mirrors/linux
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-12-28 07:54:36 -05:00
Code Issues Packages Projects Releases Wiki Activity

RDMA/nldev: Check CAP_NET_RAW in user namespace for QP modify

Browse Source 
Currently, the capability check is done in the default
init_user_ns user namespace. When a process runs in a
non default user namespace, such check fails. Due to this
when a process is running using Podman, it fails to modify
the QP.

Since the RDMA device is a resource within a network namespace,
use the network namespace associated with the RDMA device to
determine its owning user namespace.

Fixes: 0cadb4db79 ("RDMA/uverbs: Restrict usage of privileged QKEYs")
Signed-off-by: Parav Pandit <parav@nvidia.com>
Link: https://patch.msgid.link/099eb263622ccdd27014db7e02fec824a3307829.1750963874.git.leon@kernel.org
Signed-off-by: Leon Romanovsky <leon@kernel.org>
This commit is contained in:
Parav Pandit
2025-06-26 21:58:11 +03:00
committed by Leon Romanovsky
parent bd82467f17
commit 28ea058a29
2 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/infiniband/core/nldev.c
View File

@@ -255,7 +255,7 @@ EXPORT_SYMBOL(rdma_nl_put_driver_u64_hex);
bool rdma_nl_get_privileged_qkey(void)
{
return privileged_qkey || capable(CAP_NET_RAW);
return privileged_qkey;
}
EXPORT_SYMBOL(rdma_nl_get_privileged_qkey);

3
drivers/infiniband/core/uverbs_cmd.c
View File

@@ -1877,7 +1877,8 @@ static int modify_qp(struct uverbs_attr_bundle *attrs,
attr->path_mig_state = cmd->base.path_mig_state;
if (cmd->base.attr_mask & IB_QP_QKEY) {
if (cmd->base.qkey & IB_QP_SET_QKEY &&
!rdma_nl_get_privileged_qkey()) {
!(rdma_nl_get_privileged_qkey() ||
rdma_uattrs_has_raw_cap(attrs))) {
ret = -EPERM;
goto release_qp;
}