x86/pod: do not reclaim special pages for PoD cache

When doing PoD cache reclaim as part of a decrease reservation call, avoid
reclaiming special pages for the PoD cache.  Otherwise such pages get moved
from the domain ->xenpage_list to the ->page_list, while still being
referenced in ->shared_info domain field.

Prevent PoD cache from reclaiming special pages, as nothing good can come
out of it.

This is XSA-507 / CVE-2026-62434.

Fixes: 41aa0b6269 ("PoD memory 4/9: Decrease reservation")
Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
(cherry picked from commit 372497ce42)

xen/arch/x86/mm/p2m-pod.c

@@ -559,12 +559,13 @@ decrease_reservation(struct domain *d, gfn_t gfn, unsigned int order)
         p2m_access_t a;
         p2m_type_t t;
         unsigned int cur_order;
+        mfn_t mfn = p2m->get_entry(p2m, gfn_add(gfn, i), &t, &a, 0, &cur_order,
+                                   NULL);
 
-        p2m->get_entry(p2m, gfn_add(gfn, i), &t, &a, 0, &cur_order, NULL);
         n = 1UL << min(order, cur_order);
         if ( p2m_is_pod(t) )
             pod += n;
-        else if ( p2m_is_ram(t) )
+        else if ( p2m_is_ram(t) && !is_special_page(mfn_to_page(mfn)) )
             ram += n;
     }
 
@@ -667,6 +668,9 @@ decrease_reservation(struct domain *d, gfn_t gfn, unsigned int order)
             ASSERT(mfn_valid(mfn));
 
             page = mfn_to_page(mfn);
+            if ( is_special_page(page) )
+                /* Do not touch special pages, let generic code handle them. */
+                continue;
 
             /* This shouldn't be able to fail */
             if ( p2m_set_entry(p2m, gfn_add(gfn, i), INVALID_MFN, cur_order,