copy_file_range and splice accept a negative offset #467

copy_file_range and splice read *off_in and *off_out from guest memory into an int64_t that starts at -1, and the copy code treats any negative value as "use the descriptor's position" (io_copy_chunked in src/syscall/io.c, and the same >= 0 tests in the splice path). A guest that passes a pointer to a negative offset therefore gets a copy from or to the file position instead of an error.

Linux rejects these calls. Measured with a static aarch64 probe that writes 8 bytes to a regular file and calls each syscall with a pointer to -1 and a count of 4:

On Linux, copy_file_range gives EOVERFLOW because generic_copy_file_checks adds the size_t count to the loff_t position, the negative position promotes to a huge unsigned value, and the sum wraps. splice gives EINVAL from the rw_verify_area check on a negative position.

Goal: a negative offset passed by pointer is refused with the Linux errno before anything is copied, and the "no pointer" case keeps using the descriptor position. That means the sentinel would have to be "pointer was NULL" rather than "value is negative".

Found while answering review on #463; not changed there because it is outside RLIMIT_FSIZE.