Thanks @pangyun for the project.
I just tested it.
First, I compiled it into the flash, because you were testing it in SRAM

Then I changed
(void)MPU_EnableRegion(&mpu_pal_config_1_Instance, 2U, false);
to
(void)MPU_EnableRegion(&mpu_pal_config_1_Instance, 3U, false);
So that the descriptor 3 that allows the READ access is disabled only.
After debugging I see that the fault is at 0x2F5C.

This is because the code of MPU_GetError() uses a LDR instruction to load R0 with the value at 0x2F5C - so this is a read operation. Execution of the code in the Flash is allowed by the MPU but reading is not.

Regards,
Daniel