gnttab: properly drop page ref on a GNTTAB_cache_flush error path

Ordinary domains always have a grant table. System domains don't, but they
also don't normally "own" pages - except for DOM_IO and DOM_COW on x86.

This is XSA-520 / CVE-2026-102700.

Reported-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reported-by: Yehyeong Lee <yhlee@isslab.korea.ac.kr>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
(cherry picked from commit 6a355a772ca5205b8de29c58cfc3cef4f2ba8238)

xen/common/grant_table.c

@@ -3632,6 +3632,8 @@ static int _cache_flush(gnttab_cache_flush_t *cflush, grant_ref_t *cur_ref)
     owner = page_get_owner_and_reference(page);
     if ( !owner || !owner->grant_table )
     {
+        if ( owner )
+            put_page(page);
         rcu_unlock_domain(d);
         return -EPERM;
     }