This is an automated email from the ASF dual-hosted git repository. xiaoxiang781216 pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/nuttx.git
commit ab9dcf33649ddaa010f067cff1117a6ccfd22b57 Author: Royyan Zahir <[email protected]> AuthorDate: Wed Sep 30 11:25:12 2026 +0400 arch/risc-v: map nothing of the kernel over user space access_ok() trusts the user address range, so a global kernel leaf inside it would pass as user memory. Refuse such a mapping. Signed-off-by: Royyan Zahir <[email protected]> --- arch/risc-v/src/common/riscv_mmu.c | 35 +++++++++++++++++++++++++++++++++++ 1 file changed, 35 insertions(+) diff --git a/arch/risc-v/src/common/riscv_mmu.c b/arch/risc-v/src/common/riscv_mmu.c index aec5aba3b03..bf0b8d7f84a 100644 --- a/arch/risc-v/src/common/riscv_mmu.c +++ b/arch/risc-v/src/common/riscv_mmu.c @@ -33,6 +33,10 @@ #include "riscv_internal.h" #include "riscv_mmu.h" +#ifdef CONFIG_BUILD_KERNEL +# include "addrenv.h" +#endif + /**************************************************************************** * Pre-processor Definitions ****************************************************************************/ @@ -41,6 +45,27 @@ * Private Functions ****************************************************************************/ +#ifdef CONFIG_BUILD_KERNEL +static bool is_user_overlap(uintptr_t vaddr, size_t size) +{ + uintptr_t last = vaddr + size - 1; + + if (vaddr <= ARCH_ADDRENV_VEND && last >= ARCH_ADDRENV_VBASE) + { + return true; + } + +#ifdef CONFIG_ARCH_VMA_MAPPING + if (vaddr <= ARCH_SHM_VEND && last >= CONFIG_ARCH_SHM_VBASE) + { + return true; + } +#endif + + return false; +} +#endif + /**************************************************************************** * Private Data ****************************************************************************/ @@ -69,6 +94,16 @@ void mmu_ln_setentry(uint32_t ptlevel, uintptr_t lnvaddr, uintptr_t paddr, DEBUGASSERT(ptlevel > 0 && ptlevel <= RV_MMU_PT_LEVELS); +#ifdef CONFIG_BUILD_KERNEL + if ((mmuflags & PTE_LEAF_MASK) != 0 && + (mmuflags & (PTE_G | PTE_U)) == PTE_G && + is_user_overlap(vaddr, RV_MMU_L1_PAGE_SIZE >> + (RV_MMU_VPN_WIDTH * (ptlevel - 1)))) + { + PANIC(); + } +#endif + /* Test if this is a leaf PTE, if it is, set A+D even if they are not used * by the implementation. *
