ptrace: Do not pass a negative resid to proc_rwmem()

[markj]

Summary

uiomove() asserts against this.

proc_iop() already asserts this, but maybe it should be a runtime check.

While here, avoid truncting uio_resid in proc_rwmem().

sys/kern/sys_process.c

do {
                  * Get the page number of this segment.
                  */
                 pageno = trunc_page(uva);
                 page_offset = uva - pageno;
 
                 /*
                  * How many bytes to copy
                  */
-                len = min(PAGE_SIZE - page_offset, uio->uio_resid);
+                len = MIN(PAGE_SIZE - page_offset, uio->uio_resid);
 
                 /*
                  * Fault and hold the page on behalf of the process.
                  */
                 error = vm_fault(map, pageno, reqprot, fault_flags, &m);
                 if (error != KERN_SUCCESS) {
                         if (error == KERN_RESOURCE_SHORTAGE)
                                 error = ENOMEM;
else
                         CTR3(KTR_PTRACE, "PT_READ: pid %d: %p >= %#x",
                             p->p_pid, addr, tmp);
                 td->td_retval[0] = tmp;
                 PROC_LOCK(p);
                 break;
 
         case PT_IO:
                 piod = addr;
+                if (piod->piod_len > SSIZE_MAX) {
+                        error = EINVAL;
+                        goto out;
+                }
                 iov.iov_base = piod->piod_addr;
                 iov.iov_len = piod->piod_len;
                 uio.uio_offset = (off_t)(uintptr_t)piod->piod_offs;
                 uio.uio_resid = piod->piod_len;
                 uio.uio_iov = &iov;
                 uio.uio_iovcnt = 1;
                 uio.uio_segflg = UIO_USERSPACE;
                 uio.uio_td = td;