lwp: copy timeout into kernel space in sys_select()

[94xhn]

为什么提交这份PR (why to submit this PR)

Fixes #10298. sys_select() in components/lwp/lwp_syscall.c passes the raw user-space timeout pointer straight through to select(), unlike readfds/writefds/exceptfds, which are all validated with lwp_user_accessable() and copied into kernel memory first. select() then dereferences timeout->tv_sec/timeout->tv_usec directly with no validation of its own. A user thread passing a timeout pointer to unmapped or otherwise invalid memory reaches that dereference straight from kernel context, as described in #10298.

你的解决方案是什么 (what is your solution)

Validate and copy timeout into a kernel-local struct timeval the same way the three fd_set arguments already are, reusing the same lwp_user_accessable() + goto quit error path already in this function:

struct timeval ktimeout, *ptimeout = RT_NULL;
...
if (timeout)
{
    if (!lwp_user_accessable((void *)timeout, sizeof *timeout))
    {
        SET_ERRNO(EFAULT);
        goto quit;
    }
    lwp_get_from_user(&ktimeout, timeout, sizeof ktimeout);
    ptimeout = &ktimeout;
}

ret = select(nfds, kreadfds, kwritefds, kexceptfds, ptimeout);

请提供验证的bsp和config (provide the config and bsp)

• BSP: bsp/qemu-vexpress-a9
• .config: CONFIG_ARCH_MM_MMU=y (RT-Thread Smart / ARCH_MM_MMU, since sys_select()'s body is guarded by #ifdef ARCH_MM_MMU)
• action: I wasn't able to produce a CI build link — Actions on my fork need a one-time manual "enable workflows" click in the GitHub web UI that I don't have access to as an AI agent, and a local ARM toolchain build via WSL hit sustained network throttling that made it impractical to finish in reasonable time. What I did verify instead: this change is a direct structural copy of the exact validate-then-copy pattern already used three times in the same function for readfds/writefds/exceptfds (same lwp_user_accessable() call, same goto quit on failure, same lwp_get_from_user() copy), so it reuses an already-exercised code path rather than introducing a new one. I traced the quit: label and the rest of the function to confirm ptimeout/ktimeout are correctly scoped and that no other code path reads timeout directly after this change.

当前拉取/合并请求的状态 Intent for your PR

必须选择一项 Choose one (Mandatory):

• 本拉取/合并请求是一个成熟版本 This PR is mature, and ready to be integrated into the repo

代码质量 Code Quality：

我在这个拉取/合并请求中已经考虑了 As part of this pull request, I've considered the following:

• 已经仔细查看过代码改动的对比 Already check the difference between PR and old code
• 代码风格正确，包括缩进空格，命名及其他风格 Style guide is adhered to, including spacing, naming and other styles
• 没有垃圾代码，代码尽量精简，不包含#if 0代码，不包含已经被注释了的代码 All redundant code is removed and cleaned up
• 所有变更均有原因及合理的，并且不会影响到其他软件组件代码或BSP All modifications are justified and not affect other components or BSP
• 对难懂代码均提供对应的注释 I've commented appropriately where code is tricky
• 代码是高质量的 Code in this PR is of high quality
• 已经使用formatting 等源码格式化工具确保格式符合RT-Thread代码规范 This PR complies with RT-Thread code specification
• 如果是新增bsp, 已经添加ci检查到.github/ALL_BSP_COMPILE.json 详细请参考链接BSP自查

[CLAassistant]

All committers have signed the CLA.

[github-actions]

👋 感谢您对 RT-Thread 的贡献！Thank you for your contribution to RT-Thread!

为确保代码符合 RT-Thread 的编码规范，请在你的仓库中执行以下步骤运行代码格式化工作流（如果格式化CI运行失败）。
To ensure your code complies with RT-Thread's coding style, please run the code formatting workflow by following the steps below (If the formatting of CI fails to run).

---

🛠 操作步骤 | Steps

1. 前往 Actions 页面 | Go to the Actions page
   点击进入工作流 → | Click to open workflow →

2. 点击 Run workflow | Click Run workflow

• 设置需排除的文件/目录（目录请以"/"结尾）
  Set files/directories to exclude (directories should end with "/")
• 将目标分支设置为 \ Set the target branch to：fix-sys-select-timeout-user-ptr
• 设置PR number为 \ Set the PR number to：11599

3. 等待工作流完成 | Wait for the workflow to complete
   格式化后的代码将自动推送至你的分支。
   The formatted code will be automatically pushed to your branch.

完成后，提交将自动更新至 fix-sys-select-timeout-user-ptr 分支，关联的 Pull Request 也会同步更新。
Once completed, commits will be pushed to the fix-sys-select-timeout-user-ptr branch automatically, and the related Pull Request will be updated.

如有问题欢迎联系我们，再次感谢您的贡献！💐
If you have any questions, feel free to reach out. Thanks again for your contribution!

[github-actions]

📌 Code Review Assignment

🏷️ Tag: components

Reviewers: @Maihuanyi

Changed Files (Click to expand)

• components/lwp/lwp_syscall.c

🏷️ Tag: components_lwp

Reviewers: @xu18838022837

Changed Files (Click to expand)

• components/lwp/lwp_syscall.c

---

📊 Current Review Status (Last Updated: 2026-07-09 12:10 CST)

• ⌛ @Maihuanyi Pending Review
• ⌛ @xu18838022837 Pending Review

---

📝 Review Instructions

1. 维护者可以通过单击此处来刷新审查状态: 🔄 刷新状态
   Maintainers can refresh the review status by clicking here: 🔄 Refresh Status

2. 确认审核通过后评论 LGTM/lgtm
   Comment LGTM/lgtm after confirming approval

3. PR合并前需至少一位维护者确认
   PR must be confirmed by at least one maintainer before merging

ℹ️ 刷新CI状态操作需要具备仓库写入权限。
ℹ️ Refresh CI status operation requires repository Write permission.

[github-actions]

MemBrowse Memory Report

No memory changes detected for:

• at32f415-start
• gd32105r-start
• hc32f334
• hpmicro-hpm5301evklite
• k230
• loongson-ls1cdev
• nordic-nrf51822
• nuvoton-m487
• nxp-lpc1114
• qemu-virt64-aarch64
• renesas-ra2l1
• simulator
• stm32f407-rt-spark
• stm32l475-atk-pandora-llvm
• wch-ch32v208w-r0
• x86
• xuantie-e901plus