[xen staging] xen/rangeset: Fix rangeset_remove_range() with e == ~0UL

[patchbot@xxxxxxx]

commit 4e3c0eeac5761c505f8229e82d265eb29957ca5c
Author:     Stefano Stabellini <stefano.stabellini@xxxxxxx>
AuthorDate: Tue Oct 20 15:33:26 2026 -0700
Commit:     Stefano Stabellini <stefano.stabellini@xxxxxxx>
CommitDate: Fri Oct 23 17:26:14 2026 -0700

    xen/rangeset: Fix rangeset_remove_range() with e == ~0UL
    
    When the removal spans several ranges, the last one is trimmed by
    setting its start to e + 1, and destroyed if that leaves it empty.  For
    e == ~0UL, e + 1 wraps to 0, so the range is kept as [0, end] and the
    removal adds everything below it.
    
    This is hit by pv_shim_shutdown(), whose iomem_deny_access(d, 0, ~0UL)
    on resume turns the guest's grant frame permissions into [0, highest
    grant frame].  arch_iommu_hwdom_init() can hit it too, for a PVH
    hardware domain with an E820 entry above its 48-bit iomem_caps.
    
    Destroy the range when it ends within [s, e] instead.
    
    Signed-off-by: Stefano Stabellini <stefano.stabellini@xxxxxxx>
    Acked-by: Roger Pau Monné <roger@xxxxxxxxxxxxxx>
---
 xen/common/rangeset.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/xen/common/rangeset.c b/xen/common/rangeset.c
index 0e3b9acd35..2c0c1bfc08 100644
--- a/xen/common/rangeset.c
+++ b/xen/common/rangeset.c
@@ -239,9 +239,10 @@ int rangeset_remove_range(
             destroy_range(r, t);
         }
 
-        x->s = e + 1;
-        if ( x->s > x->e )
+        if ( x->e <= e )
             destroy_range(r, x);
+        else
+            x->s = e + 1;
     }
 
  out:
--
generated by git-patchbot for /home/xen/git/xen.git#staging