[NET]: Validate socket filters against BPF_MAXINSNS in one spot.

Currently the checks are scattered all over and this leads
to inconsistencies and even cases where the check is not made.

Based upon a patch from Kris Katterjohn.

Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 2 insertions, 2 deletions

diff --git a/net/core/filter.c b/net/core/filter.c
index 2841bfce29d6..3a10e0bc90e8 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -293,7 +293,7 @@ int sk_chk_filter(struct sock_filter *filter, int flen)
         struct sock_filter *ftest;
         int pc;
 
-        if (((unsigned int)flen >= (~0U / sizeof(struct sock_filter))) || flen == 0)
+        if (flen == 0 || flen > BPF_MAXINSNS)
                 return -EINVAL;
 
         /* check the filter code now */
@@ -360,7 +360,7 @@ int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk)
         int err;
 
         /* Make sure new filter is there and in the right amounts. */
-        if (fprog->filter == NULL || fprog->len > BPF_MAXINSNS)
+        if (fprog->filter == NULL)
                 return -EINVAL;
 
         fp = sock_kmalloc(sk, fsize+sizeof(*fp), GFP_KERNEL);