Created attachment 268006 [details] demonstration code Hello, A single-threaded process that creates two independent kqueue() objects, each with an EVFILT_TIMER event, will cause a hard kernel lockup when run in a debugger (gdb or lldb), interrupted, then exiting the debugger. I am seeing this on amd64 and arm64, FreeBSD 14.3 and 15.0. I do not need root access. To reproduce (using the attached test.c): gcc -O0 -g -o test test.c gdb ./test > r Ctrl + C to interrupt > q Debugger will ask if you are sure you want to quit (y/N) - answer y At this point the system locks up hard (to the point where, when running under vmware or qemu, the vm cannot be shutdown gracefully and the vm container must be killed). I can still ping the box but attempts to ssh in fail. Running shutdown on the console also fails.
https://reviews.freebsd.org/D55264
A commit in branch main references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=75a30ea09f4e75480743fae5c2369d50a6d8526c commit 75a30ea09f4e75480743fae5c2369d50a6d8526c Author: Konstantin Belousov <kib@FreeBSD.org> AuthorDate: 2026-02-12 20:24:13 +0000 Commit: Konstantin Belousov <kib@FreeBSD.org> CommitDate: 2026-02-13 15:46:41 +0000 filt_timerexpire_l(): re-insert restarted timer into head instead of tail of the resumed timers list, so that kqtimer_proc_continue() does not iterated into the same timer again. PR: 293141 Reviewed by: markj Sponsored by: The FreeBSD Foundation MFC after: 3 days Differential revision: https://reviews.freebsd.org/D55264 sys/kern/kern_event.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
A commit in branch main references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=e7f86f8b1383d278fff1d973230972325072ead6 commit e7f86f8b1383d278fff1d973230972325072ead6 Author: Konstantin Belousov <kib@FreeBSD.org> AuthorDate: 2026-02-13 15:32:40 +0000 Commit: Konstantin Belousov <kib@FreeBSD.org> CommitDate: 2026-02-13 15:46:41 +0000 kqtimer_proc_continue(): correct calculation of 'now' It must be sbinuptime(), this is how kc->next is set up. PR: 293141 Noted and reviewed by: markj Sponsored by: The FreeBSD Foundation MFC after: 3 days Differential revision: https://reviews.freebsd.org/D55264 sys/kern/kern_event.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
A commit in branch stable/15 references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=71cc31c18d1e92840920a344937f2889ca94d08b commit 71cc31c18d1e92840920a344937f2889ca94d08b Author: Konstantin Belousov <kib@FreeBSD.org> AuthorDate: 2026-02-13 15:32:40 +0000 Commit: Konstantin Belousov <kib@FreeBSD.org> CommitDate: 2026-02-16 06:13:59 +0000 kqtimer_proc_continue(): correct calculation of 'now' PR: 293141 (cherry picked from commit e7f86f8b1383d278fff1d973230972325072ead6) sys/kern/kern_event.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
A commit in branch stable/15 references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=22bf122dceb73f194c258b32d657088e3e02fe3b commit 22bf122dceb73f194c258b32d657088e3e02fe3b Author: Konstantin Belousov <kib@FreeBSD.org> AuthorDate: 2026-02-12 20:24:13 +0000 Commit: Konstantin Belousov <kib@FreeBSD.org> CommitDate: 2026-02-16 06:13:59 +0000 filt_timerexpire_l(): re-insert restarted timer into head instead of tail PR: 293141 (cherry picked from commit 75a30ea09f4e75480743fae5c2369d50a6d8526c) sys/kern/kern_event.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
A commit in branch stable/14 references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=cf941029dd0291c8b685aa3f6d7872371e6136b9 commit cf941029dd0291c8b685aa3f6d7872371e6136b9 Author: Konstantin Belousov <kib@FreeBSD.org> AuthorDate: 2026-02-13 15:32:40 +0000 Commit: Konstantin Belousov <kib@FreeBSD.org> CommitDate: 2026-02-16 06:19:30 +0000 kqtimer_proc_continue(): correct calculation of 'now' PR: 293141 (cherry picked from commit e7f86f8b1383d278fff1d973230972325072ead6) sys/kern/kern_event.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
A commit in branch stable/14 references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=119af90d483aee79bf549b3d63e1093bb59e1092 commit 119af90d483aee79bf549b3d63e1093bb59e1092 Author: Konstantin Belousov <kib@FreeBSD.org> AuthorDate: 2026-02-12 20:24:13 +0000 Commit: Konstantin Belousov <kib@FreeBSD.org> CommitDate: 2026-02-16 06:19:30 +0000 filt_timerexpire_l(): re-insert restarted timer into head instead of tail PR: 293141 (cherry picked from commit 75a30ea09f4e75480743fae5c2369d50a6d8526c) sys/kern/kern_event.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
A commit in branch releng/14.4 references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=37fa2e7695818d4da269a24e2de1a653828947dd commit 37fa2e7695818d4da269a24e2de1a653828947dd Author: Konstantin Belousov <kib@FreeBSD.org> AuthorDate: 2026-02-12 20:24:13 +0000 Commit: Colin Percival <cperciva@FreeBSD.org> CommitDate: 2026-02-18 01:47:15 +0000 filt_timerexpire_l(): re-insert restarted timer into head instead of tail PR: 293141 (cherry picked from commit 75a30ea09f4e75480743fae5c2369d50a6d8526c) (cherry picked from commit 119af90d483aee79bf549b3d63e1093bb59e1092) sys/kern/kern_event.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
A commit in branch releng/14.4 references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=39dd0d8a0d6929aa62191b616614135474e382d6 commit 39dd0d8a0d6929aa62191b616614135474e382d6 Author: Konstantin Belousov <kib@FreeBSD.org> AuthorDate: 2026-02-13 15:32:40 +0000 Commit: Colin Percival <cperciva@FreeBSD.org> CommitDate: 2026-02-18 01:47:15 +0000 kqtimer_proc_continue(): correct calculation of 'now' PR: 293141 (cherry picked from commit e7f86f8b1383d278fff1d973230972325072ead6) (cherry picked from commit cf941029dd0291c8b685aa3f6d7872371e6136b9) sys/kern/kern_event.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)