1 files changed, 19 insertions, 2 deletions

diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index b155cd17c1bd..ebf0a673cb83 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -463,7 +463,7 @@ int map_check_no_btf(const struct bpf_map *map,
         return -ENOTSUPP;
 }
 
-static int map_check_btf(const struct bpf_map *map, const struct btf *btf,
+static int map_check_btf(struct bpf_map *map, const struct btf *btf,
                          u32 btf_key_id, u32 btf_value_id)
 {
         const struct btf_type *key_type, *value_type;
@@ -478,6 +478,21 @@ static int map_check_btf(const struct bpf_map *map, const struct btf *btf,
         if (!value_type || value_size != map->value_size)
                 return -EINVAL;
 
+        map->spin_lock_off = btf_find_spin_lock(btf, value_type);
+
+        if (map_value_has_spin_lock(map)) {
+                if (map->map_type != BPF_MAP_TYPE_HASH &&
+                    map->map_type != BPF_MAP_TYPE_ARRAY)
+                        return -ENOTSUPP;
+                if (map->spin_lock_off + sizeof(struct bpf_spin_lock) >
+                    map->value_size) {
+                        WARN_ONCE(1,
+                                  "verifier bug spin_lock_off %d value_size %d\n",
+                                  map->spin_lock_off, map->value_size);
+                        return -EFAULT;
+                }
+        }
+
         if (map->ops->map_check_btf)
                 ret = map->ops->map_check_btf(map, btf, key_type, value_type);
 
@@ -542,6 +557,8 @@ static int map_create(union bpf_attr *attr)
                 map->btf = btf;
                 map->btf_key_type_id = attr->btf_key_type_id;
                 map->btf_value_type_id = attr->btf_value_type_id;
+        } else {
+                map->spin_lock_off = -EINVAL;
         }
 
         err = security_bpf_map_alloc(map);
@@ -740,7 +757,7 @@ static int map_lookup_elem(union bpf_attr *attr)
                         err = -ENOENT;
                 } else {
                         err = 0;
-                        memcpy(value, ptr, value_size);
+                        copy_map_value(map, value, ptr);
                 }
                 rcu_read_unlock();
         }