[xen master] xen/gnttab: Drop owner->grant_table check in _cache_flush()

[patchbot@xxxxxxx]

commit bec8e3c1fb91b96f337c08c6daf1bb2563b320c0
Author:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
AuthorDate: Mon Sep 28 20:05:01 2026 +0100
Commit:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
CommitDate: Wed Nov 4 18:11:35 2026 +0000

    xen/gnttab: Drop owner->grant_table check in _cache_flush()
    
    The "owner && !owner->grant_table" case needs a put_page() in it's error 
path.
    
    In Xen 4.20 and earlier, this was addressed by XSA-520.  Since the addition 
of
    CONFIG_HAS_GRANT_CACHE_FLUSH in Xen 4.21, this path is only reachable on 
ARM,
    and system domains on ARM do not own any memory.
    
    Therefore delete the check, rather than inserting unreachable error 
handling.
    
    No functional change.
    
    This issue was also independently reported by Yehyeong Lee as the security
    team was already working on XSA-519/520.
    
    Reported-by: Yehyeong Lee <yhlee@xxxxxxxxxxxxxxxxxx>
    Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Reviewed-by: Jan Beulich <jbeulich@xxxxxxxx>
---
 xen/common/grant_table.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c
index 5e79c012b6..2285c4aee8 100644
--- a/xen/common/grant_table.c
+++ b/xen/common/grant_table.c
@@ -3633,7 +3633,7 @@ static int _cache_flush(gnttab_cache_flush_t *cflush, 
grant_ref_t *cur_ref)
 
     page = mfn_to_page(mfn);
     owner = page_get_owner_and_reference(page);
-    if ( !owner || !owner->grant_table )
+    if ( !owner )
     {
         rcu_unlock_domain(d);
         return -EPERM;
--
generated by git-patchbot for /home/xen/git/xen.git#master