aio: Return EINVAL if the number of events is negative.

PiperOrigin-RevId: 202671065
Change-Id: I248b74544d47ddde9cd59d89aa6ccb7dad2b6f89

1 files changed, 5 insertions, 1 deletions

diff --git a/pkg/sentry/syscalls/linux/sys_aio.go b/pkg/sentry/syscalls/linux/sys_aio.go
index 470027206..345ef9bec 100644
--- a/pkg/sentry/syscalls/linux/sys_aio.go
+++ b/pkg/sentry/syscalls/linux/sys_aio.go
@@ -132,7 +132,7 @@ func IoGetevents(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.S
 	timespecAddr := args[4].Pointer()
 
 	// Sanity check arguments.
-	if minEvents > events {
+	if minEvents < 0 || minEvents > events {
 		return 0, nil, syserror.EINVAL
 	}
 
@@ -359,6 +359,10 @@ func IoSubmit(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Sysc
 	nrEvents := args[1].Int()
 	addr := args[2].Pointer()
 
+	if nrEvents < 0 {
+		return 0, nil, syserror.EINVAL
+	}
+
 	for i := int32(0); i < nrEvents; i++ {
 		// Copy in the address.
 		cbAddrNative := t.Arch().Native(0)