4 files changed, 100 insertions, 26 deletions

diff --git a/sys/kern/kern_acl.c b/sys/kern/kern_acl.c
index 0e9fc40acaa2..8d0c6c733fba 100644
--- a/sys/kern/kern_acl.c
+++ b/sys/kern/kern_acl.c
@@ -72,16 +72,22 @@ vacl_set_acl(struct proc *p, struct vnode *vp, acl_type_t type,
     struct acl *aclp)
 {
 	struct acl inkernacl;
+	struct ucred *uc;
 	int error;
 
 	error = copyin(aclp, &inkernacl, sizeof(struct acl));
 	if (error)
 		return(error);
-	VOP_LEASE(vp, p, p->p_ucred, LEASE_WRITE);
+	PROC_LOCK(p);
+	uc = p->p_ucred;
+	crhold(uc);
+	PROC_UNLOCK(p);
+	VOP_LEASE(vp, p, uc, LEASE_WRITE);
 	vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, p);
-	error = VOP_SETACL(vp, type, &inkernacl, p->p_ucred, p);
+	error = VOP_SETACL(vp, type, &inkernacl, uc, p);
 	VOP_UNLOCK(vp, 0, p);
-	return(error);
+	crfree(uc);
+	return (error);
 }
 
 /*
@@ -92,12 +98,18 @@ vacl_get_acl(struct proc *p, struct vnode *vp, acl_type_t type,
     struct acl *aclp)
 {
 	struct acl inkernelacl;
+	struct ucred *uc;
 	int error;
 
-	VOP_LEASE(vp, p, p->p_ucred, LEASE_WRITE);
+	PROC_LOCK(p);
+	uc = p->p_ucred;
+	crhold(uc);
+	PROC_UNLOCK(p);
+	VOP_LEASE(vp, p, uc, LEASE_WRITE);
 	vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, p);
-	error = VOP_GETACL(vp, type, &inkernelacl, p->p_ucred, p);
+	error = VOP_GETACL(vp, type, &inkernelacl, uc, p);
 	VOP_UNLOCK(vp, 0, p);
+	crfree(uc);
 	if (error == 0)
 		error = copyout(&inkernelacl, aclp, sizeof(struct acl));
 	return (error);
@@ -109,12 +121,18 @@ vacl_get_acl(struct proc *p, struct vnode *vp, acl_type_t type,
 static int
 vacl_delete(struct proc *p, struct vnode *vp, acl_type_t type)
 {
+	struct ucred *uc;
 	int error;
 
-	VOP_LEASE(vp, p, p->p_ucred, LEASE_WRITE);
+	PROC_LOCK(p);
+	uc = p->p_ucred;
+	crhold(uc);
+	PROC_UNLOCK(p);
+	VOP_LEASE(vp, p, uc, LEASE_WRITE);
 	vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, p);
-	error = VOP_SETACL(vp, ACL_TYPE_DEFAULT, 0, p->p_ucred, p);
+	error = VOP_SETACL(vp, ACL_TYPE_DEFAULT, 0, uc, p);
 	VOP_UNLOCK(vp, 0, p);
+	crfree(uc);
 	return (error);
 }
 
@@ -126,12 +144,18 @@ vacl_aclcheck(struct proc *p, struct vnode *vp, acl_type_t type,
     struct acl *aclp)
 {
 	struct acl inkernelacl;
+	struct ucred *uc;
 	int error;
 
 	error = copyin(aclp, &inkernelacl, sizeof(struct acl));
 	if (error)
 		return(error);
-	error = VOP_ACLCHECK(vp, type, &inkernelacl, p->p_ucred, p);
+	PROC_LOCK(p);
+	uc = p->p_ucred;
+	crhold(uc);
+	PROC_UNLOCK(p);
+	error = VOP_ACLCHECK(vp, type, &inkernelacl, uc, p);
+	crfree(uc);
 	return (error);
 }
 
diff --git a/sys/kern/kern_event.c b/sys/kern/kern_event.c
index 1a89d3248896..c1604d2af5c2 100644
--- a/sys/kern/kern_event.c
+++ b/sys/kern/kern_event.c
@@ -215,8 +215,9 @@ filt_procattach(struct knote *kn)
 		kn->kn_flags &= ~EV_FLAG1;
 	}
 
