When max_queue_pairs is set to VHOST_MAX_QUEUE_PAIRS (128), VDUSE
calculates total_queues as max_queue_pairs * 2 + 1 = 257 to account
for the control queue. However, the virtqueue array was sized as
VHOST_MAX_QUEUE_PAIRS * 2, causing an out-of-bounds array access.
Fix by defining VHOST_MAX_VRING to explicitly account for the control
queue (VHOST_MAX_QUEUE_PAIRS * 2 + 1) and using it for the virtqueue
array size.
Fixes: f0a37cc6a1e2 ("vhost: add multiqueue support to VDUSE")
Cc: [email protected]
Signed-off-by: Maxime Coquelin <[email protected]>
---
lib/vhost/vhost.h | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/lib/vhost/vhost.h b/lib/vhost/vhost.h
index e9e71c1707..ee61f7415e 100644
--- a/lib/vhost/vhost.h
+++ b/lib/vhost/vhost.h
@@ -261,8 +261,9 @@ struct vhost_async {
};
#define VHOST_RECONNECT_VERSION 0x0
-#define VHOST_MAX_VRING 0x100
#define VHOST_MAX_QUEUE_PAIRS 0x80
+/* Max vring count: 2 per queue pair plus 1 control queue */
+#define VHOST_MAX_VRING (VHOST_MAX_QUEUE_PAIRS * 2 + 1)
struct __rte_cache_aligned vhost_reconnect_vring {
uint16_t last_avail_idx;
@@ -501,7 +502,7 @@ struct __rte_cache_aligned virtio_net {
int extbuf;
int linearbuf;
- struct vhost_virtqueue *virtqueue[VHOST_MAX_QUEUE_PAIRS * 2];
+ struct vhost_virtqueue *virtqueue[VHOST_MAX_VRING];
rte_rwlock_t iotlb_pending_lock;
struct vhost_iotlb_entry *iotlb_pool;
--
2.52.0
