Hello Anton, On Tue, Jul 7, 2026 at 3:59 PM Anton Vanda <[email protected]> wrote: > > In the batch path of the asynchronous packed ring dequeue, the address > of the virtio net header is obtained from vhost_iova_to_vva(), which > returns 0 when a guest-provided descriptor address cannot be fully > translated. The batch check only validates that the descriptor address > is non-zero and that the length is consistent. A malicious or buggy > guest could therefore trigger a NULL pointer dereference and crash the > vhost application (denial of service). > > Check the translation result and leave the batch fast path with an error > on failure, so the single-packet path handles the invalid descriptor, as > is already done for the non-batch async dequeue path. > > Perform the header translation before the DMA iovec setup so that the > early return cannot leave the async iterator state partially updated. > > Fixes: c2fa52bf1e5d ("vhost: add batch dequeue in async vhost packed ring") > Cc: [email protected] > > Signed-off-by: Anton Vanda <[email protected]> > --- > .mailmap | 1 + > lib/vhost/virtio_net.c | 26 +++++++++++++++++--------- > 2 files changed, 18 insertions(+), 9 deletions(-) >
Thanks for your contribution, but since async support is being removed in v26.11, your patch is no longer necessary. Maxime
