x86: incorrect error handling for guest p2m page removals

ISSUE DESCRIPTION

The internal function querying a domain’s p2m table grabs the p2m lock by default, so that the answer to the query remains true until the caller can act on that information; it is up to the caller then to release the lock. Unfortunately, certain failure paths don’t release the lock.

IMPACT

A malicious or buggy guest may cause a deadlock, resulting in a DoS (Denial of Service) affecting the entire host.

VULNERABLE SYSTEMS

Xen 4.11 and onward are vulnerable.
Only x86 systems are vulnerable. ARM systems are not vulnerable.
Only systems running untrusted HVM or PVH guests are vulnerable. Systems running only PV guests are not vulnerable.