Re: [PATCH v2 2/2] Send gnttab unmap notify event after the grant is fully released

[Tu Dinh <ngoc-tu.dinh@xxxxxxxxxx>]

On 27/05/2026 13:32, Rafał Wojdyła wrote:
> Move the notification event to after the unmap hypercall completes,
> so the peer only gets notified after the grant is completely released
> on our side. Closes possible race when the peer could be notified
> before the grant was fully torn down.
> 
> Signed-off-by: Rafał Wojdyła <omeg@xxxxxxxxxxxxxxxxxxxxxx>

I don't have a way to test this change specifically but it looks correct 
to me.

Reviewed-by: Tu Dinh <ngoc-tu.dinh@xxxxxxxxxx>

> ---
>   src/xeniface/ioctl_gnttab.c | 16 +++++++++-------
>   1 file changed, 9 insertions(+), 7 deletions(-)
> 
> diff --git a/src/xeniface/ioctl_gnttab.c b/src/xeniface/ioctl_gnttab.c
> index ef77295..ee319cb 100644
> --- a/src/xeniface/ioctl_gnttab.c
> +++ b/src/xeniface/ioctl_gnttab.c
> @@ -802,17 +802,11 @@ GnttabFreeMap(
>   
>       Trace("Context %p\n", Context);
>   
> +    // Write the notify value while the grant is still mapped.
>       if (Context->Flags & XENIFACE_GNTTAB_USE_NOTIFY_OFFSET) {
>           ((PCHAR)Context->KernelVa)[Context->NotifyOffset] = 0;
>       }
>   
> -    if (Context->Flags & XENIFACE_GNTTAB_USE_NOTIFY_PORT) {
> -        status = EvtchnNotify(Fdo, Context->NotifyPort, NULL);
> -
> -        if (!NT_SUCCESS(status)) // non-fatal, we must free memory
> -            Error("failed to notify port %lu: 0x%x\n", Context->NotifyPort, 
> status);
> -    }
> -
>       // unmap from user address space
>       MmUnmapLockedPages(Context->UserVa, Context->Mdl);
>   
> @@ -828,6 +822,14 @@ GnttabFreeMap(
>   
>       ASSERT(NT_SUCCESS(status));
>   
> +    // Notify the peer after the map is fully gone.
> +    if (Context->Flags & XENIFACE_GNTTAB_USE_NOTIFY_PORT) {
> +        status = EvtchnNotify(Fdo, Context->NotifyPort, NULL);
> +
> +        if (!NT_SUCCESS(status)) // non-fatal, we must free memory
> +            Error("failed to notify port %lu: 0x%x\n", Context->NotifyPort, 
> status);
> +    }
> +
>       RtlZeroMemory(Context, sizeof(*Context));
>       __FreePoolWithTag(Context, XENIFACE_POOL_TAG);
>   }



--
Ngoc Tu Dinh | Vates XCP-ng Developer

XCP-ng & Xen Orchestra - Vates solutions

web: https://vates.tech