1 files changed, 42 insertions, 3 deletions

diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 84470d1480aa..797a99c7493e 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -463,7 +463,7 @@ int map_check_no_btf(const struct bpf_map *map,
         return -ENOTSUPP;
 }
 
-static int map_check_btf(const struct bpf_map *map, const struct btf *btf,
+static int map_check_btf(struct bpf_map *map, const struct btf *btf,
                          u32 btf_key_id, u32 btf_value_id)
 {
         const struct btf_type *key_type, *value_type;
@@ -478,6 +478,22 @@ static int map_check_btf(const struct bpf_map *map, const struct btf *btf,
         if (!value_type || value_size != map->value_size)
                 return -EINVAL;
 
+        map->spin_lock_off = btf_find_spin_lock(btf, value_type);
+
+        if (map_value_has_spin_lock(map)) {
+                if (map->map_type != BPF_MAP_TYPE_HASH &&
+                    map->map_type != BPF_MAP_TYPE_ARRAY &&
+                    map->map_type != BPF_MAP_TYPE_CGROUP_STORAGE)
+                        return -ENOTSUPP;
+                if (map->spin_lock_off + sizeof(struct bpf_spin_lock) >
+                    map->value_size) {
+                        WARN_ONCE(1,
+                                  "verifier bug spin_lock_off %d value_size %d\n",
+                                  map->spin_lock_off, map->value_size);
+                        return -EFAULT;
+                }
+        }
+
         if (map->ops->map_check_btf)
                 ret = map->ops->map_check_btf(map, btf, key_type, value_type);
 
@@ -542,6 +558,8 @@ static int map_create(union bpf_attr *attr)
                 map->btf = btf;
                 map->btf_key_type_id = attr->btf_key_type_id;
                 map->btf_value_type_id = attr->btf_value_type_id;
+        } else {
+                map->spin_lock_off = -EINVAL;
         }
 
         err = security_bpf_map_alloc(map);
@@ -664,7 +682,7 @@ static void *__bpf_copy_key(void __user *ukey, u64 key_size)
 }
 
 /* last field in 'union bpf_attr' used by this command */
-#define BPF_MAP_LOOKUP_ELEM_LAST_FIELD value
+#define BPF_MAP_LOOKUP_ELEM_LAST_FIELD flags
 
 static int map_lookup_elem(union bpf_attr *attr)
 {
@@ -680,6 +698,9 @@ static int map_lookup_elem(union bpf_attr *attr)
         if (CHECK_ATTR(BPF_MAP_LOOKUP_ELEM))
                 return -EINVAL;
 
+        if (attr->flags & ~BPF_F_LOCK)
+                return -EINVAL;
+
         f = fdget(ufd);
         map = __bpf_map_get(f);
         if (IS_ERR(map))
@@ -690,6 +711,12 @@ static int map_lookup_elem(union bpf_attr *attr)
                 goto err_put;
         }
 
+        if ((attr->flags & BPF_F_LOCK) &&
+            !map_value_has_spin_lock(map)) {
+                err = -EINVAL;
+                goto err_put;
+        }
+
         key = __bpf_copy_key(ukey, map->key_size);
         if (IS_ERR(key)) {
                 err = PTR_ERR(key);
@@ -745,7 +772,13 @@ static int map_lookup_elem(union bpf_attr *attr)
                         err = -ENOENT;
                 } else {
                         err = 0;
-                        memcpy(value, ptr, value_size);
+                        if (attr->flags & BPF_F_LOCK)
+                                /* lock 'ptr' and copy everything but lock */
+                                copy_map_value_locked(map, value, ptr, true);
+                        else
+                                copy_map_value(map, value, ptr);
+                        /* mask lock, since value wasn't zero inited */
+                        check_and_init_map_lock(map, value);
                 }
                 rcu_read_unlock();
         }
@@ -808,6 +841,12 @@ static int map_update_elem(union bpf_attr *attr)
                 goto err_put;
         }
 
+        if ((attr->flags & BPF_F_LOCK) &&
+            !map_value_has_spin_lock(map)) {
+                err = -EINVAL;
+                goto err_put;
+        }
+
         key = __bpf_copy_key(ukey, map->key_size);
         if (IS_ERR(key)) {
                 err = PTR_ERR(key);