RIP, RIP6, DDP, SCTP and SCTP6 lack a length check in their _connect()

functions. Fix the first three, and add a big XXX in the SCTP ones.

Found by KASAN, triggered by SyzKaller.

Reported-by: syzbot+9eaf98dad6ca738c250d@syzkaller.appspotmail.com

sys/netatalk/ddp_usrreq.c

@@ -1,4 +1,4 @@
-/*	$NetBSD: ddp_usrreq.c,v 1.72 2019/01/28 12:53:01 martin Exp $	 */
+/*	$NetBSD: ddp_usrreq.c,v 1.73 2019/02/24 07:20:33 maxv Exp $	 */
 
 /*
  * Copyright (c) 1990,1991 Regents of The University of Michigan.
@@ -27,7 +27,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ddp_usrreq.c,v 1.72 2019/01/28 12:53:01 martin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ddp_usrreq.c,v 1.73 2019/02/24 07:20:33 maxv Exp $");
 
 #include "opt_mbuftrace.h"
 #include "opt_atalk.h"
@@ -185,9 +185,11 @@ at_pcbconnect(struct ddpcb *ddp, struct sockaddr_at *sat)
 	struct ifnet   *ifp;
 	u_short         hintnet = 0, net;
 
-	if (sat->sat_family != AF_APPLETALK) {
+	if (sat->sat_family != AF_APPLETALK)
 		return EAFNOSUPPORT;
-	}
+	if (sat->sat_len != sizeof(*sat))
+		return EINVAL;
+
 	/*
          * Under phase 2, network 0 means "the network".  We take "the
          * network" to mean the network the control block is bound to.

sys/netinet/raw_ip.c

@@ -1,4 +1,4 @@
-/*	$NetBSD: raw_ip.c,v 1.178 2018/09/14 05:09:51 maxv Exp $	*/
+/*	$NetBSD: raw_ip.c,v 1.179 2019/02/24 07:20:33 maxv Exp $	*/
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -65,7 +65,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: raw_ip.c,v 1.178 2018/09/14 05:09:51 maxv Exp $");
+__KERNEL_RCSID(0, "$NetBSD: raw_ip.c,v 1.179 2019/02/24 07:20:33 maxv Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_inet.h"
@@ -499,6 +499,8 @@ rip_connect_pcb(struct inpcb *inp, struct sockaddr_in *addr)
 		return (EADDRNOTAVAIL);
 	if (addr->sin_family != AF_INET)
 		return (EAFNOSUPPORT);
+	if (addr->sin_len != sizeof(*addr))
+		return EINVAL;
 	inp->inp_faddr = addr->sin_addr;
 	return (0);
 }

sys/netinet/sctp_usrreq.c

@@ -1,5 +1,5 @@
 /*	$KAME: sctp_usrreq.c,v 1.50 2005/06/16 20:45:29 jinmei Exp $	*/
-/*	$NetBSD: sctp_usrreq.c,v 1.16 2019/02/15 14:13:32 rjs Exp $	*/
+/*	$NetBSD: sctp_usrreq.c,v 1.17 2019/02/24 07:20:33 maxv Exp $	*/
 
 /*
  * Copyright (c) 2001, 2002, 2003, 2004 Cisco Systems, Inc.
@@ -33,7 +33,7 @@
  * SUCH DAMAGE.
  */
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: sctp_usrreq.c,v 1.16 2019/02/15 14:13:32 rjs Exp $");
+__KERNEL_RCSID(0, "$NetBSD: sctp_usrreq.c,v 1.17 2019/02/24 07:20:33 maxv Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_inet.h"
@@ -3342,6 +3342,11 @@ sctp_connect(struct socket *so, struct sockaddr *nam, struct lwp *l)
 		return (EINVAL);
 	}
 #endif /* INET6 */
+
+	/*
+	 * XXX XXX XXX Check nam->sa_len?
+	 */
+
 	if ((inp->sctp_flags & SCTP_PCB_FLAGS_UNBOUND) ==
 	    SCTP_PCB_FLAGS_UNBOUND) {
 		/* Bind a ephemeral port */

sys/netinet6/raw_ip6.c

@@ -1,4 +1,4 @@
-/*	$NetBSD: raw_ip6.c,v 1.173 2019/01/28 12:53:01 martin Exp $	*/
+/*	$NetBSD: raw_ip6.c,v 1.174 2019/02/24 07:20:33 maxv Exp $	*/
 /*	$KAME: raw_ip6.c,v 1.82 2001/07/23 18:57:56 jinmei Exp $	*/
 
 /*
@@ -62,7 +62,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: raw_ip6.c,v 1.173 2019/01/28 12:53:01 martin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: raw_ip6.c,v 1.174 2019/02/24 07:20:33 maxv Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_ipsec.h"
@@ -716,6 +716,8 @@ rip6_connect(struct socket *so, struct sockaddr *nam, struct lwp *l)
 		return EADDRNOTAVAIL;
 	if (addr->sin6_family != AF_INET6)
 		return EAFNOSUPPORT;
+	if (addr->sin6_len != sizeof(*addr))
+		return EINVAL;
 
 	/*
 	 * Application should provide a proper zone ID or the use of

sys/netinet6/sctp6_usrreq.c

@@ -1,5 +1,5 @@
 /* $KAME: sctp6_usrreq.c,v 1.38 2005/08/24 08:08:56 suz Exp $ */
-/* $NetBSD: sctp6_usrreq.c,v 1.17 2019/01/28 12:53:01 martin Exp $ */
+/* $NetBSD: sctp6_usrreq.c,v 1.18 2019/02/24 07:20:33 maxv Exp $ */
 
 /*
  * Copyright (c) 2001, 2002, 2003, 2004 Cisco Systems, Inc.
@@ -33,7 +33,7 @@
  * SUCH DAMAGE.
  */
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: sctp6_usrreq.c,v 1.17 2019/01/28 12:53:01 martin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: sctp6_usrreq.c,v 1.18 2019/02/24 07:20:33 maxv Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_inet.h"
@@ -961,6 +961,11 @@ sctp6_connect(struct socket *so, struct sockaddr *nam, struct lwp *l)
 
 #ifdef INET
 	sin6 = (struct sockaddr_in6 *)nam;
+
+	/*
+	 * XXX XXX XXX Check sin6->sin6_len?
+	 */
+
 	if (inp6->in6p_flags & IN6P_IPV6_V6ONLY) {
 		/*
 		 * if IPV6_V6ONLY flag, ignore connections