grant table hypercall acquire/release imbalance

ISSUE DESCRIPTION

When releasing a non-v1 non-transitive grant after doing a grant copy operation, Xen incorrectly recurses (as if for a transitive grant) and releases an unrelated grant reference.

IMPACT

A malicious guest administrator can cause undefined behaviour; depending on the dom0 kernel a host crash is possible, but information leakage or privilege escalation cannot be ruled out.

VULNERABLE SYSTEMS

Xen 4.0 and 4.1 are vulnerable. Any kind of guest can trigger the vulnerability.
Xen 4.2 and xen-unstable, as well as Xen 3.x and earlier, are not vulnerable.