io_uring/sync: validate passed in offset

Check if the passed in offset is negative once cast to sync->off. This
ensures that -EINVAL is returned for that case, like it would be for
sync_file_range(2).

Fixes: c992fe2925d7 ("io_uring: add fsync support")
Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/io_uring/sync.c b/io_uring/sync.c
index cea2d381ffd2a49a75c135f136d3ca5f463a6dc5..ab7fa1cd7dd639074190ff991aa2ae7121170ba5 100644 (file)
--- a/io_uring/sync.c
+++ b/io_uring/sync.c
@@ -62,6 +62,8 @@ int io_fsync_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
                return -EINVAL;
 
        sync->off = READ_ONCE(sqe->off);
+       if (sync->off < 0)
+               return -EINVAL;
        sync->len = READ_ONCE(sqe->len);
        req->flags |= REQ_F_FORCE_ASYNC;
        return 0;