2 files changed, 8 insertions, 1 deletions

diff --git a/sys/vm/vm_fault.c b/sys/vm/vm_fault.c
index 5ad629273be1..c341661b02de 100644
--- a/sys/vm/vm_fault.c
+++ b/sys/vm/vm_fault.c
@@ -866,6 +866,7 @@ readrest:
 	if (((fault_flags & VM_FAULT_WIRE_MASK) == 0) && (wired == 0)) {
 		pmap_prefault(fs.map->pmap, vaddr, fs.entry);
 	}
+	vm_page_lock_queues();
 	vm_page_flag_clear(fs.m, PG_ZERO);
 	vm_page_flag_set(fs.m, PG_MAPPED|PG_REFERENCED);
 
@@ -881,7 +882,7 @@ readrest:
 	} else {
 		vm_page_activate(fs.m);
 	}
-
+	vm_page_unlock_queues();
 	mtx_lock_spin(&sched_lock);
 	if (curproc && (curproc->p_sflag & PS_INMEM) && curproc->p_stats) {
 		if (hardfault) {
@@ -1004,7 +1005,9 @@ vm_fault_unwire(map, start, end)
 		pa = pmap_extract(pmap, va);
 		if (pa != (vm_offset_t) 0) {
 			pmap_change_wiring(pmap, va, FALSE);
+			vm_page_lock_queues();
 			vm_page_unwire(PHYS_TO_VM_PAGE(pa), 1);
+			vm_page_unlock_queues();
 		}
 	}
 	mtx_unlock(&Giant);
diff --git a/sys/vm/vm_glue.c b/sys/vm/vm_glue.c
index 505d1e3b6a7f..870bced9c19f 100644
--- a/sys/vm/vm_glue.c
+++ b/sys/vm/vm_glue.c
@@ -266,11 +266,13 @@ vm_proc_dispose(struct proc *p)
 	upobj = p->p_upages_obj;
 	if (upobj->resident_page_count != UAREA_PAGES)
 		panic("vm_proc_dispose: incorrect number of pages in upobj");
+	vm_page_lock_queues();
 	while ((m = TAILQ_FIRST(&upobj->memq)) != NULL) {
 		vm_page_busy(m);
 		vm_page_unwire(m, 0);
 		vm_page_free(m);
 	}
+	vm_page_unlock_queues();
 	up = (vm_offset_t)p->p_uarea;
 	pmap_qremove(up, UAREA_PAGES);
 	kmem_free(kernel_map, up, UAREA_PAGES * PAGE_SIZE);
@@ -291,10 +293,12 @@ vm_proc_swapout(struct proc *p)
 	upobj = p->p_upages_obj;
 	if (upobj->resident_page_count != UAREA_PAGES)
 		panic("vm_proc_dispose: incorrect number of pages in upobj");
+	vm_page_lock_queues();
 	TAILQ_FOREACH(m, &upobj->memq, listq) {
 		vm_page_dirty(m);
 		vm_page_unwire(m, 0);
 	}
+	vm_page_unlock_queues();
 	up = (vm_offset_t)p->p_uarea;
 	pmap_qremove(up, UAREA_PAGES);
 }