Re: [PATCH] xen/argo: make the ring copy length check overflow-safe

[Jan Beulich <jbeulich@xxxxxxxx>]

On 10.10.2026 15:28, WeiqiW wrote:
> From: Weiqi Wang <weiqi.wang-2@xxxxxxxxxxxxxxxxxxxxxxxxx>
> 
> memcpy_to_guest_ring() bounds the copy against the ring size with
> 
>     if ( len + offset > XEN_ARGO_MAX_RING_SIZE )
> 
> where len and offset are unsigned int.  offset is masked below PAGE_SIZE
> just above, but a len close to UINT_MAX makes len + offset wrap below
> XEN_ARGO_MAX_RING_SIZE and pass the check.  The head_len computation in
> the loop wraps the same way, so the copy length is no longer bounded.
> 
> All current callers bound len via iov_count(), so this is not reachable
> in practice.

Which makes it questionable whether the change is actually needed. But as
it doesn't look to introduce (e.g.) dead code, the change is likely fine
to make.

However, there's a formal aspect which may need sorting:

>  Do not rely on that: bound len first, then compare offset
> against the room that is left.
> 
> No functional change for in-range inputs.
> 
> Signed-off-by: WeiqiW <lukewang19@xxxxxxxxxxx>

There are two different real names and three different email addresses
involved in your submission. Generally we'd expect at least the From:
that's going to be transformed to commit author to match the S-o-b. The
mail coming from yet another email address is maybe okay-ish, but not
helpful. The main problem being - how would anyone (reliably) determine
that all three belong to one an the same person, not several merely
happening to have identical / similar names.

Hence no ack just yet.

Jan