net: filter: fix upper BPF instruction limit
net: filter: fix upper BPF instruction limit

The original checks (via sk_chk_filter) for instruction count uses ">",
not ">=", so changing this in sk_convert_filter has the potential to break
existing seccomp filters that used exactly BPF_MAXINSNS many instructions.

Fixes: bd4cf0ed331a ("net: filter: rework/optimize internal BPF interpreter's instruction set")
Signed-off-by: Kees Cook <50cb10d2be062154b17ab4d66a4eab34f1cf1c84@chromium.org>
Cc: 4fbacc2fa0ffdbb11bf1ad6925b886ebd08dd15f@vger.kernel.org # v3.15+
Acked-by: Daniel Borkmann <9ff04a02a69f376b2b9aeec27187017cbf3cf5f9@redhat.com>
Acked-by: Alexei Starovoitov <c24c0248770ae98831f8a654310d4c2e07514c61@plumgrid.com>
Signed-off-by: David S. Miller <fe08d3c717adf2ae63592e4c9aec6e3e404d8e3e@davemloft.net>

KristFoundation/Programs,KristFoundation/Programs,KristFoundation/Programs,KristFoundation/Programs,KristFoundation/Programs,KristFoundation/Programs