2 files changed, 53 insertions, 20 deletions

diff --git a/sys/compat/linprocfs/linprocfs.c b/sys/compat/linprocfs/linprocfs.c
index cd21e8b0c359..a51c4f004d33 100644
--- a/sys/compat/linprocfs/linprocfs.c
+++ b/sys/compat/linprocfs/linprocfs.c
@@ -269,8 +269,7 @@ linprocfs_docpuinfo(PFS_FILL_ARGS)
 		/* XXX per-cpu vendor / class / model / id? */
 	}
 
-	sbuf_cat(sb,
-	    "flags\t\t:");
+	sbuf_cat(sb, "flags\t\t:");
 
 	if (!strcmp(cpu_vendor, "AuthenticAMD") && (class < 6)) {
 		flags[16] = "fcmov";
@@ -870,10 +869,12 @@ static int
 linprocfs_doprocmaps(PFS_FILL_ARGS)
 {
 	vm_map_t map = &p->p_vmspace->vm_map;
-	vm_map_entry_t entry;
+	vm_map_entry_t entry, tmp_entry;
 	vm_object_t obj, tobj, lobj;
-	vm_offset_t saved_end;
+	vm_offset_t e_start, e_end;
 	vm_ooffset_t off = 0;
+	vm_prot_t e_prot;
+	unsigned int last_timestamp;
 	char *name = "", *freename = NULL;
 	ino_t ino;
 	int ref_count, shadow_count, flags;
@@ -899,7 +900,9 @@ linprocfs_doprocmaps(PFS_FILL_ARGS)
 		freename = NULL;
 		if (entry->eflags & MAP_ENTRY_IS_SUB_MAP)
 			continue;
-		saved_end = entry->end;
+		e_prot = entry->protection;
+		e_start = entry->start;
+		e_end = entry->end;
 		obj = entry->object.vm_object;
 		for (lobj = tobj = obj; tobj; tobj = tobj->backing_object) {
 			VM_OBJECT_LOCK(tobj);
@@ -907,6 +910,8 @@ linprocfs_doprocmaps(PFS_FILL_ARGS)
 				VM_OBJECT_UNLOCK(lobj);
 			lobj = tobj;
 		}
+		last_timestamp = map->timestamp;
+		vm_map_unlock_read(map);
 		ino = 0;
 		if (lobj) {
 			off = IDX_TO_OFF(lobj->size);
@@ -944,10 +949,10 @@ linprocfs_doprocmaps(PFS_FILL_ARGS)
 		 */
 		error = sbuf_printf(sb,
 		    "%08lx-%08lx %s%s%s%s %08lx %02x:%02x %lu%s%s\n",
-		    (u_long)entry->start, (u_long)entry->end,
-		    (entry->protection & VM_PROT_READ)?"r":"-",
-		    (entry->protection & VM_PROT_WRITE)?"w":"-",
-		    (entry->protection & VM_PROT_EXECUTE)?"x":"-",
+		    (u_long)e_start, (u_long)e_end,
+		    (e_prot & VM_PROT_READ)?"r":"-",
+		    (e_prot & VM_PROT_WRITE)?"w":"-",
+		    (e_prot & VM_PROT_EXECUTE)?"x":"-",
 		    "p",
 		    (u_long)off,
 		    0,
@@ -958,10 +963,20 @@ linprocfs_doprocmaps(PFS_FILL_ARGS)
 		    );
 		if (freename)
 			free(freename, M_TEMP);
+		vm_map_lock_read(map);
 		if (error == -1) {
 			error = 0;
 			break;
 		}
+		if (last_timestamp + 1 != map->timestamp) {
+			/*
+			 * Look again for the entry because the map was
+			 * modified while it was unlocked.  Specifically,
+			 * the entry may have been clipped, merged, or deleted.
+			 */
+			vm_map_lookup_entry(map, e_end - 1, &tmp_entry);
+			entry = tmp_entry;
+		}
 	}
 	vm_map_unlock_read(map);
 
