Re: [PATCH for-rc v2 1/8] RDMA/bnxt_re: Reject executable mappings of the DBR and toggle pages

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] The patch rejects VM_EXEC to prevent executable mappings of the DBR and toggle pages, but fails to clear VM_MAYEXEC. This allows userspace to bypass the restriction via mprotect().
--

commit b5ba6f660e81b67fecc55a7c6ceae5f0724ddc0a
Author: Selvin Xavier <selvin.xavier@broadcom.com>

RDMA/bnxt_re: Reject executable mappings of the DBR and toggle pages

This commit updates bnxt_re_mmap() to reject VM_EXEC mappings for DBR and
toggle pages, returning -EPERM instead of -EFAULT. It is intended to prevent
userspace from mapping these pages as executable.

> diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
> index ccd2702db78b5..d80a22e4ac70d 100644
> --- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
> +++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
> @@ -5057,9 +5057,9 @@ int bnxt_re_mmap(struct ib_ucontext *ib_uctx, struct vm_area_struct *vma)
>  		break;
>  	case BNXT_RE_MMAP_DBR_PAGE:
>  	case BNXT_RE_MMAP_TOGGLE_PAGE:
> -		/* Driver doesn't expect write access for user space */
> -		if (vma->vm_flags & VM_WRITE) {
> -			ret = -EFAULT;
> +		/* Driver doesn't expect write and exec access for user space */
> +		if (vma->vm_flags & (VM_WRITE | VM_EXEC)) {
> +			ret = -EPERM;
>  		} else {
>  			vm_flags_clear(vma, VM_MAYWRITE);

[Severity: Medium]
Does this code also need to clear VM_MAYEXEC? While the patch correctly
rejects an initial mapping with PROT_EXEC, failing to clear VM_MAYEXEC allows
userspace to bypass the restriction by calling mprotect() with PROT_EXEC
after the mmap() succeeds.

>  			ret = vm_insert_page(vma, vma->vm_start,

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260909135244.122747-1-selvin.xavier@broadcom.com?part=1