[xen stable-4.19] gnttab: check values against active entry when copying an already-pinned one

[patchbot@xxxxxxx]

commit 7dfed62794a535061fa96b966916e5bbdd6e144a
Author:     Jan Beulich <jbeulich@xxxxxxxx>
AuthorDate: Mon Jul 20 16:42:29 2026 +0100
Commit:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
CommitDate: Tue Jul 28 13:08:52 2026 +0100

    gnttab: check values against active entry when copying an already-pinned one
    
    acquire_grant_for_copy() passes to its caller both an MFN and a struct
    page_info *. The two really need to be in sync for the get_page()
    underlying get_paged_frame() and get_page_type() (both acting on the
    passed back struct page_info *) and the map_domain_page() (acting on the
    passed back MFN) to achieve the intended effect.
    
    Go further and also check other properties: GTF_transitive / GTF_sub_page
    may have been flipped in the shared entry, so respective fields / values
    also may not match.
    
    The one field which we can be sure does match (as it was checked earlier
    in the function) is ->domid. Add an assertion nevertheless.
    
    This is CVE-2026-62428 / XSA-500.
    
    Fixes: d8cbecb1eeed ("grant-tables: Use get_page_from_gfn() instead of 
get_gfn()/put_gfn")
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Reviewed-by: Juergen Gross <jgross@xxxxxxxx>
    (cherry picked from commit 61b0a59ce26dfb157cc0347ebf32d0a0df17710e)
---
 xen/common/grant_table.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c
index 751b05efb6..357dcfed2b 100644
--- a/xen/common/grant_table.c
+++ b/xen/common/grant_table.c
@@ -2802,6 +2802,21 @@ acquire_grant_for_copy(
             act->trans_gref = trans_gref;
             act->mfn = grant_mfn;
         }
+        else if ( !mfn_eq(act->mfn, grant_mfn) ||
+                  act->src_domid != td->domain_id ||
+                  act->trans_gref != trans_gref ||
+                  (act->is_sub_page &&
+                   (!is_sub_page ||
+                    act->start != trans_page_off ||
+                    act->length != trans_length)) )
+        {
+            put_page(*page);
+            *page = NULL;
+            rc = GNTST_general_error;
+            goto unlock_out_clear;
+        }
+        else
+            ASSERT(act->domid == ldom);
     }
     else
     {
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.19