From e028aac940ff6c8830ef1bc7ec861c9a737f5df5 Mon Sep 17 00:00:00 2001 From: Weiqi Wang Date: Wed, 14 Oct 2026 09:24:54 +0200 Subject: [PATCH] argo: bound len before comparing offset in memcpy_to_guest_ring() memcpy_to_guest_ring() bounds the copy against the ring size with if ( len + offset > XEN_ARGO_MAX_RING_SIZE ) where len and offset are unsigned int. offset is masked below PAGE_SIZE just above, but a len close to UINT_MAX makes len + offset wrap below XEN_ARGO_MAX_RING_SIZE and pass the check. The head_len computation in the loop wraps the same way, so the copy length is no longer bounded. All current callers bound len via iov_count(), so this is not reachable in practice. No functional change for in-range inputs. Signed-off-by: Weiqi Wang Acked-by: Jan Beulich --- xen/common/argo.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/xen/common/argo.c b/xen/common/argo.c index 0b9a54db36..b308ee8311 100644 --- a/xen/common/argo.c +++ b/xen/common/argo.c @@ -568,7 +568,8 @@ memcpy_to_guest_ring(const struct domain *d, struct argo_ring_info *ring_info, offset &= ~PAGE_MASK; - if ( len + offset > XEN_ARGO_MAX_RING_SIZE ) + if ( len > XEN_ARGO_MAX_RING_SIZE || + offset > XEN_ARGO_MAX_RING_SIZE - len ) return -EFAULT; while ( len )