Mark Johnston 2cca77ee01 kqueue timer: Remove detached knotes from the process stop queue
There are some scenarios where a timer event may be detached when it is
on the process' kqueue timer stop queue.  If kqtimer_proc_continue() is
called after that point, it will iterate over the queue and access freed
timer structures.

It is also possible, at least in a multithreaded program, for a stopped
timer event to be scheduled without removing it from the process' stop
queue.  Ensure that we do not doubly enqueue the event structure in this
case.

Reported by:	syzbot+cea0931bb4e34cd728bd@syzkaller.appspotmail.com
Reported by:	syzbot+9e1a2f3734652015998c@syzkaller.appspotmail.com
Reviewed by:	kib
MFC after:	1 week
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D30251
2021-05-14 10:08:14 -04:00
..
2020-02-26 16:22:28 +00:00
2021-01-02 19:57:58 -07:00
2020-10-05 15:54:19 +00:00
2020-11-19 02:50:48 +00:00
2021-04-13 17:42:21 -04:00
2021-04-18 11:14:17 -06:00
2020-12-04 18:56:44 +00:00
2021-04-18 11:19:15 -06:00
2021-04-12 11:42:21 -03:00
2021-05-03 19:18:26 +03:00
2021-04-18 11:14:17 -06:00
2021-05-05 12:32:13 -06:00
2021-05-03 19:13:47 +03:00
2021-04-21 15:37:24 -06:00
2020-11-05 15:08:56 +00:00
2018-10-12 00:32:45 +00:00
2020-11-09 00:34:23 +00:00
2020-08-13 20:48:14 +00:00
2021-04-02 15:41:51 +03:00
2019-02-20 09:38:19 +00:00
2021-05-03 19:13:47 +03:00
2020-12-01 16:06:31 +00:00
2021-04-07 14:33:02 -04:00
2020-01-12 23:52:16 +00:00
2021-05-03 19:18:26 +03:00
2021-04-18 11:14:17 -06:00
2020-08-27 05:11:15 +00:00
2021-04-15 12:48:24 +03:00
2021-04-13 17:42:20 -04:00
2021-04-18 11:19:15 -06:00
2021-04-18 11:19:15 -06:00