Re: [PATCH 01/10] xeniface: fix NULL KernelVa dereference in GnttabFreeGrant notify

[Tu Dinh <ngoc-tu.dinh@xxxxxxxxxx>]

On 08/10/2026 14:05, david ambu wrote:
> For V2 grants with user-supplied memory, KernelVa is NULL.
> Fall back to UserVa for the notify offset write in that case.
> 
> Signed-off-by: david ambu <david.preetham@xxxxxxxxxx>
> Assisted by Claude Sonnet 4.6

Entire series except Patch 10:

Reviewed-by: Tu Dinh <ngoc-tu.dinh@xxxxxxxxxx>

Since Patch 10 is still under discussion, IMO we can hold back that 
patch alone and commit the remaining 9 to make sure that we have the 
necessary driver fixes.

> ---
>   src/xeniface/ioctl_gnttab.c | 12 +++++++++++-
>   1 file changed, 11 insertions(+), 1 deletion(-)
> 
> diff --git a/src/xeniface/ioctl_gnttab.c b/src/xeniface/ioctl_gnttab.c
> index 770f0dc..35767a2 100644
> --- a/src/xeniface/ioctl_gnttab.c
> +++ b/src/xeniface/ioctl_gnttab.c
> @@ -482,7 +482,17 @@ GnttabFreeGrant(
>       ASSERT(KeGetCurrentIrql() <= APC_LEVEL);
>   
>       if (Context->Flags & XENIFACE_GNTTAB_USE_NOTIFY_OFFSET) {
> -        ((PCHAR)Context->KernelVa)[Context->NotifyOffset] = 0;
> +        if (Context->KernelVa != NULL) {
> +            ((PCHAR)Context->KernelVa)[Context->NotifyOffset] = 0;
> +        } else {
> +#pragma prefast(suppress:6320)
> +            try {
> +                ((PCHAR)Context->UserVa)[Context->NotifyOffset] = 0;
> +            } except(EXCEPTION_EXECUTE_HANDLER) {
> +                Error("Failed to write notify offset 0x%x: 0x%x\n",
> +                      Context->NotifyOffset, GetExceptionCode());
> +            }
> +        }
>       }
>   
>       if (Context->Flags & XENIFACE_GNTTAB_USE_NOTIFY_PORT) {



--
Ngoc Tu Dinh | Vates XCP-ng Developer

XCP-ng & Xen Orchestra - Vates solutions

web: https://vates.tech