[src/trunk]: src/sys/kern ktrace(9): Avoid stomping over colliding KTROP_SET.

[riastradh <riastradh%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/5fd7678b395a
branches:  trunk
changeset: 363447:5fd7678b395a
user:      riastradh <riastradh%NetBSD.org@localhost>
date:      Sat Mar 12 17:45:53 2022 +0000

description:
ktrace(9): Avoid stomping over colliding KTROP_SET.

Reported-by: syzbot+1e2a24aaa5725cab16e1%syzkaller.appspotmail.com@localhost
Reported-by: syzbot+3f89dc33fa3020fab1c4%syzkaller.appspotmail.com@localhost
Reported-by: syzbot+44898c094ce209759d53%syzkaller.appspotmail.com@localhost
Reported-by: syzbot+99826cb4b0494bfbb828%syzkaller.appspotmail.com@localhost
Reported-by: syzbot+a7c4752dc308936c48b2%syzkaller.appspotmail.com@localhost
Reported-by: syzbot+c062464baf148ed5f192%syzkaller.appspotmail.com@localhost
Reported-by: syzbot+dfa19489edc185f94b0a%syzkaller.appspotmail.com@localhost
Reported-by: syzbot+e2c4a8195d3ad84342dc%syzkaller.appspotmail.com@localhost
Reported-by: syzbot+f31927b2905188fddc22%syzkaller.appspotmail.com@localhost

diffstat:

 sys/kern/kern_ktrace.c |  10 +++++++---
 1 files changed, 7 insertions(+), 3 deletions(-)

diffs (31 lines):

diff -r 28dec07c83c8 -r 5fd7678b395a sys/kern/kern_ktrace.c
--- a/sys/kern/kern_ktrace.c    Sat Mar 12 17:36:14 2022 +0000
+++ b/sys/kern/kern_ktrace.c    Sat Mar 12 17:45:53 2022 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: kern_ktrace.c,v 1.178 2021/02/27 13:02:42 simonb Exp $ */
+/*     $NetBSD: kern_ktrace.c,v 1.179 2022/03/12 17:45:53 riastradh Exp $      */
 
 /*-
  * Copyright (c) 2006, 2007, 2008, 2020 The NetBSD Foundation, Inc.
@@ -61,7 +61,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: kern_ktrace.c,v 1.178 2021/02/27 13:02:42 simonb Exp $");
+__KERNEL_RCSID(0, "$NetBSD: kern_ktrace.c,v 1.179 2022/03/12 17:45:53 riastradh Exp $");
 
 #include <sys/param.h>
 #include <sys/systm.h>
@@ -1396,7 +1396,11 @@
                mutex_enter(&ktrace_lock);
        }
 
-       TAILQ_REMOVE(&ktdq, ktd, ktd_list);
+       if (ktd_lookup(ktd->ktd_fp) == ktd) {
+               TAILQ_REMOVE(&ktdq, ktd, ktd_list);
+       } else {
+               /* nothing, collision in KTROP_SET */
+       }
 
        callout_halt(&ktd->ktd_wakch, &ktrace_lock);
        callout_destroy(&ktd->ktd_wakch);