Re: [PATCH for-rc 1/8] RDMA/bnxt_re: Reject executable mappings of the DBR and toggle pages

[Leon Romanovsky <leon@kernel.org>]

On Sun, Sep 06, 2026 at 04:06:53PM -0700, Selvin Xavier wrote:
> The BNXT_RE_MMAP_DBR_PAGE and BNXT_RE_MMAP_TOGGLE_PAGE cases of
> bnxt_re_mmap() hand out kernel pages that userspace is only supposed to
> read. VM_WRITE was already rejected, but VM_EXEC was not, so userspace
> could map these kernel pages executable. Reject VM_EXEC as well.
> Also, return EPERM instead of EFAULT.
> 
> Fixes: 9b66c9af7172 ("RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap")
> CC: Yousef Alhouseen <alhouseenyousef@gmail.com>
> Reviewed-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
> Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
> ---
>  drivers/infiniband/hw/bnxt_re/ib_verbs.c | 8 ++++----
>  1 file changed, 4 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
> index ccd2702db78b..e39f99434923 100644
> --- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
> +++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
> @@ -5057,11 +5057,11 @@ int bnxt_re_mmap(struct ib_ucontext *ib_uctx, struct vm_area_struct *vma)
>  		break;
>  	case BNXT_RE_MMAP_DBR_PAGE:
>  	case BNXT_RE_MMAP_TOGGLE_PAGE:
> -		/* Driver doesn't expect write access for user space */
> -		if (vma->vm_flags & VM_WRITE) {
> -			ret = -EFAULT;
> +		/* Driver doesn't expect write and exec access for user space */
> +		if (vma->vm_flags & (VM_WRITE | VM_EXEC)) {
> +			ret = -EPERM;
>  		} else {
> -			vm_flags_clear(vma, VM_MAYWRITE);
> +			vm_flags_clear(vma, VM_MAYWRITE | VM_MAYEXEC);

This is an opposite to 10bf13c33450 ("RDMA/mlx5: Remove MAYEXEC flag")
commit.

Thanks

>  			ret = vm_insert_page(vma, vma->vm_start,
>  					     virt_to_page((void *)bnxt_entry->mem_offset));
>  		}
> -- 
> 2.39.3
>