Re: [PATCH 3/5] xeniface: Reject unaligned addresses in GNTTAB_PERMIT_FOREIGN_ACCESS_V2

[Tu Dinh <ngoc-tu.dinh@xxxxxxxxxx>]

On 20/10/2026 13:55, Césaire Mounah wrote:
> IOCTL_XENIFACE_GNTTAB_PERMIT_FOREIGN_ACCESS_V2 lets user mode pass the
> address of the memory to share, but the address was never checked for
> page alignment. Pages are granted whole, so an unaligned address makes
> the MDL span one more page than NumberPages and shares partial pages at
> both ends.
> 
> Fail the request with STATUS_INVALID_PARAMETER instead. The legacy IOCTL
> always passes NULL and is not affected.
> 
> Assisted-by: Claude:Opus-5.5
> Signed-off-by: Césaire Mounah <cesaire.mounah@xxxxxxxxxx>

Reviewed-by: Tu Dinh <ngoc-tu.dinh@xxxxxxxxxx>

> ---
>   src/xeniface/ioctl_gnttab.c | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/src/xeniface/ioctl_gnttab.c b/src/xeniface/ioctl_gnttab.c
> index 0dab8e2..8256012 100644
> --- a/src/xeniface/ioctl_gnttab.c
> +++ b/src/xeniface/ioctl_gnttab.c
> @@ -393,7 +393,9 @@ IoctlGnttabPermitForeignAccess(
>       }
>   
>       Status = STATUS_INVALID_PARAMETER;
> -    if (In->NumberPages == 0 || In->NumberPages > GNTTAB_MAX_PAGES) {
> +    if (In->NumberPages == 0 ||
> +        In->NumberPages > GNTTAB_MAX_PAGES ||
> +        BYTE_OFFSET(In->Address) != 0) {
>           goto fail4;
>       }
>   



--
Ngoc Tu Dinh | Vates XCP-ng Developer

XCP-ng & Xen Orchestra - Vates solutions

web: https://vates.tech