Re: [PATCH 4/5] xeniface: Size converted MAP_FOREIGN_PAGES input with the V2 header

[Tu Dinh <ngoc-tu.dinh@xxxxxxxxxx>]

On 20/10/2026 13:55, Césaire Mounah wrote:
> The legacy IOCTL_XENIFACE_GNTTAB_MAP_FOREIGN_PAGES input is converted
> into a XENIFACE_GNTTAB_MAP_FOREIGN_PAGES_IN_V2 buffer, but that buffer
> was sized with the V1 header, which also holds RequestId. This
> over-allocated it by 4 bytes. Use the V2 header size.
> 
> Assisted-by: Claude:Opus-5.5
> Signed-off-by: Césaire Mounah <cesaire.mounah@xxxxxxxxxx>

Reviewed-by: Tu Dinh <ngoc-tu.dinh@xxxxxxxxxx>

> ---
>   src/xeniface/ioctl_gnttab.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/src/xeniface/ioctl_gnttab.c b/src/xeniface/ioctl_gnttab.c
> index 8256012..c6d82bc 100644
> --- a/src/xeniface/ioctl_gnttab.c
> +++ b/src/xeniface/ioctl_gnttab.c
> @@ -676,7 +676,7 @@ IoctlGnttabMapForeignPages(
>           // legacy IOCTL, convert the input to v2
>           status = STATUS_NO_MEMORY;
>           In = __AllocatePoolWithTag(NonPagedPool,
> -                                   
> (ULONG)FIELD_OFFSET(XENIFACE_GNTTAB_MAP_FOREIGN_PAGES_IN, References) + 
> ReferenceSize,
> +                                   
> (ULONG)FIELD_OFFSET(XENIFACE_GNTTAB_MAP_FOREIGN_PAGES_IN_V2, References) + 
> ReferenceSize,
>                                      XENIFACE_POOL_TAG);
>           if (In == NULL)
>               goto fail5;



--
Ngoc Tu Dinh | Vates XCP-ng Developer

XCP-ng & Xen Orchestra - Vates solutions

web: https://vates.tech