kern/108201: MOKB testcase for kqueue can cause kernel panic

[Craig Rodrigues]

>Number:         108201
>Category:       kern
>Synopsis:       MOKB testcase for kqueue can cause kernel panic
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Mon Jan 22 06:40:17 GMT 2007
>Closed-Date:
>Last-Modified:
>Originator:     Craig Rodrigues
>Release:        CURRENT
>Organization:
>Environment:
FreeBSD 7.0-CURRENT FreeBSD 7.0-CURRENT #35: Sun Jan 21 23:32:23 EST 2007
>Description:
The attached testcase from "Month of Kernel Bugs"
 http://projects.info-pull.com/mokb/MOKB-24-11-2006.html

causes the following panic on my system:

panic: mutex kqueue own at /usr/src/sys/kern/kern_event.c: 1069

I cannot get a proper gdb backtrace.  The ddb stack trace looks like:

kqueue_expand()
kqueue_register()
filt_proc()
knote()
fork()
fork()
syscall()
>How-To-Repeat:

>Fix:


Patch attached with submission follows:

/*
 *  Obtained from:
 *  http://projects.info-pull.com/mokb/MOKB-24-11-2006.html
 */

#include <sys/types.h>
#include <sys/event.h>
#include <sys/time.h>
#include <stdio.h>
#include <unistd.h>

int main(void) {
	struct kevent ke;
	int kq;

	kq = kqueue();
	
	EV_SET(&ke, getpid(), EVFILT_PROC, EV_ADD,
	    NOTE_EXIT|NOTE_EXEC|NOTE_TRACK, 0, NULL);
	
	kevent(kq, &ke, 1, NULL, 0, NULL);

	if (fork() != 0)
		kevent(kq, NULL, 0, &ke, 1, NULL);

	return (0);
}

>Release-Note:
>Audit-Trail:
>Unformatted: