Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7a5c938b authored by Jason Gunthorpe's avatar Jason Gunthorpe
Browse files

IB/core: Check for rdma_protocol_ib only after validating port_num 



port_num is untrusted data from the user, so it should be checked after
calling fill_sgid_attr, which validates it.

Fixes: 8d9ec9ad ("IB/core: Add a sgid_attr pointer to struct rdma_ah_attr")
Signed-off-by: default avatarJason Gunthorpe <jgg@mellanox.com>
parent 5e62d5ff

drivers/infiniband/core/verbs.c

+11 −8
Original line number Diff line number Diff line
@@ -1580,14 +1580,6 @@ static int _ib_modify_qp(struct ib_qp *qp, struct ib_qp_attr *attr, 
	const struct ib_gid_attr *old_sgid_attr_alt_av;

	int ret;



	/*

	 * Today the core code can only handle alternate paths and APM for IB

	 * ban them in roce mode.

	 */

	if (attr_mask & IB_QP_ALT_PATH &&

	    !rdma_protocol_ib(qp->device, attr->alt_ah_attr.port_num))

		return -EINVAL;



	if (attr_mask & IB_QP_AV) {

		ret = rdma_fill_sgid_attr(qp->device, &attr->ah_attr,

					  &old_sgid_attr_av);
@@ -1606,6 +1598,17 @@ static int _ib_modify_qp(struct ib_qp *qp, struct ib_qp_attr *attr, 
					  &old_sgid_attr_alt_av);

		if (ret)

			goto out_av;



		/*

		 * Today the core code can only handle alternate paths and APM

		 * for IB. Ban them in roce mode.

		 */

		if (!(rdma_protocol_ib(qp->device,

				       attr->alt_ah_attr.port_num) &&

		      rdma_protocol_ib(qp->device, port))) {

			ret = EINVAL;

			goto out;

		}

	}



	/*