This is an automated email from the ASF dual-hosted git repository. xiaoxiang781216 pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/nuttx.git
commit 9efe82af954220171be0b141b6fbc34a6be38a19 Author: likun17 <[email protected]> AuthorDate: Wed Sep 2 21:57:39 2026 +0800 sched: reject INVALID and exiting TCBs in sched_backtrace() A TCB is reachable through g_pidhash right after nxtask_assign_pid(), but tcb->xcp.regs stays NULL until up_initial_state() runs. Unwinding such a TCB read NULL[REG_FP], i.e. address 0x14, and took a MemManage fault; _assert() then hit the same TCB again from HardFault context, which locks up the core and loses the coredump. The TSTATE_TASK_INVALID / TCB_FLAG_EXIT_PROCESSING check only existed in sched_backtrace_handler(), which is built under CONFIG_SMP, so single core builds had no protection. Do the same check in the common path and return 0, which sched_dumpstack() already handles. Signed-off-by: likun17 <[email protected]> --- sched/sched/sched_backtrace.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/sched/sched/sched_backtrace.c b/sched/sched/sched_backtrace.c index 9264b11fe06..c6deec98212 100644 --- a/sched/sched/sched_backtrace.c +++ b/sched/sched/sched_backtrace.c @@ -142,6 +142,13 @@ int sched_backtrace(pid_t tid, FAR void **buffer, int size, int skip) tcb = nxsched_get_tcb(tid); if (tcb != NULL) { + if (tcb->task_state == TSTATE_TASK_INVALID || + (tcb->flags & TCB_FLAG_EXIT_PROCESSING) != 0) + { + leave_critical_section(flags); + return 0; + } + #ifdef CONFIG_SMP if (!OSINIT_IS_PANIC() && tcb->task_state == TSTATE_TASK_RUNNING)
