x86/p2m: issue a sync flush before freeing paging pages

In the EPT implementation, the defer flushing logic is used
unconditionally, and that would lead to paging memory being returned to the
paging pool before its references had been flushed.

Issue any pending flushes before freeing the paging memory back to the
pool.

Note AMD (NPT) and Shadow paging are not affected, as they don't implement
the deferred flushing logic.

This is XSA-480 / CVE-2026-23554

Fixes: 4a59e6bb3a ("x86/EPT: squash meaningless TLB flush")
Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
(cherry picked from commit 4bc2e5333a)

xen/arch/x86/mm/p2m.c

@@ -459,6 +459,11 @@ void p2m_free_ptp(struct p2m_domain *p2m, struct page_info *pg)
     ASSERT(p2m->domain);
     ASSERT(p2m->domain->arch.paging.free_page);
 
+    /*
+     * Issue any pending flush here, in case it was deferred before.  The page
+     * will be returned to the paging pool now.
+     */
+    p2m_tlb_flush_sync(p2m);
     page_list_del(pg, &p2m->pages);
     p2m->domain->arch.paging.free_page(p2m->domain, pg);