From ea020a4eae8baf04b969d7feffe9345dc3b1d115 Mon Sep 17 00:00:00 2001
From: Ville Juven <ville.juven@unikie.com>
Date: Tue, 17 Dec 2024 16:04:52 +0200
Subject: [PATCH] sem_holder.c: Replace addrenv_select with kmm_map for holder
 sem access

The holder list can be modified via interrupt so using addrenv_select is
not safe. Access the semaphore by mapping it into kernel virtual memory
instead.
---
 sched/semaphore/sem_holder.c | 26 +++++++++-----------------
 1 file changed, 9 insertions(+), 17 deletions(-)

diff --git a/sched/semaphore/sem_holder.c b/sched/semaphore/sem_holder.c
index ebd6578d9f..8e51d6cf31 100644
--- a/sched/semaphore/sem_holder.c
+++ b/sched/semaphore/sem_holder.c
@@ -30,8 +30,8 @@
 #include <assert.h>
 #include <debug.h>
 
-#include <nuttx/addrenv.h>
 #include <nuttx/arch.h>
+#include <nuttx/mm/kmap.h>
 
 #include "sched/sched.h"
 #include "semaphore/semaphore.h"
@@ -98,6 +98,10 @@ nxsem_allocholder(FAR sem_t *sem, FAR struct tcb_s *htcb)
       PANIC();
     }
 
+#ifdef CONFIG_MM_KMAP
+  sem = kmm_map_user(this_task(), sem, sizeof(*sem));
+#endif
+
   pholder->sem    = sem;
   pholder->htcb   = htcb;
   pholder->counts = 0;
@@ -194,6 +198,10 @@ static inline void nxsem_freeholder(FAR sem_t *sem,
         }
     }
 
+#ifdef CONFIG_MM_KMAP
+  kmm_unmap(pholder->sem);
+#endif
+
   /* Release the holder and counts */
 
   pholder->tlink  = NULL;
@@ -398,15 +406,6 @@ static void nxsem_restore_priority(FAR struct tcb_s *htcb)
     {
       FAR struct semholder_s *pholder;
 
-#ifdef CONFIG_ARCH_ADDRENV
-      FAR struct addrenv_s *oldenv;
-
-      if (htcb->addrenv_own)
-        {
-          addrenv_select(htcb->addrenv_own, &oldenv);
-        }
-#endif
-
       /* Try to find the highest priority across all the threads that are
        * waiting for any semaphore held by htcb.
        */
@@ -424,13 +423,6 @@ static void nxsem_restore_priority(FAR struct tcb_s *htcb)
             }
         }
 
-#ifdef CONFIG_ARCH_ADDRENV
-      if (htcb->addrenv_own)
-        {
-          addrenv_restore(oldenv);
-        }
-#endif
-
       /* Apply the selected priority to the thread (hopefully back to the
        * threads base_priority).
        */