| From a31c000bf2b2efa1eda6b5cd2b9ae1f7b52d8233 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Wed, 21 Jan 2026 11:48:56 -0700 |
| Subject: io_uring/sync: validate passed in offset |
| |
| From: Jens Axboe <axboe@kernel.dk> |
| |
| [ Upstream commit 649dd18f559891bdafc5532d737c7dfb56060a6d ] |
| |
| Check if the passed in offset is negative once cast to sync->off. This |
| ensures that -EINVAL is returned for that case, like it would be for |
| sync_file_range(2). |
| |
| Fixes: c992fe2925d7 ("io_uring: add fsync support") |
| Signed-off-by: Jens Axboe <axboe@kernel.dk> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| io_uring/sync.c | 2 ++ |
| 1 file changed, 2 insertions(+) |
| |
| diff --git a/io_uring/sync.c b/io_uring/sync.c |
| index cea2d381ffd2a..ab7fa1cd7dd63 100644 |
| --- a/io_uring/sync.c |
| +++ b/io_uring/sync.c |
| @@ -62,6 +62,8 @@ int io_fsync_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe) |
| return -EINVAL; |
| |
| sync->off = READ_ONCE(sqe->off); |
| + if (sync->off < 0) |
| + return -EINVAL; |
| sync->len = READ_ONCE(sqe->len); |
| req->flags |= REQ_F_FORCE_ASYNC; |
| return 0; |
| -- |
| 2.51.0 |
| |
