linux: Fix sockopt copyout

[chuck]

Summary

The Linux getsockopt did not check the size of the provided buffer when
copying out the value, leading to buffer overflows (e.g., for TCP_INFO).

Fix is to use the smaller of the option value size and the provided
buffer.

[kib]

sys/compat/linux/linux_socket.c

2319

Is it right to use FreeBSD-native type for socklen? Do we need e.g. linux_socklen_t, if we do not have it already?

[chuck]

sys/compat/linux/linux_socket.c

2319

There is a l_socklen_t in sys/amd64/linux/linux.h, but it is defined as an l_ulong. Since linux_getsockopt_args defines optlen as l_uintptr_t, perhaps this should be l_uint?

[kib]

sys/compat/linux/linux_socket.c

2319

But why l_uint? It should be l_socklen_t, no?

[markj]

sys/compat/linux/linux_socket.c

2319

In the Linux sources the type is int *. I don't know why our emulator uses l_uintptr_t, it looks incorrect. Probably that should be fixed.

[chuck]

Update change from review feedback

[markj]

sys/compat/linux/linux_socket.c

2321–2322

Now I don't understand what this change is fixing. Is it the loptlen < 0 check that's required?

[chuck]

sys/compat/linux/linux_socket.c

2321–2322

The fix is the copyin() of optlen to reconcile how much data to copyout() (smaller of length passed to the function and the Linux buffer length).

The "less than zero" check is to account for the sign difference when converting Linux's integer optlen to (an unsigned) socklen_t in order to compare the buffer sizes.

[chuck]

Rebase