-	/* XXX lock the proc here while adding to the list? */
+	PROC_LOCK(p);
 	SLIST_INSERT_HEAD(&p->p_klist, kn, kn_selnext);
+	PROC_UNLOCK(p);
 
 	return (0);
 }
@@ -237,8 +238,9 @@ filt_procdetach(struct knote *kn)
 	if (kn->kn_status & KN_DETACHED)
 		return;
 
-	/* XXX locking?  this might modify another process. */
+	PROC_LOCK(p);
 	SLIST_REMOVE(&p->p_klist, kn, knote, kn_selnext);
+	PROC_UNLOCK(p);
 }
 
 static int
diff --git a/sys/kern/subr_acl_posix1e.c b/sys/kern/subr_acl_posix1e.c
index 0e9fc40acaa2..8d0c6c733fba 100644
--- a/sys/kern/subr_acl_posix1e.c
+++ b/sys/kern/subr_acl_posix1e.c
@@ -72,16 +72,22 @@ vacl_set_acl(struct proc *p, struct vnode *vp, acl_type_t type,
     struct acl *aclp)
 {
 	struct acl inkernacl;
+	struct ucred *uc;
 	int error;
 
 	error = copyin(aclp, &inkernacl, sizeof(struct acl));
 	if (error)
 		return(error);
-	VOP_LEASE(vp, p, p->p_ucred, LEASE_WRITE);
+	PROC_LOCK(p);
+	uc = p->p_ucred;
+	crhold(uc);
+	PROC_UNLOCK(p);
+	VOP_LEASE(vp, p, uc, LEASE_WRITE);
 	vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, p);
-	error = VOP_SETACL(vp, type, &inkernacl, p->p_ucred, p);
+	error = VOP_SETACL(vp, type, &inkernacl, uc, p);
 	VOP_UNLOCK(vp, 0, p);
-	return(error);
+	crfree(uc);
+	return (error);
 }
 
 /*
@@ -92,12 +98,18 @@ vacl_get_acl(struct proc *p, struct vnode *vp, acl_type_t type,
     struct acl *aclp)
 {
 	struct acl inkernelacl;
+	struct ucred *uc;
 	int error;
 
-	VOP_LEASE(vp, p, p->p_ucred, LEASE_WRITE);
+	PROC_LOCK(p);
+	uc = p->p_ucred;
+	crhold(uc);
+	PROC_UNLOCK(p);
+	VOP_LEASE(vp, p, uc, LEASE_WRITE);
 	vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, p);
-	error = VOP_GETACL(vp, type, &inkernelacl, p->p_ucred, p);
+	error = VOP_GETACL(vp, type, &inkernelacl, uc, p);
 	VOP_UNLOCK(vp, 0, p);
+	crfree(uc);
 	if (error == 0)
 		error = copyout(&inkernelacl, aclp, sizeof(struct acl));
 	return (error);
@@ -109,12 +121,18 @@ vacl_get_acl(struct proc *p, struct vnode *vp, acl_type_t type,
 static int
 vacl_delete(struct proc *p, struct vnode *vp, acl_type_t type)
 {
+	struct ucred *uc;
 	int error;
 
-	VOP_LEASE(vp, p, p->p_ucred, LEASE_WRITE);
+	PROC_LOCK(p);
+	uc = p->p_ucred;
+	crhold(uc);
+	PROC_UNLOCK(p);
+	VOP_LEASE(vp, p, uc, LEASE_WRITE);
 	vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, p);
-	error = VOP_SETACL(vp, ACL_TYPE_DEFAULT, 0, p->p_ucred, p);
+	error = VOP_SETACL(vp, ACL_TYPE_DEFAULT, 0, uc, p);
 	VOP_UNLOCK(vp, 0, p);
+	crfree(uc);
 	return (error);
 }
 
