Check IPv4 options when using IP_HDRINCL socket option on SOCK_RAW sockets

[tuexen]

Summary

When sending a packet on a socket(AF_INET, SOCKRAW, ...) socket having the IP_HDRINCL socket option enabled, the user can provide inconsistent data for the options in the IPv4 header. When the packets need to be fragmented, the function [[ https://svnweb.freebsd.org/base/head/sys/netinet/ip_options.c?view=markup#l561 | ip_optcopy ]] assumes the the IP options have a valid layout. The valid layouts are described in RFC 791. This patch verifies that the user provides the IP options using a valid layout.

This issue was found by running syzkaller on OpenBSD. Greg Steuck made me aware that the problem might also exist on FreeBSD.

Test Plan

Use the attached test program on a kernel with INVARIANTS enabled. Without the fix, the kernel panics. With the fix, the write() call fails.

test-raw-1.c1 KBDownload

[tuexen]

Use explicit page number range instead of 15ff as suggested by lstewart@.