timerfd: kernel random crash due to race condition to access the timerfd list

[weike.chen_dell.com]

Summary

Add locker while add/remove/read the timerfd list.

[dchagin]

https://cgit.freebsd.org/src/commit/sys/kern/sys_timerfd.c?id=02f534b57f84d6f4f97c337b05b383c8b3aaf18c

btw, do you have a reproducer? I assume that it is sufficient to use the CK_LIST without locking

[dchagin]

In D41982#957204, @dchagin wrote:

https://cgit.freebsd.org/src/commit/sys/kern/sys_timerfd.c?id=02f534b57f84d6f4f97c337b05b383c8b3aaf18c

btw, do you have a reproducer? I assume that it is sufficient to use the CK_LIST without locking

^^^^^^

ah, never mind, CK is not lock free

[imp]

sys/kern/sys_timerfd.c

62

where do you initialize this lock?

[imp]

sys/kern/sys_timerfd.c

62

Ah, never mind, I see that's the next line.

[imp]

I'm confused... this has actually already been committed.

[weike.chen_dell.com]

In D41982#957755, @imp wrote:

I'm confused... this has actually already been committed.

Yes, I see: https://cgit.freebsd.org/src/commit/sys/kern/sys_timerfd.c?id=02f534b57f84d6f4f97c337b05b383c8b3aaf18c. But it looks like this commit hasn't been merged to releng/14.0 yet.

[emaste]

Was merged to releng/14.0 in fcafa24531021555976b4945d9c58667c0f75ca2