[Bug] rt-thread crack oops with command 'list_kmem'

RT-Thread Version

e1c1a07c48200fd3a99b6edc05cc2d80cfa6ff18

Hardware Type/Architectures

qemu-virt64-riscv

Develop Toolchain

GCC

Describe the bug

wxk@local:~/work/dl-linux/rt-thread/bsp/qemu-virt64-riscv$ ./run.sh

OpenSBI v0.9
   ____                    _____ ____ _____
  / __ \                  / ____|  _ \_   _|
 | |  | |_ __   ___ _ __ | (___ | |_) || |
 | |  | | '_ \ / _ \ '_ \ \___ \|  _ < | |
 | |__| | |_) |  __/ | | |____) | |_) || |_
  \____/| .__/ \___|_| |_|_____/|____/_____|
        | |
        |_|

Platform Name             : riscv-virtio,qemu
Platform Features         : timer,mfdeleg
Platform HART Count       : 1
Firmware Base             : 0x80000000
Firmware Size             : 100 KB
Runtime SBI Version       : 0.2

Domain0 Name              : root
Domain0 Boot HART         : 0
Domain0 HARTs             : 0*
Domain0 Region00          : 0x0000000080000000-0x000000008001ffff ()
Domain0 Region01          : 0x0000000000000000-0xffffffffffffffff (R,W,X)
Domain0 Next Address      : 0x0000000080200000
Domain0 Next Arg1         : 0x000000008f000000
Domain0 Next Mode         : S-mode
Domain0 SysReset          : yes

Boot HART ID              : 0
Boot HART Domain          : root
Boot HART ISA             : rv64imafdcsu
Boot HART Features        : scounteren,mcounteren,time
Boot HART PMP Count       : 16
Boot HART PMP Granularity : 4
Boot HART PMP Address Bits: 54
Boot HART MHPM Count      : 0
Boot HART MHPM Count      : 0
Boot HART MIDELEG         : 0x0000000000000222
Boot HART MEDELEG         : 0x000000000000b109
heap: [0x8028f9e8 - 0x8428f9e8]

 \ | /
- RT -     Thread Operating System
 / | \     5.2.2 build Sep  9 2025 16:30:12
 2006 - 2024 Copyright by RT-Thread team
lwIP-2.0.3 initialized!
[I/sal.skt] Socket Abstraction Layer initialize success.
[I/utest] utest is initialize success.
[I/utest] total utest testcase num: (0)
file system initialization done!
Hello RISC-V
msh />list_kmem
(rt_object_get_type(&mutex->parent.parent) == RT_Object_Class_Mutex) assertion failed at function:_rt_mutex_take, line number:1337
Unhandled Exception 5:Load Access Fault
scause:0x0000000000000005,stval:0x0000000000000010,sepc:0x00000000802379b2
--------------Dump Registers-----------------
Function Registers:
        ra(x1) = 0x0000000080237ab2     user_sp = 0x000000008037fc90
        gp(x3) = 0x000000008026eab8     tp(x4) = (nil)
Temporary Registers:
        t0(x5) = 0x0000000000044100     t1(x6) = 0x0000000000000004
        t2(x7) = 0xffffffffffffffff
        t3(x28) = 0x8080808080808080    t4(x29) = (nil)
        t5(x30) = (nil) t6(x31) = (nil)
Saved Registers:
        s0/fp(x8) = 0x000000008037fd00  s1(x9) = 0x000000008025325e
        s2(x18) = (nil) s3(x19) = (nil)
        s4(x20) = (nil) s5(x21) = (nil)
        s6(x22) = (nil) s7(x23) = (nil)
        s8(x24) = (nil) s9(x25) = (nil)
        s10(x26) = (nil)        s11(x27) = (nil)
Function Arguments Registers:
        a0(x10) = 0x0000000080276b18    a1(x11) = 0x000000008037fdc0
        a2(x12) = 0x000000008037fd1c    a3(x13) = 0x0000000000000084
        a4(x14) = (nil) a5(x15) = 0x0000000000000010
        a6(x16) = (nil) a7(x17) = 0x0000000000004000
sstatus = 0x8000000000046120
        Supervisor Interrupt Disabled
        Last Time Supervisor Interrupt Enabled
        Last Privilege is Supervisor Mode
        Permit to Access User Page
        Not Permit to Read Executable-only Page
satp = (nil)
        Current Page Table(Physical) = (nil)
        Current ASID = (nil)
        Mode = No Address Translation/Protection Mode
-----------------Dump OK---------------------
--------------Thread list--------------
current thread: tshell
--------------Backtrace--------------
please use: addr2line -e rtthread.elf -a -f
 0x802379b2Unhandled Exception 5:Load Access Fault
[E/libcpu.trap]
-------- [SEVER ERROR] --------
[E/libcpu.trap] Nested trap detected
[E/libcpu.trap] scause:0x0000000000000005,stval:0x0000000000000010,sepc:0x00000000802379b2

--------------Dump Registers-----------------
Function Registers:
        ra(x1) = 0x0000000080237ab2     user_sp = 0x000000008037f8f0
        gp(x3) = 0x000000008026eab8     tp(x4) = (nil)
Temporary Registers:
        t0(x5) = 0x0000000000000005     t1(x6) = 0x0000000000000008
        t2(x7) = 0xffffffffffffffff
        t3(x28) = 0x8080808080808080    t4(x29) = (nil)
        t5(x30) = (nil) t6(x31) = (nil)
Saved Registers:
        s0/fp(x8) = 0x000000008037f960  s1(x9) = 0x000000008025325e
        s2(x18) = (nil) s3(x19) = (nil)
        s4(x20) = (nil) s5(x21) = (nil)
        s6(x22) = (nil) s7(x23) = (nil)
        s8(x24) = (nil) s9(x25) = (nil)
        s10(x26) = (nil)        s11(x27) = (nil)
Function Arguments Registers:
        a0(x10) = 0x0000000080276b18    a1(x11) = 0x000000008037fd00
        a2(x12) = 0x000000008037f97c    a3(x13) = 0x000000000000000b
        a4(x14) = (nil) a5(x15) = 0x0000000000000010
        a6(x16) = (nil) a7(x17) = 0x0000000000000200
sstatus = 0x0000000000044100
        Supervisor Interrupt Disabled
        Last Time Supervisor Interrupt Disabled
        Last Privilege is Supervisor Mode
        Permit to Access User Page
        Not Permit to Read Executable-only Page
satp = (nil)
        Current Page Table(Physical) = (nil)
        Current ASID = (nil)
        Mode = No Address Translation/Protection Mode
-----------------Dump OK---------------------
shutdown...

wxk@local:~/work/dl-linux/rt-thread/bsp/qemu-virt64-riscv$ addr2line -e rtthread.elf -a -f
0x802379b2
0x00000000802379b2
_query
/home/wxk/work/dl-linux/rt-thread/libcpu/risc-v/common64/mmu.c:461

Other additional context

No response

Reproduce the failure in bsp/qemu-virt64-riscv by running run.sh and entering list_kmem. Start with libcpu/risc-v/common64/mmu.c:461 and use addr2line on the reported address to trace _query. Done means list_kmem no longer triggers the mutex assertion or Load Access Fault.