[xen stable-4.17] gnttab: properly drop page ref on a GNTTAB_cache_flush error path

[patchbot@xxxxxxx]

commit 1eaef8526490f01c09a040d1318b13e439e8c459
Author:     Jan Beulich <jbeulich@xxxxxxxx>
AuthorDate: Tue Sep 29 17:45:11 2026 +0100
Commit:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
CommitDate: Tue Oct 13 14:20:52 2026 +0100

    gnttab: properly drop page ref on a GNTTAB_cache_flush error path
    
    Ordinary domains always have a grant table. System domains don't, but they
    also don't normally "own" pages - except for DOM_IO and DOM_COW on x86.
    
    This is XSA-520 / CVE-2026-102700.
    
    Reported-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Reported-by: Yehyeong Lee <yhlee@xxxxxxxxxxxxxxxxxx>
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    (cherry picked from commit 6a355a772ca5205b8de29c58cfc3cef4f2ba8238)
---
 xen/common/grant_table.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c
index abd351de69..5932722ce0 100644
--- a/xen/common/grant_table.c
+++ b/xen/common/grant_table.c
@@ -3569,6 +3569,8 @@ static int _cache_flush(gnttab_cache_flush_t *cflush, 
grant_ref_t *cur_ref)
     owner = page_get_owner_and_reference(page);
     if ( !owner || !owner->grant_table )
     {
+        if ( owner )
+            put_page(page);
         rcu_unlock_domain(d);
         return -EPERM;
     }
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.17