On Thu, 23 Jul 2026 at 01:08, Stephen Hemminger <[email protected]> wrote: > > On Tue, 7 Jul 2026 16:50:44 +0300 > Anton Vanda <[email protected]> wrote: > > > In the batch path of the asynchronous packed ring dequeue, the address > > of the virtio net header is obtained from vhost_iova_to_vva(), which > > returns 0 when a guest-provided descriptor address cannot be fully > > translated. The batch check only validates that the descriptor address > > is non-zero and that the length is consistent. A malicious or buggy > > guest could therefore trigger a NULL pointer dereference and crash the > > vhost application (denial of service). > > > > Check the translation result and leave the batch fast path with an error > > on failure, so the single-packet path handles the invalid descriptor, as > > is already done for the non-batch async dequeue path. > > > > Perform the header translation before the DMA iovec setup so that the > > early return cannot leave the async iterator state partially updated. > > > > Fixes: c2fa52bf1e5d ("vhost: add batch dequeue in async vhost packed ring") > > Cc: [email protected] > > > > Signed-off-by: Anton Vanda <[email protected]> > > --- > > Since vhost is so security sensitive asked for more detailed AI review > (Claude Fable). > It found some issues that need addressing before merge.
vhost async is unmaintained, and I don't know a user of it. I would rather drop it and reduce vhost library attack surface. I have this idea in the back of my mind for quite some time... I'll post a RFC for removal. -- David Marchand
