sound: Check user-supplied size passed to SNDSTIOC_ADD_USER_DEVS*

SNDSTIOC_ADD_USER_DEVS* expects a user-supplied sndstioc_nv_arg->nbytes,
however we currently do not check whether this size is actually valid,
which results in a panic when SNDSTIOC_ADD_USER_DEVS* is called with an
invalid size. sndstat_add_user_devs() calls
sndstat_unpack_user_nvlbuf(), which then calls malloc() with that size.

PR:		266142
Sponsored by:	The FreeBSD Foundation
MFC after:	1 day
Reviewed by:	brooks
Differential Revision:	https://reviews.freebsd.org/D45236

sys/dev/sound/pcm/sndstat.c

@@ -864,6 +864,11 @@ sndstat_add_user_devs(struct sndstat_file *pf, caddr_t data)
 		goto done;
 	}
 
+	if (arg->nbytes > SNDST_UNVLBUF_MAX) {
+		err = ENOMEM;
+		goto done;
+	}
+
 	err = sndstat_unpack_user_nvlbuf(arg->buf, arg->nbytes, &nvl);
 	if (err != 0)
 		goto done;

sys/sys/sndstat.h

@@ -74,6 +74,11 @@ struct sndstioc_nv_arg {
 #define SNDST_DSPS_SOUND4_PVCHAN	"pvchan"
 #define SNDST_DSPS_SOUND4_RVCHAN	"rvchan"
 
+/*
+ * Maximum user-specified nvlist buffer size
+ */
+#define SNDST_UNVLBUF_MAX		65535
+
 #define SNDSTIOC_REFRESH_DEVS \
 	_IO('D', 100)
 #define SNDSTIOC_GET_DEVS \