kqueue: Clear task when closing kqueue

kqueue: Clear task when closing kqueue

When closing a kqueue, block until any pending wakeup task has finished.
Otherwise, if a pending task progressed slowly, the kqueue could stay
alive longer than the associated file descriptor table, causing
a use-after-free in KQRELE().

This also fixes a failed assertion "p->p_kq->kq_refcnt.r_refs == 1" in
kqpoll_exit().

The use-after-free bug had existed since the introduction of
kqueue_task() (the bug could occur if fdplock() blocked in KQRELE()).
However, the issue became worse when the task was allowed to run without
the kernel lock in sys/kern/kern_event.c r1.187.

Prompted by a report from Mikhail on bugs@.

OK mpi@

Reported-by: syzbot+fca7e4fa773c90886819@syzkaller.appspotmail.com