FreeBSD/src a85b7f1 (r349989)sys/kern uipc_socket.c

Improve the input validation for l_linger.
When using the SOL_SOCKET level socket option SO_LINGER, the structure
struct linger is used as the option value. The component l_linger is of
type int, but internally copied to the field so_linger of the structure
struct socket. The type of so_linger is short, but it is assumed to be
non-negative and the value is used to compute ticks to be stored in a
variable of type int.

Therefore, perform input validation on l_linger similar to the one
performed by NetBSD and OpenBSD.

Thanks to syzkaller for making me aware of this issue.

Thanks to markj@ for pointing out that a similar check should be added
to so_linger_set().

Reviewed by:            markj@
MFC after:              2 weeks
Differential Revision:  https://reviews.freebsd.org/D20948
DeltaFile
+9-1sys/kern/uipc_socket.c
+9-11 files

UnifiedSplitRaw