kqueue timer: Remove detached knotes from the process stop queue

[markj]

Summary

There are some scenarios where a timer event may be detached when it is
on the process' kqueue timer stop queue. If kqtimer_proc_continue() is
called after that point, it will iterate over the queue and access freed
timer structures.

Suppose a process has a periodic timer running. Here are a couple of
problematic scenarios:

• The process is killed by the OOM killer, so timer events are placed on the process queue (because we check for P_KILLED()). The process closes its fds, so knotes are detached and elements on the queue are freed but not removed. Later during exit1() it is possible for a signal to be raised against the process (e.g., if a resource limit is exceeded), in which case kqtimer_proc_continue() is called.
• fork_norfproc() suspends all other threads in the process, and in this case we will suspend timers too. Then it may free all fds in the process' table, but the process queue is not initialized.

[kib]

sys/kern/kern_event.c

869

Do you need to clear the flag there as well? I think it is safer to do, even if the timer cannot be reached by p_kqtim_stop iteration.

[markj]

sys/kern/kern_event.c

869

kc is freed immediately after this, so a thread holding a reference to it would perform a use-after-free. Do you see some need for reference counting?

[kib]

sys/kern/kern_event.c

869

No, I misread the code. I do not think that so far kc's need refcounting.

[markj]

Handle double enqueues as well. It is possible for a timer event to be on the
suspend queue, and before it is removed, another running thread can force the
callout to be rescheduled with kevent().