[PATCH 2/6] fs: reject negative lengths in ftruncate()

[Ahmad Fatoum <a.fatoum@pengutronix.de>]

From: Ahmad Fatoum <a.fatoum@barebox.org>

ftruncate() passes any length on to the file system driver and then
records it as the new file size. None of the drivers expect a negative
one, so e.g. ubootvarfs moves the rest of the environment to before the
start of its buffer when asked to truncate a variable to -100 bytes.

A negative length is easy to come by: truncate -s parses its argument
as unsigned and truncate -s +SIZE can wrap around. Let's return -EINVAL
for it like POSIX says, before any driver sees it.

Assisted-by: Claude:opus-5.5
Signed-off-by: Ahmad Fatoum <a.fatoum@barebox.org>
---
 fs/fs.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/fs.c b/fs/fs.c
index e18e3b9cd7b2..977635d41082 100644
--- a/fs/fs.c
+++ b/fs/fs.c
@@ -393,6 +393,9 @@ int ftruncate(int fd, loff_t length)
 	if (IS_ERR(f))
 		return -errno;
 
+	if (length < 0)
+		return errno_set(-EINVAL);
+
 	if (!i_size_is_bound(f->f_inode))
 		return 0;
 
-- 
2.47.3