Star0
33
代码
代码
Issues20
Pull Requests13
项目讨论
Wiki
分析
Star0
33
已开启
fix(cve): 修复 CVE-2026-86564 在 dpdk 中的漏洞, CVE-2026-86562 #827
infra_team创建于 29 天前
fix(cve): 修复 CVE-2026-86564 在 dpdk 中的漏洞, CVE-2026-86562 #827
已开启
infra_team创建于 29 天前
从infra_team/dpdkfix-CVE-2026-86564-master合入到src-openeuler/dpdkmaster
共 2 个文件变更+87-1
A0157-vhost-fix-ctrlq-command_data-length-validation.patch+81-0
@@ -0,0 +1,81 @@
1+From 34e58d00b08061f8e7cc24510132f54169d74e6c Mon Sep 17 00:00:00 2001
2+From: infra_team <zhaiwenjie1@huawei.com>
3+Date: Mon, 21 Sep 2026 16:28:59 +0000
4+Subject: [PATCH] vhost: fix ctrlq command_data length validation
5+ 
6+The vhost control queue handler reads a 2-byte queue_pairs value from
7+command_data without validating that the request payload actually
8+carries data beyond the 2-byte class and command header. A malicious
9+guest can submit a control request with a 2-byte payload, triggering a
10+2-byte heap out-of-bounds read in the vhost host process (DoS).
11+ 
12+Record the control request payload length in virtio_net_ctrl_pop() and
13+reject, in virtio_net_ctrl_handle_req(), any request whose payload is
14+shorter than class + command + sizeof(uint16_t) before dereferencing
15+command_data.
16+ 
17+CVE-2026-86564
18+ 
19+Signed-off-by: infra_team <zhaiwenjie1@huawei.com>
20+---
21+ lib/vhost/virtio_net_ctrl.c | 16 ++++++++++++++--
22+ 1 file changed, 14 insertions(+), 2 deletions(-)
23+ 
24+diff --git a/lib/vhost/virtio_net_ctrl.c b/lib/vhost/virtio_net_ctrl.c
25+index c4847f8..6a06c4b 100644
26+--- a/lib/vhost/virtio_net_ctrl.c
27++++ b/lib/vhost/virtio_net_ctrl.c
28+@@ -18,6 +18,7 @@ struct virtio_net_ctrl {
29+
30+ struct virtio_net_ctrl_elem {
31+ struct virtio_net_ctrl *ctrl_req;
32++ uint16_t data_len;
33+ uint16_t head_idx;
34+ uint16_t n_descs;
35+ uint8_t *desc_ack;
36+@@ -129,6 +130,8 @@ virtio_net_ctrl_pop(struct virtio_net *dev, struct vhost_virtqueue *cvq,
37+ goto err;
38+ }
39+
40++ ctrl_elem->data_len = data_len;
41++
42+ ctrl_req = (uint8_t *)ctrl_elem->ctrl_req;
43+
44+ if (cvq->desc[desc_idx].flags & VRING_DESC_F_INDIRECT) {
45+@@ -189,7 +192,8 @@ virtio_net_ctrl_pop(struct virtio_net *dev, struct vhost_virtqueue *cvq,
46+ }
47+
48+ static uint8_t
49+-virtio_net_ctrl_handle_req(struct virtio_net *dev, struct virtio_net_ctrl *ctrl_req)
50++virtio_net_ctrl_handle_req(struct virtio_net *dev, struct virtio_net_ctrl *ctrl_req,
51++ uint16_t data_len)
52+ {
53+ uint8_t ret = VIRTIO_NET_ERR;
54+
55+@@ -198,6 +202,13 @@ virtio_net_ctrl_handle_req(struct virtio_net *dev, struct virtio_net_ctrl *ctrl_
56+ uint16_t queue_pairs;
57+ uint32_t i;
58+
59++ if (data_len < sizeof(ctrl_req->class) + sizeof(ctrl_req->command) +
60++ sizeof(uint16_t)) {
61++ VHOST_LOG_CONFIG(dev->ifname, ERR,
62++ "Invalid control command data length\n");
63++ return VIRTIO_NET_ERR;
64++ }
65++
66+ queue_pairs = *(uint16_t *)(uintptr_t)ctrl_req->command_data;
67+ VHOST_LOG_CONFIG(dev->ifname, INFO, "Ctrl req: MQ %u queue pairs\n", queue_pairs);
68+ ret = VIRTIO_NET_OK;
69+@@ -274,7 +285,8 @@ virtio_net_ctrl_handle(struct virtio_net *dev)
70+ if (ret <= 0)
71+ break;
72+
73+- *ctrl_elem.desc_ack = virtio_net_ctrl_handle_req(dev, ctrl_elem.ctrl_req);
74++ *ctrl_elem.desc_ack = virtio_net_ctrl_handle_req(dev, ctrl_elem.ctrl_req,
75++ ctrl_elem.data_len);
76+
77+ ret = virtio_net_ctrl_push(dev, &ctrl_elem);
78+ if (ret < 0)
79+--
80+2.39.5
81+ 
Mdpdk.spec+6-1
@@ -11,7 +11,7 @@
11 11 
12Name: dpdk12Name: dpdk
13Version: 23.1113Version: 23.11
14-Release: 4414+Release: 45
15URL: http://dpdk.org15URL: http://dpdk.org
16Source: https://fast.dpdk.org/rel/dpdk-%{version}.tar.xz16Source: https://fast.dpdk.org/rel/dpdk-%{version}.tar.xz
17 17 
@@ -192,6 +192,7 @@ Patch6153: 0153-net-xsc-fix-stale-packet-length-from-incomplete-CQE.patch
192Patch6154: 0154-net-nbl-add-NBL-PMD.patch192Patch6154: 0154-net-nbl-add-NBL-PMD.patch
193Patch6155: 0155-net-sxe2-add-sxe2-PMD.patch193Patch6155: 0155-net-sxe2-add-sxe2-PMD.patch
194Patch6156: 0156-net-zxdh-add-ZTE-ZXDH-PMD.patch194Patch6156: 0156-net-zxdh-add-ZTE-ZXDH-PMD.patch
195+Patch6157: 0157-vhost-fix-ctrlq-command_data-length-validation.patch
195 196 
196BuildRequires: meson197BuildRequires: meson
197BuildRequires: python3-pyelftools198BuildRequires: python3-pyelftools
@@ -396,6 +397,10 @@ fi
396/usr/sbin/depmod397/usr/sbin/depmod
397 398 
398%changelog399%changelog
400+* Tue Sep 22 2026 infra_team <zhaiwenjie1@huawei.com> - 23.11-45
401+- fix CVE-2026-86564
402+- vhost: fix ctrlq command_data length validation
403+ 
399* Tue Aug 11 2026 Wangjunlong <wang.junlong1@zte.com.cn> - 23.11-44404* Tue Aug 11 2026 Wangjunlong <wang.junlong1@zte.com.cn> - 23.11-44
400- net/zxdh: add ZTE ZXDH PMD support405- net/zxdh: add ZTE ZXDH PMD support
401 406