jerpelea opened a new pull request, #19669: URL: https://github.com/apache/nuttx/pull/19669
## Summary riscv_fillpage() is the LOADPF/STOREPF handler used under CONFIG_PAGING. It checked whether intermediate page table levels were already allocated, but never checked the final leaf PTE before installing a new mapping. RISC-V raises the same LOADPF/STOREPF cause both when a leaf PTE is absent (a real fault) and when it is present but its permission bits don't satisfy the access, e.g. a store to a .text page whose write access was revoked after ELF loading. The two cases are indistinguishable from mcause alone. Treating both cases as "page missing" let riscv_fillpage silently allocate a fresh, zeroed physical page over an existing mapping, discarding the old page (a leak) and defeating whatever permission that mapping was enforcing. Reproduced on real hardware: a user-space store to an already-loaded .text page got a fresh writable page instead of being rejected. Check the leaf PTE's valid bit before allocating; if a mapping already exists, panic instead of overwriting it. ## Impact RELEASE ## Testing CI -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
