condvar: Fix a user-after-free in _cv_wait() when ktrace is enabled

[markj]

Summary

When a thread wakes up after sleeping on a CV, it must not dereference
the CV structure, as it may already have been freed. At least ZFS
relies on this invariant, see commit
c636f94bd2ff15be5b904939872b4bce31456c18 for example.

Thus, when logging context-switch events, copy the wmesg into a stack
buffer while it is still safe to do so, and log that after waking up.

Reported by: syzkaller

[kib]

sys/kern/kern_condvar.c

216

This code has the same issue?

279

And this and several other functions below

[markj]

Update all of the _cv_wait* variants.

Move the initial ktrcsw() call later, after assertions and special cases are
checked.

[kib]

sys/kern/kern_condvar.c

144