[PATCH 23.11 12/14] vhost: fix inflight descriptor table overflow

[Maxime Coquelin]

Add bounds checking against inflight table size in split and packed
ring inflight descriptor APIs. The inflight table is sized from
queue_size received in VHOST_USER_SET_INFLIGHT_FD, but the guest can
later resize the virtqueue larger via SET_VRING_NUM. Existing checks
only validated against vq->size, not the inflight table's desc_num.

A malicious guest could desynchronize these sizes and publish avail
entries with head indices valid for the enlarged virtqueue but out
of bounds for the inflight descriptor table, causing heap corruption.

CVE-2026-86565
Bugzilla ID: 2008

Reported-by: Jia Jia <physicalmtea at gmail.com>
Signed-off-by: Maxime Coquelin <maxime.coquelin at redhat.com>
Acked-by: Kevin Traynor <ktraynor at redhat.com>
---
 .mailmap          |  1 +
 lib/vhost/vhost.c | 18 ++++++++++++++++++
 2 files changed, 19 insertions(+)

diff --git a/.mailmap b/.mailmap
index 3cebf366a6..b0a020d82e 100644
--- a/.mailmap
+++ b/.mailmap
@@ -654,6 +654,7 @@ Jesper Wramberg <jesper.wramberg at gmail.com>
 Jesse Brandeburg <jesse.brandeburg at intel.com>
 Jesse Bruni <jesse.bruni at intel.com>
 Jia He <justin.he at arm.com> <jia.he at hxt-semitech.com>
+Jia Jia <physicalmtea at gmail.com>
 Jianbo Liu <jianbo.liu at arm.com> <jianbo.liu at linaro.org>
 Jianfeng Tan <jianfeng.tan at intel.com>
 Jiangu Zhao <zhaojg at arraynetworks.com.cn>
diff --git a/lib/vhost/vhost.c b/lib/vhost/vhost.c
index 3f4dea4822..4bd86cd6f9 100644
--- a/lib/vhost/vhost.c
+++ b/lib/vhost/vhost.c
@@ -1159,6 +1159,9 @@ rte_vhost_set_inflight_desc_split(int vid, uint16_t vring_idx,
 	if (unlikely(idx >= vq->size))
 		return -1;
 
+	if (unlikely(idx >= vq->inflight_split->desc_num))
+		return -1;
+
 	vq->inflight_split->desc[idx].counter = vq->global_counter++;
 	vq->inflight_split->desc[idx].inflight = 1;
 	return 0;
@@ -1205,6 +1208,9 @@ rte_vhost_set_inflight_desc_packed(int vid, uint16_t vring_idx,
 	if (unlikely(old_free_head >= vq->size))
 		return -1;
 
+	if (unlikely(old_free_head >= inflight_info->desc_num))
+		return -1;
+
 	free_head = old_free_head;
 
 	/* init header descriptor */
@@ -1263,6 +1269,9 @@ rte_vhost_clr_inflight_desc_split(int vid, uint16_t vring_idx,
 	if (unlikely(idx >= vq->size))
 		return -1;
 
+	if (unlikely(idx >= vq->inflight_split->desc_num))
+		return -1;
+
 	rte_atomic_thread_fence(rte_memory_order_seq_cst);
 
 	vq->inflight_split->desc[idx].inflight = 0;
@@ -1306,6 +1315,9 @@ rte_vhost_clr_inflight_desc_packed(int vid, uint16_t vring_idx,
 	if (unlikely(head >= vq->size))
 		return -1;
 
+	if (unlikely(head >= inflight_info->desc_num))
+		return -1;
+
 	rte_atomic_thread_fence(rte_memory_order_seq_cst);
 
 	inflight_info->desc[head].inflight = 0;
@@ -1388,10 +1400,16 @@ rte_vhost_set_last_inflight_io_packed(int vid, uint16_t vring_idx,
 	if (unlikely(head >= vq->size))
 		return -1;
 
+	if (unlikely(head >= inflight_info->desc_num))
+		return -1;
+
 	last = inflight_info->desc[head].last;
 	if (unlikely(last >= vq->size))
 		return -1;
 
+	if (unlikely(last >= inflight_info->desc_num))
+		return -1;
+
 	inflight_info->desc[last].next = inflight_info->free_head;
 	inflight_info->free_head = head;
 	inflight_info->used_idx += inflight_info->desc[head].num;
-- 
2.56.0