[Bug] Memory allocation error in rt_malloc function

RT-Thread Version

5.2.0 commit 2f559906d6202c27142237ab4b1d893034a5b7c3

Hardware Type/Architectures

VEXPRESS_A9

Develop Toolchain

GCC

Steps to reproduce

1.Build RT-Thread
2.Use the following command to start the kernel with QEMU:

qemu-system-arm \
    -M vexpress-a9 \
    -smp 2 \
    -m 4096M \
    -kernel /path/to/rt-thread/bsp/qemu-vexpress-a9/rtthread.bin \
    -drive if=sd,file=/path/to/rt-thread/bsp/qemu-vexpress-a9/sd.bin,format=raw \
    -nographic \
    -semihosting \

Source code location

/root/rtthread/rt-thread/src/kservice.c : 686

rt_weak void *rt_malloc(rt_size_t size)
{
    rt_base_t level;
    void *ptr;

    /* Enter critical zone */
    level = _heap_lock();
    /* allocate memory block from system heap */
    ptr = _MEM_MALLOC(size); // 686
    /* Exit critical zone */
    _heap_unlock(level);
    /* call 'rt_malloc' hook */
    RT_OBJECT_HOOK_CALL(rt_malloc_hook, (&ptr, size));
    return ptr;
}

Test case

syz_create_bind_socket (0x3, 0x0, 0x8001, 0x0)

long syz_create_bind_socket(volatile long domain, volatile long type, volatile long protocol, volatile long sockaddr_ptr) {
    int sock = socket((int)domain, (int)type, (int)protocol);
    if (sock < 0) {
        return -1;
    }
    struct sockaddr_in addr;
    if (sockaddr_ptr != 0) {
        memcpy(&addr, (struct sockaddr_in *)sockaddr_ptr, sizeof(struct sockaddr_in));
    } else {
        memset(&addr, 0, sizeof(struct sockaddr_in));
        addr.sin_family = AF_INET;
        addr.sin_port = htons(12345);
        addr.sin_addr.s_addr = htonl(INADDR_ANY); 
    }

    if (bind(sock, (struct sockaddr *)&addr, sizeof(struct sockaddr_in)) < 0) {
        closesocket(sock);
        return -2; 
    }

    return (long)sock;
}

Backtrace upon hitting the bug

#executing syz_create_bind_socket (0x3, 0x0, 0x8001, 0x0)
2024/09/04 10:54:03 Syscall execution is ok
2024/09/04 10:54:04 qemu run inst merger err: execution timed out
2024/09/04 10:54:04 Received stop signal, requires feedback = true
2024/09/04 10:54:04 running diagnose
2024/09/04 10:54:04 VM-0 failed reading regs: dial tcp 127.0.0.1:41077: connect: connection refused
2024/09/04 10:54:04 VM-0 failed reading regs: dial tcp 127.0.0.1:41077: connect: connection refused
2024/09/04 10:54:04 Stack frames at BUG: unexpected stop:
2024/09/04 10:54:04 Level: 0: 1611238748, /root/kcov.c : __sanitizer_cov_trace_pc : 71 : 
2024/09/04 10:54:04 Level: 1: 1611471932, /root/rtthread/rt-thread/src/mem.c : rt_smem_alloc : 282 : 
2024/09/04 10:54:04 Level: 2: 1611468880, /root/rtthread/rt-thread/src/kservice.c : rt_malloc : 686 : 
2024/09/04 10:54:04 Level: 3: 1611165704, /root/rtthread/rt-thread/components/net/sal/socket/net_sockets.c : socket : 234 : 
2024/09/04 10:54:04 Level: 4: 1611220832, /root/rtthread/rt-thread/bsp/qemu-vexpress-a9/applications/common_freertos.h : syz_create_bind_socket : 896 : 

I would greatly appreciate it if you could kindly inform me of any mistakes in the previous issues.

Other additional context

No response

Other additional context

No response

Reproduce the timeout with the provided QEMU vexpress-a9 command and syz_create_bind_socket case. Trace the path from components/net/sal/socket/net_sockets.c:234 through src/kservice.c:686 into src/mem.c:282, then determine why allocation fails or hangs. Done means the reproducer completes without the reported timeout and the relevant allocation behavior is covered by a regression test or documented verification.