K 10
svn:author
V 6
tuexen
K 8
svn:date
V 27
2020-05-06T21:59:58.252005Z
K 7
svn:log
V 758
MFC r349989: Improve input validation for l_linger

When using the SOL_SOCKET level socket option SO_LINGER, the structure
struct linger is used as the option value. The component l_linger is of
type int, but internally copied to the field so_linger of the structure
struct socket. The type of so_linger is short, but it is assumed to be
non-negative and the value is used to compute ticks to be stored in a
variable of type int.

Therefore, perform input validation on l_linger similar to the one
performed by NetBSD and OpenBSD.

Thanks to syzkaller for making me aware of this issue.

Thanks to markj@ for pointing out that a similar check should be added
to so_linger_set().

Reviewed by:		markj
Differential Revision:	https://reviews.freebsd.org/D20948

END