[xen stable-4.20] x86/pod: do not reclaim special pages for PoD cache

[patchbot@xxxxxxx]

commit 4314e6ded0188200c2f1ec9df463f464350e302e
Author:     Roger Pau Monne <roger.pau@xxxxxxxxxx>
AuthorDate: Tue Jul 14 17:05:45 2026 +0200
Commit:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
CommitDate: Tue Jul 28 13:08:27 2026 +0100

    x86/pod: do not reclaim special pages for PoD cache
    
    When doing PoD cache reclaim as part of a decrease reservation call, avoid
    reclaiming special pages for the PoD cache.  Otherwise such pages get moved
    from the domain ->xenpage_list to the ->page_list, while still being
    referenced in ->shared_info domain field.
    
    Prevent PoD cache from reclaiming special pages, as nothing good can come
    out of it.
    
    This is XSA-507 / CVE-2026-62434.
    
    Fixes: 41aa0b62699e ("PoD memory 4/9: Decrease reservation")
    Signed-off-by: Roger Pau Monné <roger.pau@xxxxxxxxxx>
    Reviewed-by: Jan Beulich <jbeulich@xxxxxxxx>
    (cherry picked from commit 372497ce42bdd56f8f7052c9154e9201d7ecf8fd)
---
 xen/arch/x86/mm/p2m-pod.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/xen/arch/x86/mm/p2m-pod.c b/xen/arch/x86/mm/p2m-pod.c
index fa2b9a2728..a6a898e7b9 100644
--- a/xen/arch/x86/mm/p2m-pod.c
+++ b/xen/arch/x86/mm/p2m-pod.c
@@ -536,12 +536,13 @@ decrease_reservation(struct domain *d, gfn_t gfn, 
unsigned int order)
         p2m_access_t a;
         p2m_type_t t;
         unsigned int cur_order;
+        mfn_t mfn = p2m->get_entry(p2m, gfn_add(gfn, i), &t, &a, 0, &cur_order,
+                                   NULL);
 
-        p2m->get_entry(p2m, gfn_add(gfn, i), &t, &a, 0, &cur_order, NULL);
         n = 1UL << min(order, cur_order);
         if ( p2m_is_pod(t) )
             pod += n;
-        else if ( p2m_is_ram(t) )
+        else if ( p2m_is_ram(t) && !is_special_page(mfn_to_page(mfn)) )
             ram += n;
     }
 
@@ -644,6 +645,9 @@ decrease_reservation(struct domain *d, gfn_t gfn, unsigned 
int order)
             ASSERT(mfn_valid(mfn));
 
             page = mfn_to_page(mfn);
+            if ( is_special_page(page) )
+                /* Do not touch special pages, let generic code handle them. */
+                continue;
 
             /* This shouldn't be able to fail */
             if ( p2m_set_entry(p2m, gfn_add(gfn, i), INVALID_MFN, cur_order,
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.20