Re: [PATCH for-rc 1/8] RDMA/bnxt_re: Reject executable mappings of the DBR and toggle pages

[Jason Gunthorpe <jgg@ziepe.ca>]

On Tue, Sep 08, 2026 at 04:45:53PM +0300, Leon Romanovsky wrote:
> On Sun, Sep 06, 2026 at 04:06:53PM -0700, Selvin Xavier wrote:
> > The BNXT_RE_MMAP_DBR_PAGE and BNXT_RE_MMAP_TOGGLE_PAGE cases of
> > bnxt_re_mmap() hand out kernel pages that userspace is only supposed to
> > read. VM_WRITE was already rejected, but VM_EXEC was not, so userspace
> > could map these kernel pages executable. Reject VM_EXEC as well.
> > Also, return EPERM instead of EFAULT.
> > 
> > Fixes: 9b66c9af7172 ("RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap")
> > CC: Yousef Alhouseen <alhouseenyousef@gmail.com>
> > Reviewed-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
> > Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
> > ---
> >  drivers/infiniband/hw/bnxt_re/ib_verbs.c | 8 ++++----
> >  1 file changed, 4 insertions(+), 4 deletions(-)
> > 
> > diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
> > index ccd2702db78b..e39f99434923 100644
> > --- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
> > +++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
> > @@ -5057,11 +5057,11 @@ int bnxt_re_mmap(struct ib_ucontext *ib_uctx, struct vm_area_struct *vma)
> >  		break;
> >  	case BNXT_RE_MMAP_DBR_PAGE:
> >  	case BNXT_RE_MMAP_TOGGLE_PAGE:
> > -		/* Driver doesn't expect write access for user space */
> > -		if (vma->vm_flags & VM_WRITE) {
> > -			ret = -EFAULT;
> > +		/* Driver doesn't expect write and exec access for user space */
> > +		if (vma->vm_flags & (VM_WRITE | VM_EXEC)) {
> > +			ret = -EPERM;
> >  		} else {
> > -			vm_flags_clear(vma, VM_MAYWRITE);
> > +			vm_flags_clear(vma, VM_MAYWRITE | VM_MAYEXEC);
> 
> This is an opposite to 10bf13c33450 ("RDMA/mlx5: Remove MAYEXEC flag")
> commit.

Why did we do that? These MMIO mmap should never be executable

Jason