Re: [PATCH] RDMA/iwcm: restrict MAPINFO to administrators

[Leon Romanovsky <leon@kernel.org>]

On Sat, Nov 07, 2026 at 06:33:38PM +0900, Sung Byeongchan wrote:
> 
> RDMA_NL_IWPM_MAPINFO announces the userspace iWARP port mapper and asks
> the kernel to send its live mapping table. Its callback registration does
> not request an administrative permission check, so an ordinary local
> NETLINK_RDMA sender can use the public mapper name and ABI version to
> replace the global daemon portid.
> 
> With a production SIW mapping present, an unprivileged claimant received
> the complete local and mapped sockaddr records in three of three fresh
> KASAN boots. A second independent unprivileged socket could repeat the
> claim. Wrong-name and old-version controls were rejected.
> 
> Set RDMA_NL_ADMIN_PERM on only the MAPINFO callback. The common RDMA
> netlink receiver then requires CAP_NET_ADMIN before the callback changes
> the daemon identity or serializes the mapping table.
> 
> The fixed kernel rejected the valid unprivileged request with -EPERM and
> zero records in three of three matched boots. Legitimate root mapper
> registration, live SIW mapping, daemon recovery, mapping removal and
> post-remove cleanup all passed their baseline and fixed controls.
> 
> The demonstrated impact is disclosure of local iWARP endpoint metadata
> and displacement of the trusted mapper identity. Uninitialized memory,
> controlled read or write, RCE and LPE were not demonstrated.

1. People still read commit messages, so please read yours before submitting.
2. Write a proper commit message; don't submit AI-generated slop.
3. Include the full kernel stack trace from dmesg in the commit message.
4. Add RDMA_NL_ADMIN_PERM to all IWPM commands.

Thanks

> 
> Fixes: b493d91d333e ("iwcm: common code for port mapper")
> Assisted-by: OpenAI Codex
> 
> Signed-off-by: Sung Byeongchan <tjdqudcks0424@naver.com>
> ---
>  drivers/infiniband/core/iwcm.c |    5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> diff --git a/drivers/infiniband/core/iwcm.c b/drivers/infiniband/core/iwcm.c
> index 4b05867dad895..8a3b5aa2dc5f7 100644
> --- a/drivers/infiniband/core/iwcm.c
> +++ b/drivers/infiniband/core/iwcm.c
> @@ -86,7 +86,10 @@ static struct rdma_nl_cbs iwcm_nl_cb_table[RDMA_NL_IWPM_NUM_OPS] = {
>  	[RDMA_NL_IWPM_QUERY_MAPPING] = {.dump = iwpm_add_and_query_mapping_cb},
>  	[RDMA_NL_IWPM_REMOTE_INFO] = {.dump = iwpm_remote_info_cb},
>  	[RDMA_NL_IWPM_HANDLE_ERR] = {.dump = iwpm_mapping_error_cb},
> -	[RDMA_NL_IWPM_MAPINFO] = {.dump = iwpm_mapping_info_cb},
> +	[RDMA_NL_IWPM_MAPINFO] = {
> +		.dump = iwpm_mapping_info_cb,
> +		.flags = RDMA_NL_ADMIN_PERM,
> +	},
>  	[RDMA_NL_IWPM_MAPINFO_NUM] = {.dump = iwpm_ack_mapping_info_cb},
>  	[RDMA_NL_IWPM_HELLO] = {.dump = iwpm_hello_cb}
>  };
> 
> base-commit: d48723711bae9b8cdc56719c448ba42fef28cbee
> -- 
> 2.43.0