From: Yuntao Wang <ytcoode@gmail.com>
Date: Thu, 24 Mar 2022 16:42:38 +0000 (+0800)
Subject: bpf: Fix maximum permitted number of arguments check
X-Git-Url: http://git.maquefel.me/?a=commitdiff_plain;h=c29a4920dfcaa1433b09e2674f605f72767a385c;p=linux.git

bpf: Fix maximum permitted number of arguments check

Since the m->arg_size array can hold up to MAX_BPF_FUNC_ARGS argument
sizes, it's ok that nargs is equal to MAX_BPF_FUNC_ARGS.

Signed-off-by: Yuntao Wang <ytcoode@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Link: https://lore.kernel.org/bpf/20220324164238.1274915-1-ytcoode@gmail.com
---

diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
index 24788ce564a08..0918a39279f6c 100644
--- a/kernel/bpf/btf.c
+++ b/kernel/bpf/btf.c
@@ -5507,7 +5507,7 @@ int btf_distill_func_proto(struct bpf_verifier_log *log,
 	}
 	args = (const struct btf_param *)(func + 1);
 	nargs = btf_type_vlen(func);
-	if (nargs >= MAX_BPF_FUNC_ARGS) {
+	if (nargs > MAX_BPF_FUNC_ARGS) {
 		bpf_log(log,
 			"The function %s has %d arguments. Too many.\n",
 			tname, nargs);