[PATCH 3/5] xeniface: Reject unaligned addresses in GNTTAB_PERMIT_FOREIGN_ACCESS_V2

[Césaire Mounah <cesaire.mounah@xxxxxxxxxx>]

IOCTL_XENIFACE_GNTTAB_PERMIT_FOREIGN_ACCESS_V2 lets user mode pass the
address of the memory to share, but the address was never checked for
page alignment. Pages are granted whole, so an unaligned address makes
the MDL span one more page than NumberPages and shares partial pages at
both ends.

Fail the request with STATUS_INVALID_PARAMETER instead. The legacy IOCTL
always passes NULL and is not affected.

Assisted-by: Claude:Opus-5.5
Signed-off-by: Césaire Mounah <cesaire.mounah@xxxxxxxxxx>
---
 src/xeniface/ioctl_gnttab.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/xeniface/ioctl_gnttab.c b/src/xeniface/ioctl_gnttab.c
index 0dab8e2..8256012 100644
--- a/src/xeniface/ioctl_gnttab.c
+++ b/src/xeniface/ioctl_gnttab.c
@@ -393,7 +393,9 @@ IoctlGnttabPermitForeignAccess(
     }
 
     Status = STATUS_INVALID_PARAMETER;
-    if (In->NumberPages == 0 || In->NumberPages > GNTTAB_MAX_PAGES) {
+    if (In->NumberPages == 0 ||
+        In->NumberPages > GNTTAB_MAX_PAGES ||
+        BYTE_OFFSET(In->Address) != 0) {
         goto fail4;
     }
 
-- 
2.55.0.windows.5



--
Césaire Mounah | Vates Windows Guest Tools Engineer

XCP-ng & Xen Orchestra - Vates solutions

web: https://vates.tech