diff --git a/xen/common/argo.c b/xen/common/argo.c
index 0b9a54db36..b308ee8311 100644
--- a/xen/common/argo.c
+++ b/xen/common/argo.c
@@ -568,7 +568,8 @@ memcpy_to_guest_ring(const struct domain *d, struct argo_ring_info *ring_info,
 
     offset &= ~PAGE_MASK;
 
-    if ( len + offset > XEN_ARGO_MAX_RING_SIZE )
+    if ( len > XEN_ARGO_MAX_RING_SIZE ||
+         offset > XEN_ARGO_MAX_RING_SIZE - len )
         return -EFAULT;
 
     while ( len )