Skip to site navigation (Press enter)

[I] [BUG] Premature exit of a process will cause the group to be released ahead of schedule. [nuttx]</span></a></span> </h1> <p class="darkgray font13"> <span class="sender pipe"><a href="/search?l=commits@nuttx.apache.org&q=from:%22via+GitHub%22" rel="nofollow"><span itemprop="author" itemscope itemtype="http://schema.org/Person"><span itemprop="name">via GitHub</span></span></a></span> <span class="date"><a href="/search?l=commits@nuttx.apache.org&q=date:20251201" rel="nofollow">Mon, 01 Dec 2025 22:32:06 -0800</a></span> </p> </div> <div itemprop="articleBody" class="msgBody">  <pre> husong2 opened a new issue, #17418: URL: <a rel="nofollow" href="https://github.com/apache/nuttx/issues/17418">https://github.com/apache/nuttx/issues/17418</a></pre><pre> ### Description / Steps to reproduce the issue If there is a sleep call in a child thread, a crash will occur. The test case is as follows: ```c #define TIMEOUT 5 /* Timeout value of 5 seconds. / #define INTHREAD 0 / Control going to or is already for Thread / #define INMAIN 1 / Control going to or is already for Main / static int sem1; / Manual semaphore / static void a_thread_func(void arg) { printf("a_thread_func entry \n"); / Indicate to main() that the thread was created. / sem1 = INTHREAD; / Wait for main to detach change the attribute object and try and detach this thread. * Wait for a timeout value of 10 seconds before timing out if the thread was not able * to be detached. / // sleep(TIMEOUT); printf("a_thread_func entry 2222\n"); printf ("Test FAILED: Did not detach the thread, main still waiting for it to end execution.\n"); pthread_exit((void )PTS_FAIL); return NULL; } int main(void) { pthread_t new_th; pthread_attr_t new_attr; int ret_val; /* Initializing / sem1 = INMAIN; if (pthread_attr_init(&new_attr) != 0) { perror("Cannot initialize attribute object\n"); return PTS_UNRESOLVED; } / Create a new thread passing it the new attribute object / if (pthread_create(&new_th, &new_attr, a_thread_func, NULL) != 0) { perror("Error creating thread\n"); return PTS_UNRESOLVED; } / Wait for thread to indicate that the start routine for the thread has started. / while (sem1 == INMAIN) sleep(1); / If pthread_detach fails, that means that the test fails as well. / ret_val = pthread_detach(new_th); if (ret_val != 0) { / Thread is already detached. / if (ret_val == EINVAL) { printf("Test FAILED\n"); return PTS_FAIL; } / pthread_detach() failed for another reason. */ else { printf("Error in pthread_detach(), error: %d\n", ret_val); return PTS_UNRESOLVED; } } printf("Test PASSED\n"); printf("Test PASSED 2222 \n"); return PTS_PASS; } ``` The specific logic is as follows: When the process starts to exit by calling exit(), the main thread will be removed from the group. The call chain is as follows: ```text #0 group_leave (tcb=tcb@entry=0x412a1470) at ../../nuttx/sched/group/group_leave.c:195 #1 0x0012a32e in nxtask_exithook (tcb=tcb@entry=0x412a1470, status=status@entry=0) at ../../nuttx/sched/task/task_exithook.c:481 #2 0x0012ad78 in _exit (status=112, status@entry=1093276784) at ../../nuttx/sched/task/exit.c:106 #3 0x001bb22c in exit (status=1093276784) at ../../nuttx/libs/libc/stdlib/lib_exit.c:126 #4 0x001b92bc in nxtask_startup (entrypt=entrypt@entry=0x412a1470, argc=<optimized out>, argv=<optimized out>) at ../../nuttx/libs/libc/sched/task_startup.c:66 #5 0x00129e14 in nxtask_start () at ../../nuttx/sched/task/task_start.c:104 #6 0x00000000 in ?? () ``` Then, when the child thread executes sleep(), it will also trigger the exit process: the child thread is removed from the group and its TCB is deleted. At this point, since the TCB and the group are allocated together in memory, the memory space of the group will be deleted along with the TCB. The call chain is as follows: ```text #0 group_leave (tcb=tcb@entry=0x412a1a28) at ../../nuttx/sched/group/group_leave.c:195 #1 0x0012a32e in nxtask_exithook (tcb=tcb@entry=0x412a1a28, status=status@entry=0) at ../../nuttx/sched/task/task_exithook.c:481 #2 0x001209b0 in nx_pthread_exit (exit_value=exit_value@entry=0xffffffff) at ../../nuttx/sched/pthread/pthread_exit.c:123 #3 0x00116726 in pthread_exit (exit_value=exit_value@entry=0xffffffff) at ../../nuttx/libs/libc/pthread/pthread_exit.c:71 #4 0x00111084 in leave_cancellation_point () at ../../nuttx/libs/libc/sched/task_cancelpt.c:200 #5 0x00134238 in clock_nanosleep (clockid=clockid@entry=0, flags=flags@entry=0, rqtp=rqtp@entry=0x412a2ec8, rmtp=rmtp@entry=0x412a2ed8) at ../../nuttx/sched/signal/sig_nanosleep.c:208 #6 0x004256c0 in sleep (seconds=seconds@entry=5) at ../../nuttx/libs/libc/unistd/lib_sleep.c:112 #7 0x00211d0e in a_thread_func (arg=<error reading variable: value has been optimized out>) at ../../apps/testing/ltp/ltp/testcases/open_posix_testsuite/conformance/interfaces/pthread_attr_init/2-1.c:46 #8 0x004089e0 in pthread_startup (entry=<optimized out>, arg=<optimized out>) at ../../nuttx/libs/libc/pthread/pthread_create.c:61 #9 0x00445baa in pthread_start () at ../../nuttx/sched/pthread/pthread_create.c:147 #10 0x00000000 in ?? () ``` ```text #0 umm_delayfree (mem=mem@entry=0x4129fa28) at ../../nuttx/mm/umm_heap/umm_free.c:69 #1 0x00122c7e in nxsched_release_tcb (tcb=tcb@entry=0x4129fa28, ttype=1) at ../../nuttx/sched/sched/sched_releasetcb.c:213 #2 0x001d3a70 in nxtask_exit () at ../../nuttx/sched/task/task_exit.c:128 #3 0x0013b568 in up_exit (status=status@entry=0) at ../../nuttx/arch/arm/src/common/arm_exit.c:59 #4 0x00120808 in nx_pthread_exit (exit_value=exit_value@entry=0xffffffff) at ../../nuttx/sched/pthread/pthread_exit.c:131 #5 0x00116636 in pthread_exit (exit_value=exit_value@entry=0xffffffff) at ../../nuttx/libs/libc/pthread/pthread_exit.c:71 #6 0x00110f94 in leave_cancellation_point () at ../../nuttx/libs/libc/sched/task_cancelpt.c:204 #7 0x001340c0 in clock_nanosleep (clockid=clockid@entry=0, flags=flags@entry=0, rqtp=rqtp@entry=0x412a0ec8, rmtp=rmtp@entry=0x412a0ed8) at ../../nuttx/sched/signal/sig_nanosleep.c:208 #8 0x00424ef0 in sleep (seconds=seconds@entry=5) at ../../nuttx/libs/libc/unistd/lib_sleep.c:112 #9 0x0021153e in a_thread_func (arg=<error reading variable: value has been optimized out>) at ../../apps/testing/ltp/ltp/testcases/open_posix_testsuite/conformance/interfaces/pthread_attr_init/2-1.c:46 #10 0x00408210 in pthread_startup (entry=<optimized out>, arg=<optimized out>) at ../../nuttx/libs/libc/pthread/pthread_create.c:61 #11 0x004453da in pthread_start () at ../../nuttx/sched/pthread/pthread_create.c:147 #12 0x00000000 in ?? () ``` Finally, the process starts to exit by calling up_exit(). The exit process still contains an operation to delete the TCB, resulting in a double free. The call chain is as follows: ```text #0 __assert (filename=filename@entry=0x4d1504 "../../nuttx/mm/mm_heap/mm_free.c", linenum=linenum@entry=67, msg=msg@entry=0x0) at ../../nuttx/libs/libc/assert/lib_assert.c:39 #1 0x00117e8e in add_delaylist (heap=heap@entry=0x4129e000, mem=mem@entry=0x4129f470, asan_check=false) at ../../nuttx/mm/mm_heap/mm_free.c:67 #2 