Input validation for l_linger

[tuexen]

Summary

When using the SOL_SOCKET level socket option SO_LINGER, the structure struct linger is used as the option value. The component l_linger is of type int, but internally copied to the field so_linger of the structure struct socket. The type of so_linger is short, but it is assumed to be non-negative and the value is used to compute ticks to be stored in a variable of type int.

Therefore, perform input validation on l_linger similar to the one performed by NetBSD and OpenBSD.

Thanks to syzkaller for making me aware of this issue.

[markj]

We also have the (unused) so_linger_set(), which should possibly assert that the input value is valid.

[tuexen]

Use KASSERT in so_linger_set() to ensure that the value is valid as suggested by markj@.

[tuexen]

In D20948#454139, @markj wrote:

We also have the (unused) so_linger_set(), which should possibly assert that the input value is valid.

Added in updated version.