Normally, process already has all its kqueue fds destroyed at the moment p_klist is detached in exit flow. But, if the process was created with rfork(2) with shared file descriptors, its signal knotes can survive. Then, knlist_detach() does not destroy non-empty knlist. Later, when owning kqueue is closed, we access freed (or rather, reused, because struct proc is type-stable) memory by referencing p->p_klist from such knote. Handle this situation by deleting all knotes hanging from p_klist. PR: 275286
Details
Details
Diff Detail
Diff Detail
- Repository
- rG FreeBSD src repository
- Lint
Lint Not Applicable - Unit
Tests Not Applicable