Re: [PATCH for-rc 1/8] RDMA/bnxt_re: Reject executable mappings of the DBR and toggle pages

[Leon Romanovsky <leon@kernel.org>]

On Wed, Sep 09, 2026 at 10:29:48AM -0300, Jason Gunthorpe wrote:
> On Tue, Sep 08, 2026 at 04:45:53PM +0300, Leon Romanovsky wrote:
> > On Sun, Sep 06, 2026 at 04:06:53PM -0700, Selvin Xavier wrote:
> > > The BNXT_RE_MMAP_DBR_PAGE and BNXT_RE_MMAP_TOGGLE_PAGE cases of
> > > bnxt_re_mmap() hand out kernel pages that userspace is only supposed to
> > > read. VM_WRITE was already rejected, but VM_EXEC was not, so userspace
> > > could map these kernel pages executable. Reject VM_EXEC as well.
> > > Also, return EPERM instead of EFAULT.
> > > 
> > > Fixes: 9b66c9af7172 ("RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap")
> > > CC: Yousef Alhouseen <alhouseenyousef@gmail.com>
> > > Reviewed-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
> > > Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
> > > ---
> > >  drivers/infiniband/hw/bnxt_re/ib_verbs.c | 8 ++++----
> > >  1 file changed, 4 insertions(+), 4 deletions(-)
> > > 
> > > diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
> > > index ccd2702db78b..e39f99434923 100644
> > > --- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
> > > +++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
> > > @@ -5057,11 +5057,11 @@ int bnxt_re_mmap(struct ib_ucontext *ib_uctx, struct vm_area_struct *vma)
> > >  		break;
> > >  	case BNXT_RE_MMAP_DBR_PAGE:
> > >  	case BNXT_RE_MMAP_TOGGLE_PAGE:
> > > -		/* Driver doesn't expect write access for user space */
> > > -		if (vma->vm_flags & VM_WRITE) {
> > > -			ret = -EFAULT;
> > > +		/* Driver doesn't expect write and exec access for user space */
> > > +		if (vma->vm_flags & (VM_WRITE | VM_EXEC)) {
> > > +			ret = -EPERM;
> > >  		} else {
> > > -			vm_flags_clear(vma, VM_MAYWRITE);
> > > +			vm_flags_clear(vma, VM_MAYWRITE | VM_MAYEXEC);
> > 
> > This is an opposite to 10bf13c33450 ("RDMA/mlx5: Remove MAYEXEC flag")
> > commit.
> 
> Why did we do that? These MMIO mmap should never be executable

I don't remember the rationale, but if I understood my findings correctly,
clearing VM_MAYEXEC broke memcopy.

Thanks