setitimer: Fix exit race

[markj]

Summary

We use the p_itcallout callout, interlocked by the proc lock, to
schedule timeouts for the setitimer(2) system call. When a process
exits, the callout must be stopped.

Currently we attempt to stop the callout in exit1() with the call
_callout_stop_safe(&p->p_itcallout, CS_EXECUTING). If this call returns
0, then we sleep in order to drain the callout. However, this happens
only if the callout is not scheduled at all. If the callout thread is
blocked on the proc lock, then exit1() will not block and the callout
may execute after the process has fully exited, typically resulting in a
panic.

I cannot see a reason to use the CS_EXECUTING flag here. Instead, use
the regular callout_stop()/callout_drain() dance to halt the callout.

Reported by: ler
Tested by: pho

[glebius]

Thanks for understanding that! I scratched my head a lot around it. ler@'s panics were definitely attributed to CS_EXECUTING, since it is the only place in kernel where the flag is used and the callout(9) proved to be stable in the last years.