_lock;
 	struct vhost_iotlb_entry *iotlb_pool;
-- 
2.43.0

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-03-31 00:32:33.339731138 +0300
+++ 0047-vhost-fix-virtqueue-array-size-for-control-queue.patch	2026-03-31 00:32:29.018248000 +0300
@@ -1 +1 @@
-From 7cc4f260bf1c01ff717b6490f6c0ca205cb08953 Mon Sep 17 00:00:00 2001
+From 622e817ecf51f0e2130fd9273f3684ae1215f58f Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit 7cc4f260bf1c01ff717b6490f6c0ca205cb08953 ]
+
@@ -16 +17,0 @@
-Cc: stable at dpdk.org
@@ -26 +27 @@
-index e9e71c1707..ee61f7415e 100644
+index f8624fba3d..17a9ba66ca 100644
@@ -29,2 +30,3 @@
-@@ -261,8 +261,9 @@ struct vhost_async {
- };
+@@ -360,8 +360,9 @@ struct vhost_virtqueue {
+ #define VIRTIO_DEVICE_STATUS_DEV_NEED_RESET	0x40
+ #define VIRTIO_DEVICE_STATUS_FAILED		0x80
@@ -32 +33,0 @@
- #define VHOST_RECONNECT_VERSION		0x0
@@ -36 +37 @@
-+#define VHOST_MAX_VRING			(VHOST_MAX_QUEUE_PAIRS * 2 + 1)
++#define VHOST_MAX_VRING                        (VHOST_MAX_QUEUE_PAIRS * 2 + 1)
@@ -38,3 +39,3 @@
- struct __rte_cache_aligned vhost_reconnect_vring {
- 	uint16_t last_avail_idx;
-@@ -501,7 +502,7 @@ struct __rte_cache_aligned virtio_net {
+ /* Declare IOMMU related bits for older kernels */
+ #ifndef VIRTIO_F_IOMMU_PLATFORM
+@@ -492,7 +493,7 @@ struct virtio_net {