From: Ahmad Fatoum <[email protected]> ftruncate() passes any length on to the file system driver and then records it as the new file size. None of the drivers expect a negative one, so e.g. ubootvarfs moves the rest of the environment to before the start of its buffer when asked to truncate a variable to -100 bytes.
A negative length is easy to come by: truncate -s parses its argument as unsigned and truncate -s +SIZE can wrap around. Let's return -EINVAL for it like POSIX says, before any driver sees it. Assisted-by: Claude:opus-5.5 Signed-off-by: Ahmad Fatoum <[email protected]> --- fs/fs.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/fs.c b/fs/fs.c index e18e3b9cd7b2..977635d41082 100644 --- a/fs/fs.c +++ b/fs/fs.c @@ -393,6 +393,9 @@ int ftruncate(int fd, loff_t length) if (IS_ERR(f)) return -errno; + if (length < 0) + return errno_set(-EINVAL); + if (!i_size_is_bound(f->f_inode)) return 0; -- 2.47.3
