CVSROOT: /cvs
Module name: src
Changes by: v...@cvs.openbsd.org 2022/06/27 07:35:21
Modified files:
sys/kern : kern_event.c
sys/sys : eventvar.h
Log message:
kqueue: Clear task when closing kqueue
When closing a kqueue, block until any pending wakeup task has finished.
Otherwise, if a pending task progressed slowly, the kqueue could stay
alive longer than the associated file descriptor table, causing
a use-after-free in KQRELE().
This also fixes a failed assertion "p->p_kq->kq_refcnt.r_refs == 1" in
kqpoll_exit().
The use-after-free bug had existed since the introduction of
kqueue_task() (the bug could occur if fdplock() blocked in KQRELE()).
However, the issue became worse when the task was allowed to run without
the kernel lock in sys/kern/kern_event.c r1.187.
Prompted by a report from Mikhail on bugs@.
OK mpi@
Reported-by: syzbot+fca7e4fa773c90886...@syzkaller.appspotmail.com
