From 7ad699e4fbfc233aabf82dd5ede68e4e09802284 Mon Sep 17 00:00:00 2001 From: Rafal Kolanski Date: Wed, 22 Apr 2020 04:22:33 +1000 Subject: [PATCH] riscv: check type of cap before checking if mapped In decodeRISCVMMUInvocation, in the asid_pool_cap case, the first extra cap is supplied by the user. Before asking whether the page table cap is mapped, we should check it is a page table cap. Signed-off-by: Rafal Kolanski --- src/arch/riscv/kernel/vspace.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/arch/riscv/kernel/vspace.c b/src/arch/riscv/kernel/vspace.c index 973d8b113..aa4bb5c90 100644 --- a/src/arch/riscv/kernel/vspace.c +++ b/src/arch/riscv/kernel/vspace.c @@ -1002,7 +1002,9 @@ exception_t decodeRISCVMMUInvocation(word_t label, word_t length, cptr_t cptr, vspaceCapSlot = extraCaps.excaprefs[0]; vspaceCap = vspaceCapSlot->cap; - if (cap_page_table_cap_get_capPTIsMapped(vspaceCap)) { + if (unlikely( + cap_get_capType(vspaceCap) != cap_page_table_cap || + cap_page_table_cap_get_capPTIsMapped(vspaceCap))) { userError("RISCVASIDPool: Invalid vspace root."); current_syscall_error.type = seL4_InvalidCapability; current_syscall_error.invalidCapNumber = 1;