IB/mlx5: Fix possible array overflow

The check to verify that userspace does not provide an invalid index to the
micro UAR was placed too late. Fix this by moving the check before using the
index.

Reported by: Shachar Raindel <[email protected]>
Signed-off-by: Eli Cohen <[email protected]>
Signed-off-by: Roland Dreier <[email protected]>

diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index ecd3aebc46fe29692053c1afeb6e4f3f8cc982d0..a24431746377092528eee81d84ad9b660b585bb1 100644 (file)
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -650,13 +650,13 @@ static int mlx5_ib_mmap(struct ib_ucontext *ibcontext, struct vm_area_struct *vm
                        return -EINVAL;
 
                idx = get_index(vma->vm_pgoff);
+               if (idx >= uuari->num_uars)
+                       return -EINVAL;
+
                pfn = uar_index2pfn(dev, uuari->uars[idx].index);
                mlx5_ib_dbg(dev, "uar idx 0x%lx, pfn 0x%llx\n", idx,
                            (unsigned long long)pfn);
 
-               if (idx >= uuari->num_uars)
-                       return -EINVAL;
-
                vma->vm_page_prot = pgprot_writecombine(vma->vm_page_prot);
                if (io_remap_pfn_range(vma, vma->vm_start, pfn,
                                       PAGE_SIZE, vma->vm_page_prot))