@@ -126,12 +144,18 @@ vacl_aclcheck(struct proc *p, struct vnode *vp, acl_type_t type,
     struct acl *aclp)
 {
 	struct acl inkernelacl;
+	struct ucred *uc;
 	int error;
 
 	error = copyin(aclp, &inkernelacl, sizeof(struct acl));
 	if (error)
 		return(error);
-	error = VOP_ACLCHECK(vp, type, &inkernelacl, p->p_ucred, p);
+	PROC_LOCK(p);
+	uc = p->p_ucred;
+	crhold(uc);
+	PROC_UNLOCK(p);
+	error = VOP_ACLCHECK(vp, type, &inkernelacl, uc, p);
+	crfree(uc);
 	return (error);
 }
 
diff --git a/sys/kern/vfs_acl.c b/sys/kern/vfs_acl.c
index 0e9fc40acaa2..8d0c6c733fba 100644
--- a/sys/kern/vfs_acl.c
+++ b/sys/kern/vfs_acl.c
@@ -72,16 +72,22 @@ vacl_set_acl(struct proc *p, struct vnode *vp, acl_type_t type,
     struct acl *aclp)
 {
 	struct acl inkernacl;
+	struct ucred *uc;
 	int error;
 
 	error = copyin(aclp, &inkernacl, sizeof(struct acl));
 	if (error)
 		return(error);
-	VOP_LEASE(vp, p, p->p_ucred, LEASE_WRITE);
+	PROC_LOCK(p);
+	uc = p->p_ucred;
+	crhold(uc);
+	PROC_UNLOCK(p);
+	VOP_LEASE(vp, p, uc, LEASE_WRITE);
 	vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, p);
-	error = VOP_SETACL(vp, type, &inkernacl, p->p_ucred, p);
+	error = VOP_SETACL(vp, type, &inkernacl, uc, p);
 	VOP_UNLOCK(vp, 0, p);
-	return(error);
+	crfree(uc);
+	return (error);
 }
 
 /*
@@ -92,12 +98,18 @@ vacl_get_acl(struct proc *p, struct vnode *vp, acl_type_t type,
     struct acl *aclp)
 {
 	struct acl inkernelacl;
+	struct ucred *uc;
 	int error;
 
-	VOP_LEASE(vp, p, p->p_ucred, LEASE_WRITE);
+	PROC_LOCK(p);
+	uc = p->p_ucred;
+	crhold(uc);
+	PROC_UNLOCK(p);
+	VOP_LEASE(vp, p, uc, LEASE_WRITE);
 	vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, p);
-	error = VOP_GETACL(vp, type, &inkernelacl, p->p_ucred, p);
+	error = VOP_GETACL(vp, type, &inkernelacl, uc, p);
 	VOP_UNLOCK(vp, 0, p);
+	crfree(uc);
 	if (error == 0)
 		error = copyout(&inkernelacl, aclp, sizeof(struct acl));
 	return (error);
@@ -109,12 +121,18 @@ vacl_get_acl(struct proc *p, struct vnode *vp, acl_type_t type,
 static int
 vacl_delete(struct proc *p, struct vnode *vp, acl_type_t type)
 {
+	struct ucred *uc;
 	int error;
 
-	VOP_LEASE(vp, p, p->p_ucred, LEASE_WRITE);
+	PROC_LOCK(p);
+	uc = p->p_ucred;
+	crhold(uc);
+	PROC_UNLOCK(p);
+	VOP_LEASE(vp, p, uc, LEASE_WRITE);
 	vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, p);
-	error = VOP_SETACL(vp, ACL_TYPE_DEFAULT, 0, p->p_ucred, p);
+	error = VOP_SETACL(vp, ACL_TYPE_DEFAULT, 0, uc, p);
 	VOP_UNLOCK(vp, 0, p);
+	crfree(uc);
 	return (error);
 }
 
@@ -126,12 +144,18 @@ vacl_aclcheck(struct proc *p, struct vnode *vp, acl_type_t type,
     struct acl *aclp)
 {
 	struct acl inkernelacl;
+	struct ucred *uc;
 	int error;
 
 	error = copyin(aclp, &inkernelacl, sizeof(struct acl));
 	if (error)
 		return(error);
-	error = VOP_ACLCHECK(vp, type, &inkernelacl, p->p_ucred, p);
+	PROC_LOCK(p);
+	uc = p->p_ucred;
+	crhold(uc);
+	PROC_UNLOCK(p);
+	error = VOP_ACLCHECK(vp, type, &inkernelacl, uc, p);
+	crfree(uc);
 	return (error);
 }