casaroli opened a new pull request, #21032: URL: https://github.com/apache/nuttx/pull/21032
## Summary In kernel and protected builds the TLS block and the robust-mutex list it anchors live in user memory. At task exit `nxtask_recover()` followed `tls->tl_mhead` and wrote through each node (`mutex_reset()`, `flink`, `flags`) in kernel mode, and `task_uninit_info()` freed the user-heap task-info nodes the same way. When the TLS or a list is corrupted, for example after a stack overflow writes over the TLS at the stack base, the kernel either faulted or followed a user-controlled pointer while privileged. This change validates every list node before it is dereferenced. `pthread_mutex_inconsistent()` now takes the target `tcb` and checks that the TLS and each mutex lie inside that task's user memory. Kernel builds also require a mapped backing page and exclude the text region; protected builds accept only user data, bss and heap. Nodes must be aligned, and each mutex must be robust and owned by the exiting thread. A bad node ends the walk instead of faulting. `nxtask_recover()` selects the victim's address environment around recovery, so the TLS and an unmapped `waitobj` are read in the correct space, and restores it even when selection fails. `task_uninit_info()` skips traversing and freeing unprivileged user task-info allocations in kernel builds: the address environment reclaims the user heap, and group teardown still releases the file descriptors. `up_addrenv_find_page()` is implemented for armv7-a, since the kernel-build page check needs it. ## Impact Flat builds are unchanged: the new guards compile out. Kernel and protected builds on every architecture are affected, because the recovery code is generic. The armv7-a page-lookup implementation is new code reached only by the kernel-build check. The modified `pthread_mutex_inconsistent()` prototype is internal (`sched/pthread/pthread.h`); there is no public API or ABI change. ## Testing `rv-virt:knetnsh64` and `rv-virt:pnsh64`: full `ostest` exits with status 0, including robust-mutex recovery. `rv-virt:knetnsh64`: a user program that overflows its stack and corrupts its TLS now ends in a user `SIGSEGV` and returns to NSH; a following command runs. Before the change the kernel panicked during recovery. Focused regression: a valid robust owner death returns `EOWNERDEAD`; invalid, unmapped and self-cyclic list heads do not panic; a separate process exiting leaves the parent's mutex and semaphore untouched. `qemu-armv7a:knsh`: full kernel build passes, including the implemented page lookup. ARM runtime behaviour was not tested. `tools/checkpatch.sh` and `git diff --check` pass. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
