mirror of
https://github.com/apache/nuttx.git
synced 2026-08-03 13:19:01 +00:00
1fc6f2bac8
riscv_fillpage() is the LOADPF/STOREPF handler used under CONFIG_PAGING. It checked whether intermediate page table levels were already allocated, but never checked the final leaf PTE before installing a new mapping. RISC-V raises the same LOADPF/STOREPF cause both when a leaf PTE is absent (a real fault) and when it is present but its permission bits don't satisfy the access, e.g. a store to a .text page whose write access was revoked after ELF loading. The two cases are indistinguishable from mcause alone. Treating both cases as "page missing" let riscv_fillpage silently allocate a fresh, zeroed physical page over an existing mapping, discarding the old page (a leak) and defeating whatever permission that mapping was enforcing. Reproduced on real hardware: a user-space store to an already-loaded .text page got a fresh writable page instead of being rejected. Check the leaf PTE's valid bit before allocating; if a mapping already exists, panic instead of overwriting it. Signed-off-by: liang.huang <liang.huang@houmo.ai> |
||
|---|---|---|
| .. | ||
| arm | ||
| arm64 | ||
| avr | ||
| ceva | ||
| dummy | ||
| hc | ||
| mips | ||
| misoc | ||
| or1k | ||
| renesas | ||
| risc-v | ||
| sim | ||
| sparc | ||
| tricore | ||
| x86 | ||
| x86_64 | ||
| xtensa | ||
| z16 | ||
| z80 | ||
| CMakeLists.txt | ||
| Kconfig | ||