From 859e9f829e9f5047909df167d41830deac2cef51 Mon Sep 17 00:00:00 2001
From: Jan Beulich <jbeulich@suse.com>
Date: Tue, 29 Sep 2026 17:45:11 +0100
Subject: [PATCH] gnttab: properly drop page ref on a GNTTAB_cache_flush error
 path

Ordinary domains always have a grant table. System domains don't, but they
also don't normally "own" pages - except for DOM_IO and DOM_COW on x86.

This is XSA-520 / CVE-2026-102700.

Reported-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reported-by: Yehyeong Lee <yhlee@isslab.korea.ac.kr>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
(cherry picked from commit 6a355a772ca5205b8de29c58cfc3cef4f2ba8238)
---
 xen/common/grant_table.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c
index d69684cf55..742c9797c5 100644
--- a/xen/common/grant_table.c
+++ b/xen/common/grant_table.c
@@ -3632,6 +3632,8 @@ static int _cache_flush(gnttab_cache_flush_t *cflush, grant_ref_t *cur_ref)
     owner = page_get_owner_and_reference(page);
     if ( !owner || !owner->grant_table )
     {
+        if ( owner )
+            put_page(page);
         rcu_unlock_domain(d);
         return -EPERM;
     }