1 files changed, 14 insertions, 5 deletions

diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index e2aeb5e89f44..bfcde949c7f8 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -28,6 +28,7 @@
 #include <linux/timekeeping.h>
 #include <linux/ctype.h>
 #include <linux/btf.h>
+#include <linux/nospec.h>
 
 #define IS_FD_ARRAY(map) ((map)->map_type == BPF_MAP_TYPE_PROG_ARRAY || \
                            (map)->map_type == BPF_MAP_TYPE_PERF_EVENT_ARRAY || \
@@ -104,12 +105,14 @@ const struct bpf_map_ops bpf_map_offload_ops = {
 static struct bpf_map *find_and_alloc_map(union bpf_attr *attr)
 {
         const struct bpf_map_ops *ops;
+        u32 type = attr->map_type;
         struct bpf_map *map;
         int err;
 
-        if (attr->map_type >= ARRAY_SIZE(bpf_map_types))
+        if (type >= ARRAY_SIZE(bpf_map_types))
                 return ERR_PTR(-EINVAL);
-        ops = bpf_map_types[attr->map_type];
+        type = array_index_nospec(type, ARRAY_SIZE(bpf_map_types));
+        ops = bpf_map_types[type];
         if (!ops)
                 return ERR_PTR(-EINVAL);
 
@@ -124,7 +127,7 @@ static struct bpf_map *find_and_alloc_map(union bpf_attr *attr)
         if (IS_ERR(map))
                 return map;
         map->ops = ops;
-        map->map_type = attr->map_type;
+        map->map_type = type;
         return map;
 }
 
@@ -897,11 +900,17 @@ static const struct bpf_prog_ops * const bpf_prog_types[] = {
 
 static int find_prog_type(enum bpf_prog_type type, struct bpf_prog *prog)
 {
-        if (type >= ARRAY_SIZE(bpf_prog_types) || !bpf_prog_types[type])
+        const struct bpf_prog_ops *ops;
+
+        if (type >= ARRAY_SIZE(bpf_prog_types))
+                return -EINVAL;
+        type = array_index_nospec(type, ARRAY_SIZE(bpf_prog_types));
+        ops = bpf_prog_types[type];
+        if (!ops)
                 return -EINVAL;
 
         if (!bpf_prog_is_dev_bound(prog->aux))
-                prog->aux->ops = bpf_prog_types[type];
+                prog->aux->ops = ops;
         else
                 prog->aux->ops = &bpf_offload_prog_ops;
         prog->type = type;