6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Parav Pandit parav@nvidia.com
[ Upstream commit 0498c2d9984ed2ad75b1cd5ba6abfa1226742df5 ]
Currently, the capability check is done in the default init_user_ns user namespace. When a process runs in a non default user namespace, such check fails. Due to this when a process is running using Podman, it fails to create the QP.
Since the RDMA device is a resource within a network namespace, use the network namespace associated with the RDMA device to determine its owning user namespace.
Fixes: 2dee0e545894 ("IB/uverbs: Enable QP creation with a given source QP number") Signed-off-by: Parav Pandit parav@nvidia.com Link: https://patch.msgid.link/0e5920d1dfe836817bb07576b192da41b637130b.1750963874... Signed-off-by: Leon Romanovsky leon@kernel.org Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/infiniband/core/uverbs_cmd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c index 6700c2c66167..4d96e4a678f3 100644 --- a/drivers/infiniband/core/uverbs_cmd.c +++ b/drivers/infiniband/core/uverbs_cmd.c @@ -1451,7 +1451,7 @@ static int create_qp(struct uverbs_attr_bundle *attrs, }
if (attr.create_flags & IB_QP_CREATE_SOURCE_QPN) { - if (!capable(CAP_NET_RAW)) { + if (!rdma_uattrs_has_raw_cap(attrs)) { ret = -EPERM; goto err_put; }