From: Jan Beulich <jbeulich@suse.com>
Subject: gnttab: complete checking in gnttab_copy_buf_valid()

The ->have_grant field needs checking not only ahead of comparing GREFs,
but also ahead of comparing MFNs. Else a (likely invalid) GREF from an
earlier batch element can be mistaken for a (possibly valid) MFN.

This is CVE-2026-102703, part of XSA-523.

Fixes: d28f42f2703e ("grant-table: defer releasing pages acquired in a grant copy")
Assisted-by: Claude
Reported-by: Stephan Lipp <Stephan@Adalogics.com>
Reported-by: CodeAnt AI Security Research <securityresearch@codeant.ai>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>

diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c
index 742c9797c535..842d43684849 100644
--- a/xen/common/grant_table.c
+++ b/xen/common/grant_table.c
@@ -3081,10 +3081,10 @@ static bool_t gnttab_copy_buf_valid(const struct gnttab_copy_ptr *p,
                                     const struct gnttab_copy_buf *b,
                                     bool_t has_gref)
 {
-    if ( !b->virt )
+    if ( !b->virt || b->have_grant != has_gref )
         return 0;
     if ( has_gref )
-        return b->have_grant && p->u.ref == b->ptr.u.ref;
+        return p->u.ref == b->ptr.u.ref;
     return p->u.gmfn == b->ptr.u.gmfn;
 }