[PATCH] RDMA/iwcm: restrict MAPINFO to administrators

[PATCH] RDMA/iwcm: restrict MAPINFO to administrators

[Sung Byeongchan]

RDMA_NL_IWPM_MAPINFO announces the userspace iWARP port mapper and asks
the kernel to send its live mapping table. Its callback registration does
not request an administrative permission check, so an ordinary local
NETLINK_RDMA sender can use the public mapper name and ABI version to
replace the global daemon portid.

With a production SIW mapping present, an unprivileged claimant received
the complete local and mapped sockaddr records in three of three fresh
KASAN boots. A second independent unprivileged socket could repeat the
claim. Wrong-name and old-version controls were rejected.

Set RDMA_NL_ADMIN_PERM on only the MAPINFO callback. The common RDMA
netlink receiver then requires CAP_NET_ADMIN before the callback changes
the daemon identity or serializes the mapping table.

The fixed kernel rejected the valid unprivileged request with -EPERM and
zero records in three of three matched boots. Legitimate root mapper
registration, live SIW mapping, daemon recovery, mapping removal and
post-remove cleanup all passed their baseline and fixed controls.

The demonstrated impact is disclosure of local iWARP endpoint metadata
and displacement of the trusted mapper identity. Uninitialized memory,
controlled read or write, RCE and LPE were not demonstrated.

Fixes: b493d91d333e ("iwcm: common code for port mapper")
Assisted-by: OpenAI Codex

Signed-off-by: Sung Byeongchan <tjdqudcks0424@naver.com>
---
 drivers/infiniband/core/iwcm.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/infiniband/core/iwcm.c b/drivers/infiniband/core/iwcm.c
index 4b05867dad895..8a3b5aa2dc5f7 100644
--- a/drivers/infiniband/core/iwcm.c
+++ b/drivers/infiniband/core/iwcm.c
@@ -86,7 +86,10 @@ static struct rdma_nl_cbs iwcm_nl_cb_table[RDMA_NL_IWPM_NUM_OPS] = {
 	[RDMA_NL_IWPM_QUERY_MAPPING] = {.dump = iwpm_add_and_query_mapping_cb},
 	[RDMA_NL_IWPM_REMOTE_INFO] = {.dump = iwpm_remote_info_cb},
 	[RDMA_NL_IWPM_HANDLE_ERR] = {.dump = iwpm_mapping_error_cb},
-	[RDMA_NL_IWPM_MAPINFO] = {.dump = iwpm_mapping_info_cb},
+	[RDMA_NL_IWPM_MAPINFO] = {
+		.dump = iwpm_mapping_info_cb,
+		.flags = RDMA_NL_ADMIN_PERM,
+	},
 	[RDMA_NL_IWPM_MAPINFO_NUM] = {.dump = iwpm_ack_mapping_info_cb},
 	[RDMA_NL_IWPM_HELLO] = {.dump = iwpm_hello_cb}
 };

base-commit: d48723711bae9b8cdc56719c448ba42fef28cbee
-- 
2.43.0

Re: [PATCH] RDMA/iwcm: restrict MAPINFO to administrators

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [High] RDMA/iwcm: missing RDMA_NL_ADMIN_PERM on remaining
  iwcm_nl_cb_table ops
--

commit 0d21801da4ca7ad844070c844f5a41cee7373664f5
Author: Sung Byeongchan <tjdqudcks0424@naver.com>

RDMA/iwcm: restrict MAPINFO to administrators

This commit sets RDMA_NL_ADMIN_PERM on the RDMA_NL_IWPM_MAPINFO callback
in iwcm_nl_cb_table so that CAP_NET_ADMIN is required before handling port
mapper MAPINFO requests.

> diff --git a/drivers/infiniband/core/iwcm.c b/drivers/infiniband/core/iwcm.c
> index 4b05867dad895..8a3b5aa2dc5f7 100644
> --- a/drivers/infiniband/core/iwcm.c
> +++ b/drivers/infiniband/core/iwcm.c
> @@ -86,7 +86,10 @@ static struct rdma_nl_cbs iwcm_nl_cb_table[RDMA_NL_IWPM_NUM_OPS] = {
>  	[RDMA_NL_IWPM_QUERY_MAPPING] = {.dump = iwpm_add_and_query_mapping_cb},
>  	[RDMA_NL_IWPM_REMOTE_INFO] = {.dump = iwpm_remote_info_cb},
>  	[RDMA_NL_IWPM_HANDLE_ERR] = {.dump = iwpm_mapping_error_cb},
> -	[RDMA_NL_IWPM_MAPINFO] = {.dump = iwpm_mapping_info_cb},
> +	[RDMA_NL_IWPM_MAPINFO] = {
> +		.dump = iwpm_mapping_info_cb,
> +		.flags = RDMA_NL_ADMIN_PERM,
> +	},
>  	[RDMA_NL_IWPM_MAPINFO_NUM] = {.dump = iwpm_ack_mapping_info_cb},
>  	[RDMA_NL_IWPM_HELLO] = {.dump = iwpm_hello_cb}
>  };

[Severity: High]
Should the remaining callbacks in iwcm_nl_cb_table also set
RDMA_NL_ADMIN_PERM?

