Re: [PATCH for-rc 1/8] RDMA/bnxt_re: Reject executable mappings of the DBR and toggle pages

[Leon Romanovsky <leon@kernel.org>]

On Tue, Sep 15, 2026 at 02:04:20PM +0530, Selvin Xavier wrote:
> On Tue, Sep 15, 2026 at 2:01 PM Selvin Xavier
> <selvin.xavier@broadcom.com> wrote:
> >
> > On Thu, Sep 10, 2026 at 7:17 PM Jason Gunthorpe <jgg@ziepe.ca> wrote:
> > >
> > > On Thu, Sep 10, 2026 at 12:26:51PM +0300, Leon Romanovsky wrote:
> > > > On Wed, Sep 09, 2026 at 10:29:48AM -0300, Jason Gunthorpe wrote:
> > > > > On Tue, Sep 08, 2026 at 04:45:53PM +0300, Leon Romanovsky wrote:
> > > > > > On Sun, Sep 06, 2026 at 04:06:53PM -0700, Selvin Xavier wrote:
> > > > > > > The BNXT_RE_MMAP_DBR_PAGE and BNXT_RE_MMAP_TOGGLE_PAGE cases of
> > > > > > > bnxt_re_mmap() hand out kernel pages that userspace is only supposed to
> > > > > > > read. VM_WRITE was already rejected, but VM_EXEC was not, so userspace
> > > > > > > could map these kernel pages executable. Reject VM_EXEC as well.
> > > > > > > Also, return EPERM instead of EFAULT.
> > > > > > >
> > > > > > > Fixes: 9b66c9af7172 ("RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap")
> > > > > > > CC: Yousef Alhouseen <alhouseenyousef@gmail.com>
> > > > > > > Reviewed-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
> > > > > > > Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
> > > > > > > ---
> > > > > > >  drivers/infiniband/hw/bnxt_re/ib_verbs.c | 8 ++++----
> > > > > > >  1 file changed, 4 insertions(+), 4 deletions(-)
> > > > > > >
> > > > > > > diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
> > > > > > > index ccd2702db78b..e39f99434923 100644
> > > > > > > --- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
> > > > > > > +++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
> > > > > > > @@ -5057,11 +5057,11 @@ int bnxt_re_mmap(struct ib_ucontext *ib_uctx, struct vm_area_struct *vma)
> > > > > > >                 break;
> > > > > > >         case BNXT_RE_MMAP_DBR_PAGE:
> > > > > > >         case BNXT_RE_MMAP_TOGGLE_PAGE:
> > > > > > > -               /* Driver doesn't expect write access for user space */
> > > > > > > -               if (vma->vm_flags & VM_WRITE) {
> > > > > > > -                       ret = -EFAULT;
> > > > > > > +               /* Driver doesn't expect write and exec access for user space */
> > > > > > > +               if (vma->vm_flags & (VM_WRITE | VM_EXEC)) {
> > > > > > > +                       ret = -EPERM;
> > > > > > >                 } else {
> > > > > > > -                       vm_flags_clear(vma, VM_MAYWRITE);
> > > > > > > +                       vm_flags_clear(vma, VM_MAYWRITE | VM_MAYEXEC);
> > > > > >
> > > > > > This is an opposite to 10bf13c33450 ("RDMA/mlx5: Remove MAYEXEC flag")
> > > > > > commit.
> > > > >
> > > > > Why did we do that? These MMIO mmap should never be executable
> > > >
> > > > I don't remember the rationale, but if I understood my findings correctly,
> > > > clearing VM_MAYEXEC broke memcopy.
> > >
> > > That doesn't make sense..
> >
> > Shall i post a v3 series with v1 contents again?
> Sashiko review mentioned to clear VM_MAYEXEC also. For your reference.
> https://sashiko.dev/#/message/20260909084241.570431F00A3A%40smtp.kernel.org

I lost track of it too. Anyway, if you repost it, could you check whether
this can be handled in the core code so that it applies to all devices?

Thanks

> >
> > Thanks,
> > Selvin
> > >
> > > Jason