[xen master] argo: bound len before comparing offset in memcpy_to_guest_ring()

[patchbot@xxxxxxx]

commit e028aac940ff6c8830ef1bc7ec861c9a737f5df5
Author:     Weiqi Wang <weiqi.wang-2@xxxxxxxxxxxxxxxxxxxxxxxxx>
AuthorDate: Wed Oct 14 09:24:54 2026 +0200
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Wed Oct 14 09:24:54 2026 +0200

    argo: bound len before comparing offset in memcpy_to_guest_ring()
    
    memcpy_to_guest_ring() bounds the copy against the ring size with
    
        if ( len + offset > XEN_ARGO_MAX_RING_SIZE )
    
    where len and offset are unsigned int. offset is masked below
    PAGE_SIZE just above, but a len close to UINT_MAX makes len + offset
    wrap below XEN_ARGO_MAX_RING_SIZE and pass the check. The head_len
    computation in the loop wraps the same way, so the copy length is no
    longer bounded.
    
    All current callers bound len via iov_count(), so this is not
    reachable in practice.
    
    No functional change for in-range inputs.
    
    Signed-off-by: Weiqi Wang <weiqi.wang-2@xxxxxxxxxxxxxxxxxxxxxxxxx>
    Acked-by: Jan Beulich <jbeulich@xxxxxxxx>
---
 xen/common/argo.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/xen/common/argo.c b/xen/common/argo.c
index 0b9a54db36..b308ee8311 100644
--- a/xen/common/argo.c
+++ b/xen/common/argo.c
@@ -568,7 +568,8 @@ memcpy_to_guest_ring(const struct domain *d, struct 
argo_ring_info *ring_info,
 
     offset &= ~PAGE_MASK;
 
-    if ( len + offset > XEN_ARGO_MAX_RING_SIZE )
+    if ( len > XEN_ARGO_MAX_RING_SIZE ||
+         offset > XEN_ARGO_MAX_RING_SIZE - len )
         return -EFAULT;
 
     while ( len )
--
generated by git-patchbot for /home/xen/git/xen.git#master