argo: bound len before comparing offset in memcpy_to_guest_ring()

memcpy_to_guest_ring() bounds the copy against the ring size with

    if ( len + offset > XEN_ARGO_MAX_RING_SIZE )

where len and offset are unsigned int. offset is masked below
PAGE_SIZE just above, but a len close to UINT_MAX makes len + offset
wrap below XEN_ARGO_MAX_RING_SIZE and pass the check. The head_len
computation in the loop wraps the same way, so the copy length is no
longer bounded.

All current callers bound len via iov_count(), so this is not
reachable in practice.

No functional change for in-range inputs.

Signed-off-by: Weiqi Wang <weiqi.wang-2@postgrad.manchester.ac.uk>
Acked-by: Jan Beulich <jbeulich@suse.com>

xen/common/argo.c

@@ -568,7 +568,8 @@ memcpy_to_guest_ring(const struct domain *d, struct argo_ring_info *ring_info,
 
     offset &= ~PAGE_MASK;
 
-    if ( len + offset > XEN_ARGO_MAX_RING_SIZE )
+    if ( len > XEN_ARGO_MAX_RING_SIZE ||
+         offset > XEN_ARGO_MAX_RING_SIZE - len )
         return -EFAULT;
 
     while ( len )