Another race in XENMAPSPACE_grant_table handling

ISSUE DESCRIPTION

Guests are permitted access to certain Xen-owned pages of memory. The majority of such pages remain allocated / associated with a guest for its entire lifetime. Grant table v2 status pages, however, are de-allocated when a guest switches (back) from v2 to v1. Freeing such pages requires that the hypervisor enforce that no parallel request can result in the addition of a mapping of such a page to a guest. That enforcement was missing, allowing guests to retain access to pages that were freed and perhaps re-used for other purposes.
Unfortunately, when XSA-379 was being prepared, this similar issue was not noticed.

IMPACT

A malicious guest may be able to elevate its privileges to that of the host, cause host or guest Denial of Service (DoS), or cause information leaks.

VULNERABLE SYSTEMS

All Xen versions from 4.0 onwards are affected. Xen versions 3.4 and older are not affected.
Only x86 HVM and PVH guests permitted to use grant table version 2 interfaces can leverage this vulnerability. x86 PV guests cannot leverage this vulnerability. On Arm, grant table v2 use is explicitly unsupported.