Reviewing files that changed from the base of the PR and between cd60dcd and 5acd8a1.

• lib/vhost/vduse.c
• lib/vhost/vhost.h
• lib/vhost/virtio_net_ctrl.c

• GitHub Check: Sourcery review

lib/vhost/vhost.h (2)

265-266: LGTM! Correct fix for control queue array sizing.

The redefinition of VHOST_MAX_VRING from the fixed value 0x100 (256) to (VHOST_MAX_QUEUE_PAIRS * 2 + 1) (257) correctly accounts for the control queue. With VHOST_MAX_QUEUE_PAIRS = 0x80, the previous value of 256 would cause out-of-bounds access when accessing the control queue at index max_queue_pairs * 2 when max_queue_pairs equals VHOST_MAX_QUEUE_PAIRS.

---

505-505: Correctly updated array dimension to match new macro.

The virtqueue array now properly uses VHOST_MAX_VRING which includes space for the control queue, preventing out-of-bounds access when dev->cvq = dev->virtqueue[max_queue_pairs * 2] is assigned in vduse_device_create().

lib/vhost/vduse.c (1)

89-92: Critical fix: Correct mmap failure detection.

The previous check against NULL was incorrect since mmap() returns MAP_FAILED (defined as (void *)-1) on failure, not NULL. The old code would have missed actual mmap failures and proceeded to insert an invalid address ((void *)-1) into the IOTLB cache via vhost_user_iotlb_cache_insert(), potentially causing memory corruption or crashes when the address is later dereferenced.

Adding strerror(errno) to the error message is a good improvement for diagnostics.

lib/vhost/virtio_net_ctrl.c (6)

31-31: Good additions for descriptor chain validation.

The new nr_descs and cnt variables properly support bounds checking and loop detection for descriptor chain traversal.

---

44-47: Proper bounds validation on initial descriptor index.

This check prevents out-of-bounds access to cvq->desc[] when a malicious or corrupted guest provides an invalid descriptor index. The error path correctly advances last_avail_idx to avoid re-processing the same invalid entry.

---

62-67: Correct bounds computation for both descriptor paths.

For indirect descriptors, nr_descs is correctly derived from the descriptor table length. For direct descriptors, using cvq->size as the bound is appropriate since descriptor indices must be within the ring size.

---

69-73: Effective protection against malicious descriptor chains.

The dual check guards against:

1. Out-of-bounds access: desc_idx >= nr_descs prevents reading beyond the descriptor array
2. Infinite loops: ++cnt > nr_descs detects circular descriptor chains that would otherwise loop forever

This mirrors similar protections in virtio_net.c as noted in the PR objectives.

---

159-167: Consistent bounds checking in second traversal pass.

The cnt counter is properly reset before the second loop, and the same validation logic is applied. The loop structure change to while(1) with explicit breaks for VRING_DESC_F_WRITE is cleaner and maintains the safety guarantees established in the first pass.

---

152-156: Consistent nr_descs recomputation in second pass.

The bounds are correctly recalculated for the second traversal pass, ensuring both passes use identical validation logic.