[PATCH 01/10] xeniface: fix NULL KernelVa dereference in GnttabFreeGrant notify

[david ambu <david.preetham@xxxxxxxxxx>]

For V2 grants with user-supplied memory, KernelVa is NULL.
Fall back to UserVa for the notify offset write in that case.

Signed-off-by: david ambu <david.preetham@xxxxxxxxxx>
Assisted by Claude Sonnet 4.6
---
 src/xeniface/ioctl_gnttab.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/src/xeniface/ioctl_gnttab.c b/src/xeniface/ioctl_gnttab.c
index 770f0dc..35767a2 100644
--- a/src/xeniface/ioctl_gnttab.c
+++ b/src/xeniface/ioctl_gnttab.c
@@ -482,7 +482,17 @@ GnttabFreeGrant(
     ASSERT(KeGetCurrentIrql() <= APC_LEVEL);
 
     if (Context->Flags & XENIFACE_GNTTAB_USE_NOTIFY_OFFSET) {
-        ((PCHAR)Context->KernelVa)[Context->NotifyOffset] = 0;
+        if (Context->KernelVa != NULL) {
+            ((PCHAR)Context->KernelVa)[Context->NotifyOffset] = 0;
+        } else {
+#pragma prefast(suppress:6320)
+            try {
+                ((PCHAR)Context->UserVa)[Context->NotifyOffset] = 0;
+            } except(EXCEPTION_EXECUTE_HANDLER) {
+                Error("Failed to write notify offset 0x%x: 0x%x\n",
+                      Context->NotifyOffset, GetExceptionCode());
+            }
+        }
     }
 
     if (Context->Flags & XENIFACE_GNTTAB_USE_NOTIFY_PORT) {
-- 
2.51.0.windows.1