Module Name: src
Committed By: riastradh
Date: Sat Mar 12 17:45:53 UTC 2022
Modified Files:
src/sys/kern: kern_ktrace.c
Log Message:
ktrace(9): Avoid stomping over colliding KTROP_SET.
Reported-by: syzbot+1e2a24aaa5725cab1...@syzkaller.appspotmail.com
Reported-by: syzbot+3f89dc33fa3020fab...@syzkaller.appspotmail.com
Reported-by: syzbot+44898c094ce209759...@syzkaller.appspotmail.com
Reported-by: syzbot+99826cb4b0494bfbb...@syzkaller.appspotmail.com
Reported-by: syzbot+a7c4752dc308936c4...@syzkaller.appspotmail.com
Reported-by: syzbot+c062464baf148ed5f...@syzkaller.appspotmail.com
Reported-by: syzbot+dfa19489edc185f94...@syzkaller.appspotmail.com
Reported-by: syzbot+e2c4a8195d3ad8434...@syzkaller.appspotmail.com
Reported-by: syzbot+f31927b2905188fdd...@syzkaller.appspotmail.com
To generate a diff of this commit:
cvs rdiff -u -r1.178 -r1.179 src/sys/kern/kern_ktrace.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/kern/kern_ktrace.c
diff -u src/sys/kern/kern_ktrace.c:1.178 src/sys/kern/kern_ktrace.c:1.179
--- src/sys/kern/kern_ktrace.c:1.178 Sat Feb 27 13:02:42 2021
+++ src/sys/kern/kern_ktrace.c Sat Mar 12 17:45:53 2022
@@ -1,4 +1,4 @@
-/* $NetBSD: kern_ktrace.c,v 1.178 2021/02/27 13:02:42 simonb Exp $ */
+/* $NetBSD: kern_ktrace.c,v 1.179 2022/03/12 17:45:53 riastradh Exp $ */
/*-
* Copyright (c) 2006, 2007, 2008, 2020 The NetBSD Foundation, Inc.
@@ -61,7 +61,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: kern_ktrace.c,v 1.178 2021/02/27 13:02:42 simonb Exp $");
+__KERNEL_RCSID(0, "$NetBSD: kern_ktrace.c,v 1.179 2022/03/12 17:45:53 riastradh Exp $");
#include <sys/param.h>
#include <sys/systm.h>
@@ -1396,7 +1396,11 @@ ktrace_thread(void *arg)
mutex_enter(&ktrace_lock);
}
- TAILQ_REMOVE(&ktdq, ktd, ktd_list);
+ if (ktd_lookup(ktd->ktd_fp) == ktd) {
+ TAILQ_REMOVE(&ktdq, ktd, ktd_list);
+ } else {
+ /* nothing, collision in KTROP_SET */
+ }
callout_halt(&ktd->ktd_wakch, &ktrace_lock);
callout_destroy(&ktd->ktd_wakch);
