xen/rangeset: Fix rangeset_remove_range() with e == ~0UL

When the removal spans several ranges, the last one is trimmed by
setting its start to e + 1, and destroyed if that leaves it empty.  For
e == ~0UL, e + 1 wraps to 0, so the range is kept as [0, end] and the
removal adds everything below it.

This is hit by pv_shim_shutdown(), whose iomem_deny_access(d, 0, ~0UL)
on resume turns the guest's grant frame permissions into [0, highest
grant frame].  arch_iommu_hwdom_init() can hit it too, for a PVH
hardware domain with an E820 entry above its 48-bit iomem_caps.

Destroy the range when it ends within [s, e] instead.

Signed-off-by: Stefano Stabellini <stefano.stabellini@amd.com>
Acked-by: Roger Pau Monné <roger@xenproject.org>

xen/common/rangeset.c

@@ -239,9 +239,10 @@ int rangeset_remove_range(
             destroy_range(r, t);
         }
 
-        x->s = e + 1;
-        if ( x->s > x->e )
+        if ( x->e <= e )
             destroy_range(r, x);
+        else
+            x->s = e + 1;
     }
 
  out: