Re: [PATCH] RDMA/iwcm: restrict MAPINFO to administrators

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [High] RDMA/iwcm: missing RDMA_NL_ADMIN_PERM on remaining
  iwcm_nl_cb_table ops
--

commit 0d21801da4ca7ad844070c844f5a41cee7373664f5
Author: Sung Byeongchan <tjdqudcks0424@naver.com>

RDMA/iwcm: restrict MAPINFO to administrators

This commit sets RDMA_NL_ADMIN_PERM on the RDMA_NL_IWPM_MAPINFO callback
in iwcm_nl_cb_table so that CAP_NET_ADMIN is required before handling port
mapper MAPINFO requests.

> diff --git a/drivers/infiniband/core/iwcm.c b/drivers/infiniband/core/iwcm.c
> index 4b05867dad895..8a3b5aa2dc5f7 100644
> --- a/drivers/infiniband/core/iwcm.c
> +++ b/drivers/infiniband/core/iwcm.c
> @@ -86,7 +86,10 @@ static struct rdma_nl_cbs iwcm_nl_cb_table[RDMA_NL_IWPM_NUM_OPS] = {
>  	[RDMA_NL_IWPM_QUERY_MAPPING] = {.dump = iwpm_add_and_query_mapping_cb},
>  	[RDMA_NL_IWPM_REMOTE_INFO] = {.dump = iwpm_remote_info_cb},
>  	[RDMA_NL_IWPM_HANDLE_ERR] = {.dump = iwpm_mapping_error_cb},
> -	[RDMA_NL_IWPM_MAPINFO] = {.dump = iwpm_mapping_info_cb},
> +	[RDMA_NL_IWPM_MAPINFO] = {
> +		.dump = iwpm_mapping_info_cb,
> +		.flags = RDMA_NL_ADMIN_PERM,
> +	},
>  	[RDMA_NL_IWPM_MAPINFO_NUM] = {.dump = iwpm_ack_mapping_info_cb},
>  	[RDMA_NL_IWPM_HELLO] = {.dump = iwpm_hello_cb}
>  };

[Severity: High]
Should the remaining callbacks in iwcm_nl_cb_table also set
RDMA_NL_ADMIN_PERM?

Leaving RDMA_NL_IWPM_HELLO without RDMA_NL_ADMIN_PERM still lets an
unprivileged NETLINK_RDMA sender invoke iwpm_hello_cb() to overwrite
iwpm_user_pid, reset client registration to IWPM_REG_INCOMPL, and
downgrade iwpm_ulib_version:

drivers/infiniband/core/iwpm_msg.c:iwpm_hello_cb() {
	...
	iwpm_set_registration(nl_client, IWPM_REG_INCOMPL);
	atomic_set(&echo_nlmsg_seq, cb->nlh->nlmsg_seq);
	iwpm_ulib_version = min_t(u16, IWPM_UABI_VERSION, abi_version);
	pr_debug("Using ABI version %u\n", iwpm_ulib_version);
	iwpm_user_pid = cb->nlh->nlmsg_pid;
	ret = iwpm_send_hello(nl_client, iwpm_user_pid, iwpm_ulib_version);
	...
}

Because rdma_nl_net_init() creates the netlink socket with
NL_CFG_F_NONROOT_RECV, an unprivileged process can also subscribe to
RDMA_NL_GROUP_IWPM and answer the kernel's RDMA_NL_IWPM_REG_PID multicast
query via iwpm_register_pid_cb() to claim iwpm_user_pid and set
IWPM_REG_VALID, redirecting subsequent mapping unicasts to itself.
In addition, iwpm_remote_info_cb() accepts unauthenticated
RDMA_NL_IWPM_REMOTE_INFO messages and inserts GFP_ATOMIC iwpm_remote_info
records into iwpm_reminfo_bucket, and the remaining callbacks in
iwcm_nl_cb_table are likewise privileged iwpmd daemon operations.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261107093338.618394-1-tjdqudcks0424@naver.com?part=1