xen/gntdev: fix unsafe vma access

xen/gntdev: fix unsafe vma access

In gntdev_ioctl_get_offset_for_vaddr, we need to hold mmap_sem while
calling find_vma() to avoid potentially having the result freed out from
under us.  Similarly, the MMU notifier functions need to synchronize with
gntdev_vma_close to avoid map->vma being freed during their iteration.

Signed-off-by: Daniel De Graaf <[email protected]>
Reported-by: Al Viro <[email protected]>
Signed-off-by: Konrad Rzeszutek Wilk <[email protected]>