From 4e3c0eeac5761c505f8229e82d265eb29957ca5c Mon Sep 17 00:00:00 2001 From: Stefano Stabellini Date: Tue, 20 Oct 2026 15:33:26 -0700 Subject: [PATCH] xen/rangeset: Fix rangeset_remove_range() with e == ~0UL MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit When the removal spans several ranges, the last one is trimmed by setting its start to e + 1, and destroyed if that leaves it empty. For e == ~0UL, e + 1 wraps to 0, so the range is kept as [0, end] and the removal adds everything below it. This is hit by pv_shim_shutdown(), whose iomem_deny_access(d, 0, ~0UL) on resume turns the guest's grant frame permissions into [0, highest grant frame]. arch_iommu_hwdom_init() can hit it too, for a PVH hardware domain with an E820 entry above its 48-bit iomem_caps. Destroy the range when it ends within [s, e] instead. Signed-off-by: Stefano Stabellini Acked-by: Roger Pau Monné --- xen/common/rangeset.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/xen/common/rangeset.c b/xen/common/rangeset.c index 0e3b9acd35..2c0c1bfc08 100644 --- a/xen/common/rangeset.c +++ b/xen/common/rangeset.c @@ -239,9 +239,10 @@ int rangeset_remove_range( destroy_range(r, t); } - x->s = e + 1; - if ( x->s > x->e ) + if ( x->e <= e ) destroy_range(r, x); + else + x->s = e + 1; } out: