git: eab97e63f4df - stable/15 - kqueue: avoid closing a file under the knlist lock

The branch stable/15 has been updated by kib:

URL: https://cgit.FreeBSD.org/src/commit/?id=eab97e63f4dfa24a251bf23165059a2aa7f0ccf1

commit eab97e63f4dfa24a251bf23165059a2aa7f0ccf1
Author:     Abdelkader Boudih <[email protected]>
AuthorDate: 2026-08-07 22:57:07 +0000
Commit:     Konstantin Belousov <[email protected]>
CommitDate: 2026-08-16 02:41:16 +0000

    kqueue: avoid closing a file under the knlist lock
    
    (cherry picked from commit 4c4bad4421fb1a300178767f71215cc5f5e0bfb6)
---
 sys/kern/kern_event.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/sys/kern/kern_event.c b/sys/kern/kern_event.c
index 3990c2366ab4..62c449e59f68 100644
--- a/sys/kern/kern_event.c
+++ b/sys/kern/kern_event.c
@@ -2793,6 +2793,7 @@ knlist_cleardel(struct knlist *knl, struct thread *td, int islocked, int killkn)
 {
 	struct knote *kn, *kn2;
 	struct kqueue *kq;
+	bool dropped;
 
 	KASSERT(!knl->kl_autodestroy, ("cleardel for autodestroy %p", knl));
 	if (islocked)
@@ -2809,6 +2810,7 @@ knlist_cleardel(struct knlist *knl, struct thread *td, int islocked, int killkn)
 		 * freed or converted to one-shot, as the attached subject is
 		 * essentially disappearing.
 		 */
+		dropped = false;
 		SLIST_FOREACH_SAFE(kn, &knl->kl_list, kn_selnext, kn2) {
 			kq = kn->kn_kq;
 			KQ_LOCK(kq);
@@ -2820,7 +2822,11 @@ knlist_cleardel(struct knlist *knl, struct thread *td, int islocked, int killkn)
 			if (killkn) {
 				kn_enter_flux(kn);
 				KQ_UNLOCK(kq);
+				knl->kl_unlock(knl->kl_lockarg);
 				knote_drop_detached(kn, td);
+				knl->kl_lock(knl->kl_lockarg);
+				dropped = true;
+				break;
 			} else {
 				/* Make sure cleared knotes disappear soon */
 				kn->kn_flags |= EV_EOF | EV_ONESHOT;
@@ -2828,6 +2834,8 @@ knlist_cleardel(struct knlist *knl, struct thread *td, int islocked, int killkn)
 			}
 			kq = NULL;
 		}
+		if (dropped)
+			continue;
 
 		if (SLIST_EMPTY(&knl->kl_list))
 			break;