Re: [PATCH 2/2] gnttab: Hold a reference to Context->Process

[Owen Smith <owen.smith@xxxxxxxxxx>]

Reviewed-by: Owen Smith <owen.smith@xxxxxxxxxx>

________________________________________
From: win-pv-devel <win-pv-devel-bounces@xxxxxxxxxxxxxxxxxxxx> on behalf of Tu 
Dinh <ngoc-tu.dinh@xxxxxxxxxx>
Sent: 09 October 2026 12:26 PM
To: win-pv-devel@xxxxxxxxxxxxxxxxxxxx
Cc: Tu Dinh
Subject: [PATCH 2/2] gnttab: Hold a reference to Context->Process

Context->Process is used in a long-running fashion. Particularly, gnttab
IRPs stay pending as long as the permit/map request still lives.

In this case, we should hold a reference to the process concerned.

Assisted-by: LLM
Signed-off-by: Tu Dinh <ngoc-tu.dinh@xxxxxxxxxx>
---
 src/xeniface/ioctl_gnttab.c | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/src/xeniface/ioctl_gnttab.c b/src/xeniface/ioctl_gnttab.c
index c333034..b903387 100644
--- a/src/xeniface/ioctl_gnttab.c
+++ b/src/xeniface/ioctl_gnttab.c
@@ -49,6 +49,7 @@ CompleteGnttabIrp(
     PIRP                        Irp = Context;
     PXENIFACE_GNTTAB_CONTEXT    GnttabContext;
     PIO_WORKITEM                WorkItem;
+    PEPROCESS                   Process;
     KAPC_STATE                  ApcState;
     BOOLEAN                     ChangeProcess;

@@ -56,13 +57,17 @@ CompleteGnttabIrp(

     GnttabContext = Irp->Tail.Overlay.DriverContext[0];
     WorkItem = Irp->Tail.Overlay.DriverContext[1];
+    Process = GnttabContext->Process;
+
+    // The context is freed before we detach, so hold another process 
reference.
+    ObReferenceObject(Process);

     // We are not guaranteed to be in the context of the process that 
initiated the IRP,
     // but we need to be there to unmap memory.
-    ChangeProcess = PsGetCurrentProcess() != GnttabContext->Process;
+    ChangeProcess = PsGetCurrentProcess() != Process;
     if (ChangeProcess) {
-        Trace("Changing process from %p to %p\n", PsGetCurrentProcess(), 
GnttabContext->Process);
-        KeStackAttachProcess(GnttabContext->Process, &ApcState);
+        Trace("Changing process from %p to %p\n", PsGetCurrentProcess(), 
Process);
+        KeStackAttachProcess(Process, &ApcState);
     }

     Trace("Irp %p, Process %p, Id %lu, Type %d, IRQL %d\n",
@@ -85,6 +90,7 @@ CompleteGnttabIrp(
     if (ChangeProcess)
         KeUnstackDetachProcess(&ApcState);

+    ObDereferenceObject(Process);
     IoFreeWorkItem(WorkItem);

     Irp->IoStatus.Status = STATUS_CANCELLED;
@@ -376,6 +382,7 @@ IoctlGnttabPermitForeignAccess(

     Context->Type = XENIFACE_GNTTAB_CONTEXT_GRANT;
     Context->Process = PsGetCurrentProcess();
+    ObReferenceObject(Context->Process);
     Context->RemoteDomain = In->RemoteDomain;
     Context->UserVa = In->Address;
     Context->NumberPages = In->NumberPages;
@@ -451,6 +458,7 @@ fail9:

 fail8:
     Error("Fail8\n");
+    ObDereferenceObject(Context->Process);
     RtlZeroMemory(Context, sizeof(*Context));
     __FreePoolWithTag(Context, XENIFACE_POOL_TAG);

@@ -516,6 +524,7 @@ GnttabFreeGrant(

     GnttabStopSharing(Fdo, Context, Context->NumberPages);

+    ObDereferenceObject(Context->Process);
     RtlZeroMemory(Context, sizeof(*Context));
     __FreePoolWithTag(Context, XENIFACE_POOL_TAG);
 }
@@ -609,6 +618,7 @@ IoctlGnttabMapForeignPages(

     Context->Type = XENIFACE_GNTTAB_CONTEXT_MAP;
     Context->Process = PsGetCurrentProcess();
+    ObReferenceObject(Context->Process);

     // This IOCTL uses METHOD_NEITHER so we directly access user memory.
     if (ControlCode == IOCTL_XENIFACE_GNTTAB_MAP_FOREIGN_PAGES) {
@@ -814,6 +824,7 @@ fail3:

 fail2:
     Error("Fail2\n");
+    ObDereferenceObject(Context->Process);
     RtlZeroMemory(Context, sizeof(*Context));
     __FreePoolWithTag(Context, XENIFACE_POOL_TAG);

@@ -865,6 +876,7 @@ GnttabFreeMap(
             Error("failed to notify port %lu: 0x%x\n", Context->NotifyPort, 
status);
     }

+    ObDereferenceObject(Context->Process);
     RtlZeroMemory(Context, sizeof(*Context));
     __FreePoolWithTag(Context, XENIFACE_POOL_TAG);
 }
--
2.55.0.windows.3



--
Ngoc Tu Dinh | Vates XCP-ng Developer

XCP-ng & Xen Orchestra - Vates solutions

web: https://vates.tech