Harden sys_getaddrinfo user-pointer handling for nested ai_addr writes

[Copilot]

sys_getaddrinfo only validated the top-level user res buffer, then dereferenced res->ai_addr directly and wrote through that nested pointer in kernel context. In Smart/MMU builds, this allowed a user-controlled nested pointer to redirect kernel writes outside validated user memory.

• Copy user inputs into kernel temporaries

  • Copy res and hints into kernel-owned musl_addrinfo structs before consuming their fields.
  • Stop reading nested fields directly from user memory after the initial copy.

• Validate and isolate the nested output pointer

  • Extract res->ai_addr from the copied res.
  • Reject inaccessible nested destinations under ARCH_MM_MMU before any writeback.

• Use user-copy helpers for all kernel-to-user writes

  • Convert the returned sockaddr into a kernel musl_sockaddr temporary.
  • Write the nested socket address back with lwp_put_to_user(...) instead of writing through the user pointer directly.
  • Write the final outer musl_addrinfo back with lwp_put_to_user(...).

• Preserve existing syscall result semantics

  • Keep the existing hints-derived ai_socktype / ai_protocol behavior.
  • Ensure newly added error paths release sal_getaddrinfo() results correctly.

Example of the hardened flow:

if (lwp_get_from_user(&k_res_musl, (void *)res, sizeof(k_res_musl)) != sizeof(k_res_musl))
    return -EFAULT;

u_res_ai_addr = k_res_musl.ai_addr;

if (u_res_ai_addr && !lwp_user_accessable((void *)u_res_ai_addr, sizeof(struct musl_sockaddr)))
    return -EFAULT;

sockaddr_tomusl(k_res->ai_addr, &k_sockaddr_musl);

if (lwp_put_to_user(u_res_ai_addr, &k_sockaddr_musl, sizeof(k_sockaddr_musl)) != sizeof(k_sockaddr_musl))
    return -EFAULT;

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[github-actions]

📌 Code Review Assignment

🏷️ Tag: components

Reviewers: @Maihuanyi

Changed Files (Click to expand)

• components/lwp/lwp_syscall.c

🏷️ Tag: components_lwp

Reviewers: @xu18838022837

Changed Files (Click to expand)

• components/lwp/lwp_syscall.c

---

📊 Current Review Status (Last Updated: 2026-09-10 09:27 CST)

• ⌛ @Maihuanyi Pending Review
• ⌛ @xu18838022837 Pending Review

---

📝 Review Instructions

1. 维护者可以通过单击此处来刷新审查状态: 🔄 刷新状态
   Maintainers can refresh the review status by clicking here: 🔄 Refresh Status

2. 确认审核通过后评论 LGTM/lgtm
   Comment LGTM/lgtm after confirming approval

3. PR合并前需至少一位维护者确认
   PR must be confirmed by at least one maintainer before merging

ℹ️ 刷新CI状态操作需要具备仓库写入权限。
ℹ️ Refresh CI status operation requires repository Write permission.

[github-actions]

👋 感谢您对 RT-Thread 的贡献！Thank you for your contribution to RT-Thread!

为确保代码符合 RT-Thread 的编码规范，请在你的仓库中执行以下步骤运行代码格式化工作流（如果格式化CI运行失败）。
To ensure your code complies with RT-Thread's coding style, please run the code formatting workflow by following the steps below (If the formatting of CI fails to run).

---

🛠 操作步骤 | Steps

1. 前往 Actions 页面 | Go to the Actions page
   点击进入工作流 → | Click to open workflow →

2. 点击 Run workflow | Click Run workflow

• Use workflow from 保持默认分支（通常为 master）
  Keep the default branch (usually master) in Use workflow from
• 在 branch 输入框填写 PR 分支 copilot/fix-sys-getaddrinfo-bug
  Enter PR branch copilot/fix-sys-getaddrinfo-bug in the branch field
• 设置需排除的文件/目录（目录请以"/"结尾）
  Set files/directories to exclude (directories should end with "/")

3. 等待工作流完成 | Wait for the workflow to complete
   格式化后的代码将作为独立提交推送至你的分支。
   The formatting changes will be pushed to your branch as a separate commit.

完成后，提交将自动更新至 copilot/fix-sys-getaddrinfo-bug 分支，关联的 Pull Request 也会同步更新。
Once completed, commits will be pushed to the copilot/fix-sys-getaddrinfo-bug branch automatically, and the related Pull Request will be updated.

如有问题欢迎联系我们，再次感谢您的贡献！💐
If you have any questions, feel free to reach out. Thanks again for your contribution!

[github-actions]

MemBrowse Memory Report

k230

• SRAM: .eh_frame +24 B (+0.0%, 1,128,531 B / 268,300,288 B, total: 0% used)
  No memory changes detected for:
• at32f415-start
• esp32-c3
• gd32105r-start
• hc32f334
• hpmicro-hpm5301evklite
• infineon-psoc6
• loongson-ls1cdev
• nordic-nrf51822
• nuvoton-m487
• nxp-lpc1114
• qemu-virt64-aarch64
• raspberry-pico-rp2040
• renesas-ra2l1
• simulator
• stm32f407-rt-spark
• stm32l475-atk-pandora-llvm
• wch-ch32v208w-r0
• x86
• xuantie-e901plus