Leaving RDMA_NL_IWPM_HELLO without RDMA_NL_ADMIN_PERM still lets an
unprivileged NETLINK_RDMA sender invoke iwpm_hello_cb() to overwrite
iwpm_user_pid, reset client registration to IWPM_REG_INCOMPL, and
downgrade iwpm_ulib_version:

drivers/infiniband/core/iwpm_msg.c:iwpm_hello_cb() {
	...
	iwpm_set_registration(nl_client, IWPM_REG_INCOMPL);
	atomic_set(&echo_nlmsg_seq, cb->nlh->nlmsg_seq);
	iwpm_ulib_version = min_t(u16, IWPM_UABI_VERSION, abi_version);
	pr_debug("Using ABI version %u\n", iwpm_ulib_version);
	iwpm_user_pid = cb->nlh->nlmsg_pid;
	ret = iwpm_send_hello(nl_client, iwpm_user_pid, iwpm_ulib_version);
	...
}

Because rdma_nl_net_init() creates the netlink socket with
NL_CFG_F_NONROOT_RECV, an unprivileged process can also subscribe to
RDMA_NL_GROUP_IWPM and answer the kernel's RDMA_NL_IWPM_REG_PID multicast
query via iwpm_register_pid_cb() to claim iwpm_user_pid and set
IWPM_REG_VALID, redirecting subsequent mapping unicasts to itself.
In addition, iwpm_remote_info_cb() accepts unauthenticated
RDMA_NL_IWPM_REMOTE_INFO messages and inserts GFP_ATOMIC iwpm_remote_info
records into iwpm_reminfo_bucket, and the remaining callbacks in
iwcm_nl_cb_table are likewise privileged iwpmd daemon operations.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261107093338.618394-1-tjdqudcks0424@naver.com?part=1

Re: [PATCH] RDMA/iwcm: restrict MAPINFO to administrators

[Leon Romanovsky]

On Sat, Nov 07, 2026 at 06:33:38PM +0900, Sung Byeongchan wrote:
> 
> RDMA_NL_IWPM_MAPINFO announces the userspace iWARP port mapper and asks
> the kernel to send its live mapping table. Its callback registration does
> not request an administrative permission check, so an ordinary local
> NETLINK_RDMA sender can use the public mapper name and ABI version to
> replace the global daemon portid.
> 
> With a production SIW mapping present, an unprivileged claimant received
> the complete local and mapped sockaddr records in three of three fresh
> KASAN boots. A second independent unprivileged socket could repeat the
> claim. Wrong-name and old-version controls were rejected.
> 
> Set RDMA_NL_ADMIN_PERM on only the MAPINFO callback. The common RDMA
> netlink receiver then requires CAP_NET_ADMIN before the callback changes
> the daemon identity or serializes the mapping table.
> 
> The fixed kernel rejected the valid unprivileged request with -EPERM and
> zero records in three of three matched boots. Legitimate root mapper
> registration, live SIW mapping, daemon recovery, mapping removal and
> post-remove cleanup all passed their baseline and fixed controls.
> 
> The demonstrated impact is disclosure of local iWARP endpoint metadata
> and displacement of the trusted mapper identity. Uninitialized memory,
> controlled read or write, RCE and LPE were not demonstrated.

1. People still read commit messages, so please read yours before submitting.
2. Write a proper commit message; don't submit AI-generated slop.
3. Include the full kernel stack trace from dmesg in the commit message.
4. Add RDMA_NL_ADMIN_PERM to all IWPM commands.

Thanks

> 
> Fixes: b493d91d333e ("iwcm: common code for port mapper")
> Assisted-by: OpenAI Codex
> 
> Signed-off-by: Sung Byeongchan <tjdqudcks0424@naver.com>
> ---
>  drivers/infiniband/core/iwcm.c |    5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> diff --git a/drivers/infiniband/core/iwcm.c b/drivers/infiniband/core/iwcm.c
> index 4b05867dad895..8a3b5aa2dc5f7 100644
> --- a/drivers/infiniband/core/iwcm.c
> +++ b/drivers/infiniband/core/iwcm.c
> @@ -86,7 +86,10 @@ static struct rdma_nl_cbs iwcm_nl_cb_table[RDMA_NL_IWPM_NUM_OPS] = {
>  	[RDMA_NL_IWPM_QUERY_MAPPING] = {.dump = iwpm_add_and_query_mapping_cb},
>  	[RDMA_NL_IWPM_REMOTE_INFO] = {.dump = iwpm_remote_info_cb},
>  	[RDMA_NL_IWPM_HANDLE_ERR] = {.dump = iwpm_mapping_error_cb},
> -	[RDMA_NL_IWPM_MAPINFO] = {.dump = iwpm_mapping_info_cb},
> +	[RDMA_NL_IWPM_MAPINFO] = {
> +		.dump = iwpm_mapping_info_cb,
> +		.flags = RDMA_NL_ADMIN_PERM,
> +	},
>  	[RDMA_NL_IWPM_MAPINFO_NUM] = {.dump = iwpm_ack_mapping_info_cb},
>  	[RDMA_NL_IWPM_HELLO] = {.dump = iwpm_hello_cb}
>  };
> 
> base-commit: d48723711bae9b8cdc56719c448ba42fef28cbee
> -- 
> 2.43.0