[xen staging-4.21] gnttab: complete checking in gnttab_copy_buf_valid()

[patchbot@xxxxxxx]

commit 6db96d2ae50f046df8fc5f1de28b2cebb3f11569
Author:     Jan Beulich <jbeulich@xxxxxxxx>
AuthorDate: Tue Nov 3 12:03:18 2026 +0000
Commit:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
CommitDate: Tue Nov 3 12:05:52 2026 +0000

    gnttab: complete checking in gnttab_copy_buf_valid()
    
    The ->have_grant field needs checking not only ahead of comparing GREFs,
    but also ahead of comparing MFNs. Else a (likely invalid) GREF from an
    earlier batch element can be mistaken for a (possibly valid) MFN.
    
    This is CVE-2026-102703, part of XSA-523.
    
    Fixes: d28f42f2703e ("grant-table: defer releasing pages acquired in a 
grant copy")
    Assisted-by: Claude
    Reported-by: Stephan Lipp <Stephan@xxxxxxxxxxxxx>
    Reported-by: CodeAnt AI Security Research <securityresearch@xxxxxxxxxx>
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Reviewed-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    (cherry picked from commit 266df0688c8a4fc243cd2bfd1f4cb09164f99bff)
---
 xen/common/grant_table.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c
index 2154802b2f..9109fd6bf5 100644
--- a/xen/common/grant_table.c
+++ b/xen/common/grant_table.c
@@ -3084,10 +3084,10 @@ static bool gnttab_copy_buf_valid(
     const struct gnttab_copy_ptr *p, const struct gnttab_copy_buf *b,
     bool has_gref)
 {
-    if ( !b->virt )
+    if ( !b->virt || b->have_grant != has_gref )
         return 0;
     if ( has_gref )
-        return b->have_grant && p->u.ref == b->ptr.u.ref;
+        return p->u.ref == b->ptr.u.ref;
     return p->u.gmfn == b->ptr.u.gmfn;
 }
 
--
generated by git-patchbot for /home/xen/git/xen.git#staging-4.21