[src/trunk]: src/sys/kern Add more checks, if the values are negative we hit ...

[maxv <maxv%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/67d98e8861a9
branches:  trunk
changeset: 455809:67d98e8861a9
user:      maxv <maxv%NetBSD.org@localhost>
date:      Sun Apr 14 09:09:55 2019 +0000

description:
Add more checks, if the values are negative we hit a KASSERT later in the
timeout.

Reported-by: syzbot+662dbeb526303f458255%syzkaller.appspotmail.com@localhost

diffstat:

 sys/kern/uipc_socket.c |  8 ++++++--
 1 files changed, 6 insertions(+), 2 deletions(-)

diffs (29 lines):

diff -r eaefc1e936d1 -r 67d98e8861a9 sys/kern/uipc_socket.c
--- a/sys/kern/uipc_socket.c    Sun Apr 14 08:23:20 2019 +0000
+++ b/sys/kern/uipc_socket.c    Sun Apr 14 09:09:55 2019 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: uipc_socket.c,v 1.273 2019/04/08 18:38:45 maxv Exp $   */
+/*     $NetBSD: uipc_socket.c,v 1.274 2019/04/14 09:09:55 maxv Exp $   */
 
 /*
  * Copyright (c) 2002, 2007, 2008, 2009 The NetBSD Foundation, Inc.
@@ -71,7 +71,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: uipc_socket.c,v 1.273 2019/04/08 18:38:45 maxv Exp $");
+__KERNEL_RCSID(0, "$NetBSD: uipc_socket.c,v 1.274 2019/04/14 09:09:55 maxv Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_compat_netbsd.h"
@@ -1841,6 +1841,10 @@
                if (error)
                        break;
 
+               if (tv.tv_sec < 0 || tv.tv_usec < 0 || tv.tv_usec >= 1000000) {
+                       error = EDOM;
+                       break;
+               }
                if (tv.tv_sec > (INT_MAX - tv.tv_usec / tick) / hz) {
                        error = EDOM;
                        break;