diff options
| author |   Jason Gunthorpe <jgg@mellanox.com> | 2018-06-25 16:03:41 -0600 |
|---|---|---|
| committer | Jason Gunthorpe <jgg@mellanox.com> | 2018-06-27 15:05:58 -0600 |
| commit | 7a5c938b9ed0985ea09b821b4b7f12b5e3d88d5d (patch) | |
| tree | 7ad6c0170c1d414a8ad219465502afdbae08018d /drivers | |
| parent | IB/mlx4: Create slave AH's directly (diff) | |
| download | linux-dev-7a5c938b9ed0985ea09b821b4b7f12b5e3d88d5d.tar.xz linux-dev-7a5c938b9ed0985ea09b821b4b7f12b5e3d88d5d.zip | |
IB/core: Check for rdma_protocol_ib only after validating port_num
port_num is untrusted data from the user, so it should be checked after
calling fill_sgid_attr, which validates it.
Fixes: 8d9ec9addd6c ("IB/core: Add a sgid_attr pointer to struct rdma_ah_attr")
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/infiniband/core/verbs.c | 19 |
1 files changed, 11 insertions, 8 deletions
diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c index 128d94988dd8..1bb6b6ff3341 100644 --- a/drivers/infiniband/core/verbs.c +++ b/drivers/infiniband/core/verbs.c @@ -1580,14 +1580,6 @@ static int _ib_modify_qp(struct ib_qp *qp, struct ib_qp_attr *attr, const struct ib_gid_attr *old_sgid_attr_alt_av; int ret; - /* - * Today the core code can only handle alternate paths and APM for IB - * ban them in roce mode. - */ - if (attr_mask & IB_QP_ALT_PATH && - !rdma_protocol_ib(qp->device, attr->alt_ah_attr.port_num)) - return -EINVAL; - if (attr_mask & IB_QP_AV) { ret = rdma_fill_sgid_attr(qp->device, &attr->ah_attr, &old_sgid_attr_av); @@ -1606,6 +1598,17 @@ static int _ib_modify_qp(struct ib_qp *qp, struct ib_qp_attr *attr, &old_sgid_attr_alt_av); if (ret) goto out_av; + + /* + * Today the core code can only handle alternate paths and APM + * for IB. Ban them in roce mode. + */ + if (!(rdma_protocol_ib(qp->device, + attr->alt_ah_attr.port_num) && + rdma_protocol_ib(qp->device, port))) { + ret = EINVAL; + goto out; + } } /* |