There are some scenarios where a timer event may be detached when it is
on the process' kqueue timer stop queue. If kqtimer_proc_continue() is
called after that point, it will iterate over the queue and access freed
Suppose a process has a periodic timer running. Here are a couple of
- The process is killed by the OOM killer, so timer events are placed on the process queue (because we check for P_KILLED()). The process closes its fds, so knotes are detached and elements on the queue are freed but not removed. Later during exit1() it is possible for a signal to be raised against the process (e.g., if a resource limit is exceeded), in which case kqtimer_proc_continue() is called.
- fork_norfproc() suspends all other threads in the process, and in this case we will suspend timers too. Then it may free all fds in the process' table, but the process queue is not initialized.