diff --git a/sys/fs/procfs/procfs_map.c b/sys/fs/procfs/procfs_map.c
index 7926fe15b57c..f570e04963f0 100644
--- a/sys/fs/procfs/procfs_map.c
+++ b/sys/fs/procfs/procfs_map.c
@@ -82,11 +82,12 @@ extern struct sysentvec ia32_freebsd_sysvec;
 int
 procfs_doprocmap(PFS_FILL_ARGS)
 {
-	int error, vfslocked;
 	vm_map_t map = &p->p_vmspace->vm_map;
-	vm_map_entry_t entry;
+	vm_map_entry_t entry, tmp_entry;
 	struct vnode *vp;
 	char *fullpath, *freepath;
+	int error, vfslocked;
+	unsigned int last_timestamp;
 #ifdef COMPAT_IA32
 	int wrap32 = 0;
 #endif
@@ -113,13 +114,19 @@ procfs_doprocmap(PFS_FILL_ARGS)
 	     entry = entry->next) {
 		vm_object_t obj, tobj, lobj;
 		int ref_count, shadow_count, flags;
-		vm_offset_t addr;
+		vm_offset_t e_start, e_end, addr;
 		int resident, privateresident;
 		char *type;
+		vm_eflags_t e_eflags;
+		vm_prot_t e_prot;
 
 		if (entry->eflags & MAP_ENTRY_IS_SUB_MAP)
 			continue;
 
+		e_eflags = entry->eflags;
+		e_prot = entry->protection;
+		e_start = entry->start;
+		e_end = entry->end;
 		privateresident = 0;
 		obj = entry->object.vm_object;
 		if (obj != NULL) {
@@ -143,11 +150,13 @@ procfs_doprocmap(PFS_FILL_ARGS)
 				VM_OBJECT_UNLOCK(lobj);
 			lobj = tobj;
 		}
+		last_timestamp = map->timestamp;
+		vm_map_unlock_read(map);
 
 		freepath = NULL;
 		fullpath = "-";
 		if (lobj) {
-			switch(lobj->type) {
+			switch (lobj->type) {
 			default:
 			case OBJT_DEFAULT:
 				type = "default";
@@ -194,28 +203,37 @@ procfs_doprocmap(PFS_FILL_ARGS)
 		 */
 		error = sbuf_printf(sb,
 		    "0x%lx 0x%lx %d %d %p %s%s%s %d %d 0x%x %s %s %s %s\n",
-			(u_long)entry->start, (u_long)entry->end,
+			(u_long)e_start, (u_long)e_end,
 			resident, privateresident,
 #ifdef COMPAT_IA32
 			wrap32 ? NULL : obj,	/* Hide 64 bit value */
 #else
 			obj,
 #endif
-			(entry->protection & VM_PROT_READ)?"r":"-",
-			(entry->protection & VM_PROT_WRITE)?"w":"-",
-			(entry->protection & VM_PROT_EXECUTE)?"x":"-",
+			(e_prot & VM_PROT_READ)?"r":"-",
+			(e_prot & VM_PROT_WRITE)?"w":"-",
+			(e_prot & VM_PROT_EXECUTE)?"x":"-",
 			ref_count, shadow_count, flags,
-			(entry->eflags & MAP_ENTRY_COW)?"COW":"NCOW",
-			(entry->eflags & MAP_ENTRY_NEEDS_COPY)?"NC":"NNC",
+			(e_eflags & MAP_ENTRY_COW)?"COW":"NCOW",
+			(e_eflags & MAP_ENTRY_NEEDS_COPY)?"NC":"NNC",
 			type, fullpath);
 
 		if (freepath != NULL)
 			free(freepath, M_TEMP);
-
+		vm_map_lock_read(map);
 		if (error == -1) {
 			error = 0;
 			break;
 		}
+		if (last_timestamp + 1 != map->timestamp) {
+			/*
+			 * Look again for the entry because the map was
+			 * modified while it was unlocked.  Specifically,
+			 * the entry may have been clipped, merged, or deleted.
+			 */
+			vm_map_lookup_entry(map, e_end - 1, &tmp_entry);
+			entry = tmp_entry;
+		}
 	}
 	vm_map_unlock_read(map);
 	return (error);