Commit 7a5c938b authored by Jason Gunthorpe's avatar Jason Gunthorpe

IB/core: Check for rdma_protocol_ib only after validating port_num

port_num is untrusted data from the user, so it should be checked after
calling fill_sgid_attr, which validates it.

Fixes: 8d9ec9ad ("IB/core: Add a sgid_attr pointer to struct rdma_ah_attr")
Signed-off-by: default avatarJason Gunthorpe <jgg@mellanox.com>
parent 5e62d5ff
......@@ -1580,14 +1580,6 @@ static int _ib_modify_qp(struct ib_qp *qp, struct ib_qp_attr *attr,
const struct ib_gid_attr *old_sgid_attr_alt_av;
int ret;
/*
* Today the core code can only handle alternate paths and APM for IB
* ban them in roce mode.
*/
if (attr_mask & IB_QP_ALT_PATH &&
!rdma_protocol_ib(qp->device, attr->alt_ah_attr.port_num))
return -EINVAL;
if (attr_mask & IB_QP_AV) {
ret = rdma_fill_sgid_attr(qp->device, &attr->ah_attr,
&old_sgid_attr_av);
......@@ -1606,6 +1598,17 @@ static int _ib_modify_qp(struct ib_qp *qp, struct ib_qp_attr *attr,
&old_sgid_attr_alt_av);
if (ret)
goto out_av;
/*
* Today the core code can only handle alternate paths and APM
* for IB. Ban them in roce mode.
*/
if (!(rdma_protocol_ib(qp->device,
attr->alt_ah_attr.port_num) &&
rdma_protocol_ib(qp->device, port))) {
ret = EINVAL;
goto out;
}
}
/*
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment