From dc2df9f71c3caaa89801d5a855853875ddbebf18 Mon Sep 17 00:00:00 2001
From: visa <visa@openbsd.org>
Date: Thu, 6 Jul 2023 10:16:58 +0000
Subject: [PATCH] Clear knotes when finishing wseventvar

When finishing a wseventvar in wsevent_fini(), clear the klist.
Otherwise knotes can be left dangling, which can crash the kernel.

In general, klist_invalidate() should happen after vdevgone() in order
to avoid a race with kevent registration. However, the current wscons
drivers clear the wsevent pointer (sc->sc_base.me_evp) before calling
wsevent_fini(). This prevents the drivers from registering new kevents.

Prompted by a report by Peter J. Philipp on bugs@

OK mvs@ miod@
---
 sys/dev/wscons/wsevent.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/sys/dev/wscons/wsevent.c b/sys/dev/wscons/wsevent.c
index 89ff7840601..37dc66bc72d 100644
--- a/sys/dev/wscons/wsevent.c
+++ b/sys/dev/wscons/wsevent.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: wsevent.c,v 1.26 2022/07/02 08:50:42 visa Exp $ */
+/* $OpenBSD: wsevent.c,v 1.27 2023/07/06 10:16:58 visa Exp $ */
 /* $NetBSD: wsevent.c,v 1.16 2003/08/07 16:31:29 agc Exp $ */
 
 /*
@@ -134,6 +134,8 @@ wsevent_fini(struct wseventvar *ev)
 	free(ev->q, M_DEVBUF, WSEVENT_QSIZE * sizeof(struct wscons_event));
 	ev->q = NULL;
 
+	klist_invalidate(&ev->sel.si_note);
+
 	sigio_free(&ev->sigio);
 }
 
-- 
2.20.1