--- /dev/null
+diff --git a/xen/arch/x86/mm/shadow/common.c b/xen/arch/x86/mm/shadow/common.c
+index ca4cb13..71bfe27 100644
+--- a/xen/arch/x86/mm/shadow/common.c
++++ b/xen/arch/x86/mm/shadow/common.c
+@@ -2730,6 +2730,13 @@ void sh_remove_shadows(struct vcpu *v, mfn_t gmfn, int fast, int all)
+
+ ASSERT(!(all && fast));
+
++ if ( unlikely(!mfn_valid(gmfn)) )
++ {
++ /* Get out now if we're trying to remove shadows of a MMIO
++ * direct page. */
++ return;
++ }
++
+ /* Although this is an externally visible function, we do not know
+ * whether the shadow lock will be held when it is called (since it
+ * can be called via put_page_type when we clear a shadow l1e).