[PATCH] xen/gnttab: Properly drop page ref on a GNTTAB_cache_flush error path

[Andrew Cooper <andrew.cooper3@xxxxxxxxxx>]

From: Jan Beulich <jbeulich@xxxxxxxx>

This patch was XSA-520 in Xen 4.20 and earlier, as it affected security
supported x86 cases.

In Xen 4.21 and later, the hypercall is only available to ARM.  Nevertheless,
there are two identified cases (STATIC_MEM and the xentrace buffers) on ARM
where system domains own memory, and need this error path.

Reported-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
Reported-by: Yehyeong Lee <yhlee@xxxxxxxxxxxxxxxxxx>
Reported-by: Teddy Astie <teddy.astie@xxxxxxxxxx>
Reported-by: Stefano Stabellini <sstabellini@xxxxxxxxxx>
Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
---
 xen/common/grant_table.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c
index 5e79c012b695..a76ae35368a5 100644
--- a/xen/common/grant_table.c
+++ b/xen/common/grant_table.c
@@ -3635,6 +3635,8 @@ static int _cache_flush(gnttab_cache_flush_t *cflush, 
grant_ref_t *cur_ref)
     owner = page_get_owner_and_reference(page);
     if ( !owner || !owner->grant_table )
     {
+        if ( owner )
+            put_page(page);
         rcu_unlock_domain(d);
         return -EPERM;
     }

base-commit: 204e45847d5a743b611de989835f651fcfd6ddc0
-- 
2.39.5