[Bug] musl __pthread_exit thread-list use-after-free under concurrent thread exit (RT-Thread Smart, SMP) #11932

RT-Thread Version

5.2.2

Affected area

RT-Smart

Hardware/BSP vendor

Not applicable / Other

Architecture

ARM / AArch64

Board and hardware details

N/A

Develop Toolchain

GCC

Describe the bug

Concurrent pthread_create/exit crashes user processes on RT-Thread Smart 5.2.2 (SMP, aarch64, musl 1.2.5) inside musl_pthread_exit:
thread-list unlink writes to a thread descriptor already freed/unmapped (Data Abort), or a thread's return address is corrupted to 0 (Instruction Abort). Root cause: the futex-based __tl_lock/__tl_sync fails to provide mutual exclusion for musl's thread-list under concurrent exit on SMP, corrupting the doubly-linked list – entirely user-space, kernel futex is structurally correct.
(tl_race.c, attached): ./tl_race 1000 8 crashes after a few hundred rounds. Details in the attached report.

musl pthread_exit thread-list UAF.md

Other additional context

No response