[xen staging-4.21] gnttab: check values against active entry when copying an already-pinned one

[patchbot@xxxxxxx]

commit 14558d435ff90c71027fb7f9dcef2be159e93b21
Author:     Jan Beulich <jbeulich@xxxxxxxx>
AuthorDate: Mon Jul 20 16:39:12 2026 +0100
Commit:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
CommitDate: Tue Jul 28 13:07:36 2026 +0100

    gnttab: check values against active entry when copying an already-pinned one
    
    acquire_grant_for_copy() passes to its caller both an MFN and a struct
    page_info *. The two really need to be in sync for the get_page()
    underlying get_paged_frame() and get_page_type() (both acting on the
    passed back struct page_info *) and the map_domain_page() (acting on the
    passed back MFN) to achieve the intended effect.
    
    Go further and also check other properties: GTF_transitive / GTF_sub_page
    may have been flipped in the shared entry, so respective fields / values
    also may not match.
    
    The one field which we can be sure does match (as it was checked earlier
    in the function) is ->domid. Add an assertion nevertheless.
    
    This is CVE-2026-62428 / XSA-500.
    
    Fixes: d8cbecb1eeed ("grant-tables: Use get_page_from_gfn() instead of 
get_gfn()/put_gfn")
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Reviewed-by: Juergen Gross <jgross@xxxxxxxx>
    (cherry picked from commit 61b0a59ce26dfb157cc0347ebf32d0a0df17710e)
---
 xen/common/grant_table.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c
index 5e09027821..5577b321d2 100644
--- a/xen/common/grant_table.c
+++ b/xen/common/grant_table.c
@@ -2805,6 +2805,21 @@ acquire_grant_for_copy(
             act->trans_gref = trans_gref;
             act->mfn = grant_mfn;
         }
+        else if ( !mfn_eq(act->mfn, grant_mfn) ||
+                  act->src_domid != td->domain_id ||
+                  act->trans_gref != trans_gref ||
+                  (act->is_sub_page &&
+                   (!is_sub_page ||
+                    act->start != trans_page_off ||
+                    act->length != trans_length)) )
+        {
+            put_page(*page);
+            *page = NULL;
+            rc = GNTST_general_error;
+            goto unlock_out_clear;
+        }
+        else
+            ASSERT(act->domid == ldom);
     }
     else
     {
--
generated by git-patchbot for /home/xen/git/xen.git#staging-4.21