[PATCH] RDMA/mlx5: Check the DM type before mapping a MEMIC operation

[Hungyu Lin <dennylin0707@gmail.com>]

MLX5_IB_METHOD_DM_MAP_OP_ADDR accepts a handle to any DM object and
converts it with to_memic() without checking the DM type. The handle can
refer to a SW ICM object, which is a struct mlx5_ib_dm_icm and is
smaller than struct mlx5_ib_dm_memic.

The handler then uses the ops_xa_lock, ops and ref members, which are
all located past the end of the mlx5_ib_dm_icm allocation, so it locks
and modifies memory that belongs to other slab objects.

Return -EOPNOTSUPP for DM objects that are not MEMIC, as
MLX5_IB_METHOD_DM_QUERY already does.

Fixes: cea85fa5dbc2 ("RDMA/mlx5: Add support in MEMIC operations")
Cc: stable@vger.kernel.org
Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>
---
 drivers/infiniband/hw/mlx5/dm.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/infiniband/hw/mlx5/dm.c b/drivers/infiniband/hw/mlx5/dm.c
index 7a6fe4fea3e2..16e42fd6c802 100644
--- a/drivers/infiniband/hw/mlx5/dm.c
+++ b/drivers/infiniband/hw/mlx5/dm.c
@@ -213,6 +213,9 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DM_MAP_OP_ADDR)(
 	int err;
 	u8 op;
 
+	if (dm->base.type != MLX5_IB_UAPI_DM_TYPE_MEMIC)
+		return -EOPNOTSUPP;
+
 	err = uverbs_copy_from(&op, attrs, MLX5_IB_ATTR_DM_MAP_OP_ADDR_REQ_OP);
 	if (err)
 		return err;
-- 
2.43.0