[PATCH] xen/rangeset: Fix rangeset_remove_range() with e == ~0UL

[Stefano Stabellini <sstabellini@xxxxxxxxxx>]

When the removal spans several ranges, the last one is trimmed by
setting its start to e + 1, and destroyed if that leaves it empty.  For
e == ~0UL, e + 1 wraps to 0, so the range is kept as [0, end] and the
removal adds everything below it.

This is hit by pv_shim_shutdown(), whose iomem_deny_access(d, 0, ~0UL)
on resume turns the guest's grant frame permissions into [0, highest
grant frame].  arch_iommu_hwdom_init() can hit it too, for a PVH
hardware domain with an E820 entry above its 48-bit iomem_caps.

Destroy the range when it ends within [s, e] instead.

Signed-off-by: Stefano Stabellini <stefano.stabellini@xxxxxxx>
Acked-by: Roger Pau Monné <roger@xxxxxxxxxxxxxx>
---
 xen/common/rangeset.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/xen/common/rangeset.c b/xen/common/rangeset.c
index 0e3b9acd35..2c0c1bfc08 100644
--- a/xen/common/rangeset.c
+++ b/xen/common/rangeset.c
@@ -239,9 +239,10 @@ int rangeset_remove_range(
             destroy_range(r, t);
         }
 
-        x->s = e + 1;
-        if ( x->s > x->e )
+        if ( x->e <= e )
             destroy_range(r, x);
+        else
+            x->s = e + 1;
     }
 
  out:
-- 
2.43.0