0x001186e4 in mm_delayfree (heap=0x4129e000, mem=mem@entry=0x4129f470) at ../../nuttx/mm/mm_heap/mm_free.c:249 #3 0x00117c1e in umm_delayfree (mem=mem@entry=0x4129f470) at ../../nuttx/mm/umm_heap/umm_free.c:70 #4 0x00122cae in nxsched_release_tcb (tcb=tcb@entry=0x4129f470, ttype=0) at ../../nuttx/sched/sched/sched_releasetcb.c:213 #5 0x001d3aa0 in nxtask_exit () at ../../nuttx/sched/task/task_exit.c:128 #6 0x0013b598 in up_exit (status=status@entry=0) at ../../nuttx/arch/arm/src/common/arm_exit.c:59 #7 0x0012ac00 in _exit (status=112, status@entry=1093268592) at ../../nuttx/sched/task/exit.c:114 #8 0x001bb0e4 in exit (status=1093268592) at ../../nuttx/libs/libc/stdlib/lib_exit.c:126 #9 0x001b9174 in nxtask_startup (entrypt=entrypt@entry=0x4129f470, argc=<optimized out>, argv=<optimized out>) at ../../nuttx/libs/libc/sched/task_startup.c:66 #10 0x00129c74 in nxtask_start () at ../../nuttx/sched/task/task_start.c:104 #11 0x00000000 in ?? () ``` ### On which OS does this issue occur? [OS: Linux] ### What is the version of your OS? vela ### NuttX Version latest version ### Issue Architecture [Arch: arm64], [Arch: arm] ### Issue Area [Area: Other] ### Host information _No response_ ### Verification - [x] I have verified before submitting the report. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: commits-unsubscr...@nuttx.apache.org.apache.org For queries about this service, please contact Infrastructure at: us...@infra.apache.org </pre> </div> <div class="msgButtons margintopdouble"> <ul class="overflow"> <li class="msgButtonItems"><a class="button buttonleft " accesskey="p" href="msg148187.html">Previous message</a></li> <li class="msgButtonItems textaligncenter"><a class="button" accesskey="c" href="index.html#148194">View by thread</a></li> <li class="msgButtonItems textaligncenter"><a class="button" accesskey="i" href="maillist.html#148194">View by date</a></li> <li class="msgButtonItems textalignright"><a class="button buttonright " accesskey="n" href="msg148195.html">Next message</a></li> </ul> </div> <a name="tslice"></a> <div class="tSliceList margintopdouble"> <ul class="icons monospace"> <li class="icons-email tSliceCur"><span class="subject">[I] [BUG] <title>Premature exit of a process will cause t...</span> <span class="sender italic">via GitHub</span></li> <li><ul> <li class="icons-email"><span class="subject"><a href="msg148195.html">Re: [I] [BUG] <title>Premature exit of a process wil...</a></span> <span class="sender italic">via GitHub</span></li> <li class="icons-email"><span class="subject"><a href="msg148196.html">Re: [I] [BUG] <title>Premature exit of a process wil...</a></span> <span class="sender italic">via GitHub</span></li> <li class="icons-email"><span class="subject"><a href="msg148201.html">Re: [I] [BUG] <title>Premature exit of a process wil...</a></span> <span class="sender italic">via GitHub</span></li> <li class="icons-email"><span class="subject"><a href="msg148202.html">Re: [I] [BUG] <title>Premature exit of a process wil...</a></span> <span class="sender italic">via GitHub</span></li> <li class="icons-email"><span class="subject"><a href="msg148206.html">Re: [I] [BUG] <title>Premature exit of a process wil...</a></span> <span class="sender italic">via GitHub</span></li> <li class="icons-email"><span class="subject"><a href="msg148210.html">Re: [I] [BUG] <title>Premature exit of a process wil...</a></span> <span class="sender italic">via GitHub</span></li> <li class="icons-email"><span class="subject"><a href="msg148246.html">Re: [I] [BUG] Premature exit of a process will cause the g...