[PATCH] vhost: fix null dereference in async packed dequeue

[David Marchand]

On Thu, 23 Jul 2026 at 01:08, Stephen Hemminger
<stephen at networkplumber.org> wrote:
>
> On Tue, 7 Jul 2026 16:50:44 +0300
> Anton Vanda <avanda at ptsecurity.com> wrote:
>
> > In the batch path of the asynchronous packed ring dequeue, the address
> > of the virtio net header is obtained from vhost_iova_to_vva(), which
> > returns 0 when a guest-provided descriptor address cannot be fully
> > translated.  The batch check only validates that the descriptor address
> > is non-zero and that the length is consistent. A malicious or buggy
> > guest could therefore trigger a NULL pointer dereference and crash the
> > vhost application (denial of service).
> >
> > Check the translation result and leave the batch fast path with an error
> > on failure, so the single-packet path handles the invalid descriptor, as
> > is already done for the non-batch async dequeue path.
> >
> > Perform the header translation before the DMA iovec setup so that the
> > early return cannot leave the async iterator state partially updated.
> >
> > Fixes: c2fa52bf1e5d ("vhost: add batch dequeue in async vhost packed ring")
> > Cc: stable at dpdk.org
> >
> > Signed-off-by: Anton Vanda <avanda at ptsecurity.com>
> > ---
>
> Since vhost is so security sensitive asked for more detailed AI review (Claude Fable).
> It found some issues that need addressing before merge.

vhost async is unmaintained, and I don't know a user of it.
I would rather drop it and reduce vhost library attack surface.

I have this idea in the back of my mind for quite some time... I'll
post a RFC for removal.


-- 
David Marchand