[PATCH v2 1/3] vhost: fix virtqueue array size for control queue

[Chenbo Xia]

> On Jan 14, 2026, at 23:34, Maxime Coquelin <maxime.coquelin at redhat.com> wrote:
> 
> External email: Use caution opening links or attachments
> 
> 
> When max_queue_pairs is set to VHOST_MAX_QUEUE_PAIRS (128), VDUSE
> calculates total_queues as max_queue_pairs * 2 + 1 = 257 to account
> for the control queue. However, the virtqueue array was sized as
> VHOST_MAX_QUEUE_PAIRS * 2, causing an out-of-bounds array access.
> 
> Fix by defining VHOST_MAX_VRING to explicitly account for the control
> queue (VHOST_MAX_QUEUE_PAIRS * 2 + 1) and using it for the virtqueue
> array size.
> 
> Fixes: f0a37cc6a1e2 ("vhost: add multiqueue support to VDUSE")
> Cc: stable at dpdk.org
> 
> Signed-off-by: Maxime Coquelin <maxime.coquelin at redhat.com>
> Reviewed-by: David Marchand <david.marchand at redhat.com>
> ---
> lib/vhost/vhost.h | 5 +++--
> 1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/lib/vhost/vhost.h b/lib/vhost/vhost.h
> index e9e71c1707..ee61f7415e 100644
> --- a/lib/vhost/vhost.h
> +++ b/lib/vhost/vhost.h
> @@ -261,8 +261,9 @@ struct vhost_async {
> };
> 
> #define VHOST_RECONNECT_VERSION                0x0
> -#define VHOST_MAX_VRING                        0x100
> #define VHOST_MAX_QUEUE_PAIRS          0x80
> +/* Max vring count: 2 per queue pair plus 1 control queue */
> +#define VHOST_MAX_VRING                        (VHOST_MAX_QUEUE_PAIRS * 2 + 1)
> 
> struct __rte_cache_aligned vhost_reconnect_vring {
>        uint16_t last_avail_idx;
> @@ -501,7 +502,7 @@ struct __rte_cache_aligned virtio_net {
> 
>        int                     extbuf;
>        int                     linearbuf;
> -       struct vhost_virtqueue  *virtqueue[VHOST_MAX_QUEUE_PAIRS * 2];
> +       struct vhost_virtqueue  *virtqueue[VHOST_MAX_VRING];
> 
>        rte_rwlock_t    iotlb_pending_lock;
>        struct vhost_iotlb_entry *iotlb_pool;
> --
> 2.52.0
> 

Reviewed-by: Chenbo Xia <chenbox at nvidia.com>