</a></span> <span class="sender italic">via GitHub</span></li> <li class="icons-email"><span class="subject"><a href="msg148247.html">Re: [I] [BUG] Premature exit of a process will cause the g...</a></span> <span class="sender italic">via GitHub</span></li> </ul> </ul> </div> <div class="overflow msgActions margintopdouble"> <div class="msgReply" > <h2> Reply via email to </h2> <form method="POST" action="/mailto.php"> <input type="hidden" name="subject" value="[I] [BUG] <title>Premature exit of a process will cause the group to be released ahead of schedule. [nuttx]"> <input type="hidden" name="msgid" value="I_kwDODZiUac7bmcn3@gitbox.apache.org"> <input type="hidden" name="relpath" value="commits@nuttx.apache.org/msg148194.html"> <input type="submit" value=" via GitHub "> </form> </div> </div> </div> <div class="aside" role="complementary"> <div class="logo"> <a href="/"><img src="/logo.png" width=247 height=88 alt="The Mail Archive"></a> </div> <form class="overflow" action="/search" method="get"> <input type="hidden" name="l" value="commits@nuttx.apache.org"> <label class="hidden" for="q">Search the site</label> <input class="submittext" type="text" id="q" name="q" placeholder="Search commits"> <input class="submitbutton" name="submit" type="image" src="/submit.png" alt="Submit"> </form> <div class="nav margintop" id="nav" role="navigation"> <ul class="icons font16"> <li class="icons-home"><a href="/">The Mail Archive home</a></li> <li class="icons-list"><a href="/commits@nuttx.apache.org/">commits - all messages</a></li> <li class="icons-about"><a href="/commits@nuttx.apache.org/info.html">commits - about the list</a></li> <li class="icons-expand"><a href="/search?l=commits@nuttx.apache.org&q=subject:%22%5C%5BI%5C%5D+%5C%5BBUG%5C%5D+%3Ctitle%3EPremature+exit+of+a+process+will+cause+the+group+to+be+released+ahead+of+schedule.+%5C%5Bnuttx%5C%5D%22&o=newest&f=1" title="e" id="e">Expand</a></li> <li class="icons-prev"><a href="msg148187.html" title="p">Previous message</a></li> <li class="icons-next"><a href="msg148195.html" title="n">Next message</a></li> </ul> </div> <div class="listlogo margintopdouble"> </div> <div class="margintopdouble"> </div> </div> </div> <div class="footer" role="contentinfo"> <ul> <li><a href="/">The Mail Archive home</a></li> <li><a href="/faq.html#newlist">Add your mailing list</a></li> <li><a href="/faq.html">FAQ</a></li> <li><a href="/faq.html#support">Support</a></li> <li><a href="/faq.html#privacy">Privacy</a></li> <li class="darkgray">I_kwDODZiUac7bmcn3@gitbox.apache.org</li> </ul> </div> </body> </html> <script>(function(){function c(){var b=a.contentDocument||a.contentWindow.document;if(b){var d=b.createElement('script');d.innerHTML="window.__CF$cv$params={r:'9aa793d939d41e79',t:'MTc2NTE0Nzc4MA=='};var a=document.createElement('script');a.src='/cdn-cgi/challenge-platform/scripts/jsd/main.js';document.getElementsByTagName('head')[0].appendChild(a);";b.getElementsByTagName('head')[0].appendChild(d)}}if(document.body){var a=document.createElement('iframe');a.height=1;a.width=1;a.style.position='absolute';a.style.top=0;a.style.left=0;a.style.border='none';a.style.visibility='hidden';document.body.appendChild(a);if('loading'!==document.readyState)c();else if(window.addEventListener)document.addEventListener('DOMContentLoaded',c);else{var e=document.onreadystatechange||function(){};document.onreadystatechange=function(b){e(b);'loading'!==document.readyState&&(document.onreadystatechange=e,c())}}}})();</script>