[PATCH] IB/rdmavt: Call check_modify_qp after validating QP attributes

[PATCH] IB/rdmavt: Call check_modify_qp after validating QP attributes

[Serhat Kumral]

rvt_modify_qp() calls the driver's check_modify_qp() hook before it
validates the address handle attributes with rvt_check_ah().

hfi1_check_modify_qp() uses the user-supplied SL in ah_to_sc() to index
ibp->sl_to_sc[32]. The SL is a u8 that is bounds-checked only in
hfi1_check_ah(), which runs later so an SL >= 32 causes an possible
out-of-bounds read.

Move the check_modify_qp() call after all generic attribute checks.

Fixes: e85ec33d820e ("IB/rdmavt: add modify queue pair driver helpers")
Signed-off-by: Serhat Kumral <serhatkumral1@gmail.com>
---
found by smatch:
- drivers/infiniband/hw/hfi1/verbs.c:1474 ah_to_sc() error: buffer overflow 'ibp->sl_to_sc' 32 <= 255 user_rl='0-255'
--This fix relies on the SL bounds check added by commit 0dbfaa9f2813

 drivers/infiniband/sw/rdmavt/qp.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/infiniband/sw/rdmavt/qp.c b/drivers/infiniband/sw/rdmavt/qp.c
index 3602b9ff2196..abd33f42c888 100644
--- a/drivers/infiniband/sw/rdmavt/qp.c
+++ b/drivers/infiniband/sw/rdmavt/qp.c
@@ -1422,10 +1422,6 @@ int rvt_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
 				attr_mask))
 		goto inval;
 
-	if (rdi->driver_f.check_modify_qp &&
-	    rdi->driver_f.check_modify_qp(qp, attr, attr_mask, udata))
-		goto inval;
-
 	if (attr_mask & IB_QP_AV) {
 		if (opa_ah) {
 			if (rdma_ah_get_dlid(&attr->ah_attr) >=
@@ -1521,6 +1517,10 @@ int rvt_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
 		if (attr->max_dest_rd_atomic > rdi->dparms.max_rdma_atomic)
 			goto inval;
 
+	if (rdi->driver_f.check_modify_qp &&
+	    rdi->driver_f.check_modify_qp(qp, attr, attr_mask, udata))
+		goto inval;
+
 	switch (new_state) {
 	case IB_QPS_RESET:
 		if (qp->state != IB_QPS_RESET)
-- 
2.53.0