Re: [PATCH for-rc v2 1/8] RDMA/bnxt_re: Reject executable mappings of the DBR and toggle pages
From: sashiko-bot@kernel.org
Date: 2026-09-09 08:42:41
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [Medium] The patch rejects VM_EXEC to prevent executable mappings of the DBR and toggle pages, but fails to clear VM_MAYEXEC. This allows userspace to bypass the restriction via mprotect(). -- commit b5ba6f660e81b67fecc55a7c6ceae5f0724ddc0a Author: Selvin Xavier [off-list ref] RDMA/bnxt_re: Reject executable mappings of the DBR and toggle pages This commit updates bnxt_re_mmap() to reject VM_EXEC mappings for DBR and toggle pages, returning -EPERM instead of -EFAULT. It is intended to prevent userspace from mapping these pages as executable.
quoted hunk ↗ jump to hunk
diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c index ccd2702db78b5..d80a22e4ac70d 100644 --- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c +++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c@@ -5057,9 +5057,9 @@ int bnxt_re_mmap(struct ib_ucontext *ib_uctx, struct vm_area_struct *vma) break; case BNXT_RE_MMAP_DBR_PAGE: case BNXT_RE_MMAP_TOGGLE_PAGE: - /* Driver doesn't expect write access for user space */ - if (vma->vm_flags & VM_WRITE) { - ret = -EFAULT; + /* Driver doesn't expect write and exec access for user space */ + if (vma->vm_flags & (VM_WRITE | VM_EXEC)) { + ret = -EPERM; } else { vm_flags_clear(vma, VM_MAYWRITE);
[Severity: Medium] Does this code also need to clear VM_MAYEXEC? While the patch correctly rejects an initial mapping with PROT_EXEC, failing to clear VM_MAYEXEC allows userspace to bypass the restriction by calling mprotect() with PROT_EXEC after the mmap() succeeds.
ret = vm_insert_page(vma, vma->vm_start,
-- Sashiko AI review · https://sashiko.dev/#/patchset/20260909135244.122747-1-selvin.xavier@broadcom.com?part=1