IB/core: Check for rdma_protocol_ib only after validating port_num
authorJason Gunthorpe <jgg@mellanox.com>
Mon, 25 Jun 2018 22:03:41 +0000 (16:03 -0600)
committerJason Gunthorpe <jgg@mellanox.com>
Wed, 27 Jun 2018 21:05:58 +0000 (15:05 -0600)
port_num is untrusted data from the user, so it should be checked after
calling fill_sgid_attr, which validates it.

Fixes: 8d9ec9addd6c ("IB/core: Add a sgid_attr pointer to struct rdma_ah_attr")
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
drivers/infiniband/core/verbs.c

index 128d949..1bb6b6f 100644 (file)
@@ -1580,14 +1580,6 @@ static int _ib_modify_qp(struct ib_qp *qp, struct ib_qp_attr *attr,
        const struct ib_gid_attr *old_sgid_attr_alt_av;
        int ret;
 
-       /*
-        * Today the core code can only handle alternate paths and APM for IB
-        * ban them in roce mode.
-        */
-       if (attr_mask & IB_QP_ALT_PATH &&
-           !rdma_protocol_ib(qp->device, attr->alt_ah_attr.port_num))
-               return -EINVAL;
-
        if (attr_mask & IB_QP_AV) {
                ret = rdma_fill_sgid_attr(qp->device, &attr->ah_attr,
                                          &old_sgid_attr_av);
@@ -1606,6 +1598,17 @@ static int _ib_modify_qp(struct ib_qp *qp, struct ib_qp_attr *attr,
                                          &old_sgid_attr_alt_av);
                if (ret)
                        goto out_av;
+
+               /*
+                * Today the core code can only handle alternate paths and APM
+                * for IB. Ban them in roce mode.
+                */
+               if (!(rdma_protocol_ib(qp->device,
+                                      attr->alt_ah_attr.port_num) &&
+                     rdma_protocol_ib(qp->device, port))) {
+                       ret = EINVAL;
+                       goto out;
+               }
        }
 
        /*