syscalls: misc vulnerability fixes

kernel-src/sys/syscalls/clockget.c

@@ -12,15 +12,13 @@ syscallret_t syscall_clockget(context_t *, int clockid, timespec_t *tp) {
 	switch (clockid) {
 		case CLOCK_REALTIME: {
 			timespec_t ts = timekeeper_time();
-			usercopy_touser(tp, &ts, sizeof(timespec_t));
+			ret.errno = usercopy_touser(tp, &ts, sizeof(timespec_t));
-			ret.errno = 0;
 			break;
 		}
 		case CLOCK_MONOTONIC:
 		case CLOCK_BOOTTIME: {
 			timespec_t ts = timekeeper_timefromboot();
-			usercopy_touser(tp, &ts, sizeof(timespec_t));
+			ret.errno = usercopy_touser(tp, &ts, sizeof(timespec_t));
-			ret.errno = 0;
 			break;
 		}
 		default: {

kernel-src/sys/syscalls/getsockopt.c

@@ -11,6 +11,7 @@ syscallret_t syscall_getsockopt(context_t *, int fd, int level, int optname, voi
 
 	if (!IS_USER_ADDRESS(val) || !IS_USER_ADDRESS(len)) {
 		ret.errno = EFAULT;
+		return ret;
 	}
 
 	file_t *file = fd_get(fd);

kernel-src/sys/syscalls/hostname.c

@@ -59,10 +59,11 @@ syscallret_t syscall_hostname(context_t *, char *unew, size_t newsize, char *uol
 	spinlock_release(&lock);
 	interrupt_set(true);
 
+	ret.errno = 0;
+
 	if (uold)
 		ret.errno = usercopy_touser(uold, old, copysize + 1);
 
-	ret.errno = 0;
+	ret.ret = ret.errno ? -1 : 0;
-	ret.ret = 0;
 	return ret;
 }

kernel-src/sys/syscalls/kill.c

@@ -9,6 +9,11 @@ syscallret_t syscall_kill(context_t *context, int pid, int signal) {
 		.ret = -1
 	};
 
+	if (signal >= NSIG) {
+		ret.errno = EINVAL;
+		return ret;
+	}
+
 	int effectivepid = -1;
 
 	if (pid > 0) // specific process

kernel-src/sys/syscalls/killthread.c

@@ -9,7 +9,7 @@ syscallret_t syscall_killthread(context_t *context, int pid, int tid, int signal
 		.ret = -1
 	};
 
-	if (pid < 1 || tid < 1 || signal < 0 || signal > NSIG) {
+	if (pid < 1 || tid < 1 || signal < 0 || signal >= NSIG) {
 		ret.errno = EINVAL;
 		return ret;
 	}

kernel-src/sys/syscalls/sigaction.c

@@ -7,7 +7,7 @@ syscallret_t syscall_sigaction(context_t *, int sig, sigaction_t *new, sigaction
 		.ret = -1
 	};
 
-	if (sig > NSIG || sig == SIGKILL || sig == SIGSTOP) {
+	if (sig >= NSIG || sig == SIGKILL || sig == SIGSTOP) {
 		ret.errno = EINVAL;
 		return ret;
 	}