liang.huang 1fc6f2bac8 arch/riscv: reject overlapping leaf PTE in riscv_fillpage ... riscv_fillpage() is the LOADPF/STOREPF handler used under CONFIG_PAGING. It checked whether intermediate page table levels were already allocated, but never checked the final leaf PTE before installing a new mapping. RISC-V raises the same LOADPF/STOREPF cause both when a leaf PTE is absent (a real fault) and when it is present but its permission bits don't satisfy the access, e.g. a store to a .text page whose write access was revoked after ELF loading. The two cases are indistinguishable from mcause alone. Treating both cases as "page missing" let riscv_fillpage silently allocate a fresh, zeroed physical page over an existing mapping, discarding the old page (a leak) and defeating whatever permission that mapping was enforcing. Reproduced on real hardware: a user-space store to an already-loaded .text page got a fresh writable page instead of being rejected. Check the leaf PTE's valid bit before allocating; if a mapping already exists, panic instead of overwriting it. Signed-off-by: liang.huang <liang.huang@houmo.ai>		2026-07-08 10:19:04 -03:00
..
include	arch/riscv: Add CONFIG_ARCH_RV_ISA_ZICSR_ZIFENCEI for fence.i	2026-06-28 02:17:03 +08:00
src	arch/riscv: reject overlapping leaf PTE in riscv_fillpage	2026-07-08 10:19:04 -03:00
CMakeLists.txt	arch/risk-v: migrate to SPDX identifier	2024-12-02 17:23:25 +08:00
Kconfig	arch/risc-v/rp23xx-rv: Add SMP support for dual Hazard3	2026-06-14 22:54:12 +08:00