[PATCH 1/6] xen/gnttab: Drop owner->grant_table check in _cache_flush()

[Andrew Cooper <andrew.cooper3@xxxxxxxxxx>]

The "owner && !owner->grant_table" case needs a put_page() in it's error
handling.

In Xen 4.20 and earlier, this was addressed by XSA-520.  Since the addition of
CONFIG_HAS_GRANT_CACHE_FLUSH in Xen 4.21, this path is only reachable on ARM,
and system domains on ARM do not own any memory.

Therefore delete the check, rather than inserting unreachable error handling.

No functional change.

This issue was also independently reported by Yehyeong Lee as the security
team was already working on XSA-519/520.

Reported-by: Yehyeong Lee <yhlee@xxxxxxxxxxxxxxxxxx>
Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
Reviewed-by: Jan Beulich <jbeulich@xxxxxxxx>
---
CC: Stefano Stabellini <sstabellini@xxxxxxxxxx>
CC: Julien Grall <julien@xxxxxxx>
CC: Volodymyr Babchuk <Volodymyr_Babchuk@xxxxxxxx>
CC: Bertrand Marquis <bertrand.marquis@xxxxxxx>
CC: Michal Orzel <michal.orzel@xxxxxxx>
CC: Jan Beulich <jbeulich@xxxxxxxx>
CC: Roger Pau Monné <roger@xxxxxxxxxxxxxx>
CC: Teddy Astie <teddy.astie@xxxxxxxxxx>
CC: Oleksii Kurochko <oleksii.kurochko@xxxxxxxxx>
CC: Baptiste Le Duc <baptiste.le-duc@xxxxxxxxxx>
---
 xen/common/grant_table.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c
index 5e79c012b695..2285c4aee8d6 100644
--- a/xen/common/grant_table.c
+++ b/xen/common/grant_table.c
@@ -3633,7 +3633,7 @@ static int _cache_flush(gnttab_cache_flush_t *cflush, 
grant_ref_t *cur_ref)
 
     page = mfn_to_page(mfn);
     owner = page_get_owner_and_reference(page);
-    if ( !owner || !owner->grant_table )
+    if ( !owner )
     {
         rcu_unlock_domain(d);
         return -EPERM;
-- 
2.39.5