DoS via non-preemptable L3/L4 pagetable freeing

ISSUE DESCRIPTION

Guests have the ability to request removal of memory from themselves. This operation is intended to be requested for normal read/write pages, but is also permitted to be used on other types of pages. So far this in particular included pages pinned to their current type, with the necessary unpinning happening implicitly. The unpinning of higher level page tables can, however, take a significant amount of time, and hence is generally expected to be carried out with intermediate preemption checks. Such checks were missing from the code path involved here.

IMPACT

A malicious guest administrator can cause a Denial of Service (DoS). Specifically, prevent use of a physical CPU for a significant period of time.

VULNERABLE SYSTEMS

All Xen versions are vulnerable.
Only x86 systems are affected. ARM systems are not affected.
Only PV guests can leverage this vulnerability. HVM guests cannot leverage this vulnerability.