Push down Giant for setpgid(), setsid() and aio_daemon(). Giant protects only

malloc(9) and free(9).

4 files changed, 25 insertions, 12 deletions

diff --git a/sys/kern/kern_descrip.c b/sys/kern/kern_descrip.c
index 0476493..06743d1 100644
--- a/sys/kern/kern_descrip.c
+++ b/sys/kern/kern_descrip.c
@@ -599,7 +599,9 @@ funsetownlst(sigiolst)
 			SLIST_REMOVE(&pg->pg_sigiolst, sigio, sigio, sio_pgsigio);
 			PGRP_UNLOCK(pg);
 			crfree(sigio->sio_ucred);
+			mtx_lock(&Giant);
 			FREE(sigio, M_SIGIO);
+			mtx_unlock(&Giant);
 			PGRP_LOCK(pg);
 		} else /* if (p != NULL) */ {
 			KASSERT(sigio->sio_pgid > 0, ("Pgrp sigio in proc sigio list"));
@@ -607,7 +609,9 @@ funsetownlst(sigiolst)
 			SLIST_REMOVE(&p->p_sigiolst, sigio, sigio, sio_pgsigio);
 			PROC_UNLOCK(p);
 			crfree(sigio->sio_ucred);
+			mtx_lock(&Giant);
 			FREE(sigio, M_SIGIO);
+			mtx_unlock(&Giant);
 			PROC_LOCK(p);
 		}
 	}
diff --git a/sys/kern/kern_proc.c b/sys/kern/kern_proc.c
index 2d512b9..88a6f6f 100644
--- a/sys/kern/kern_proc.c
+++ b/sys/kern/kern_proc.c
@@ -491,12 +491,16 @@ pgdelete(pgrp)
 	savesess->s_count--;
 	SESS_UNLOCK(savesess);
 	PGRP_UNLOCK(pgrp);
+	mtx_destroy(&pgrp->pg_mtx);
+	sx_xunlock(&proctree_lock);
+	mtx_lock(&Giant);
+	sx_xlock(&proctree_lock);
 	if (savesess->s_count == 0) {
 		mtx_destroy(&savesess->s_mtx);
 		FREE(pgrp->pg_session, M_SESSION);
 	}
-	mtx_destroy(&pgrp->pg_mtx);
 	FREE(pgrp, M_PGRP);
+	mtx_unlock(&Giant);
 }
 
 /*
diff --git a/sys/kern/kern_prot.c b/sys/kern/kern_prot.c
index b8a0156..30f8902 100644
--- a/sys/kern/kern_prot.c
+++ b/sys/kern/kern_prot.c
@@ -345,9 +345,9 @@ setsid(register struct thread *td, struct setsid_args *uap)
 	pgrp = NULL;
 
 	mtx_lock(&Giant);
-
 	MALLOC(newpgrp, struct pgrp *, sizeof(struct pgrp), M_PGRP, M_WAITOK | M_ZERO);
 	MALLOC(newsess, struct session *, sizeof(struct session), M_SESSION, M_WAITOK | M_ZERO);
+	mtx_unlock(&Giant);
 
 	sx_xlock(&proctree_lock);
 
@@ -364,12 +364,15 @@ setsid(register struct thread *td, struct setsid_args *uap)
 
 	sx_xunlock(&proctree_lock);
 
-	if (newpgrp != NULL)
-		FREE(newpgrp, M_PGRP);
-	if (newsess != NULL)
-		FREE(newsess, M_SESSION);
+	if (newpgrp != NULL || newsess != NULL) {
+		mtx_lock(&Giant);
+		if (newpgrp != NULL)
+			FREE(newpgrp, M_PGRP);
+		if (newsess != NULL)
+			FREE(newsess, M_SESSION);
+		mtx_unlock(&Giant);
+	}
 
-	mtx_unlock(&Giant);
 	return (error);
 }
 
@@ -411,8 +414,8 @@ setpgid(struct thread *td, register struct setpgid_args *uap)
 	error = 0;
 
 	mtx_lock(&Giant);
-
 	MALLOC(newpgrp, struct pgrp *, sizeof(struct pgrp), M_PGRP, M_WAITOK | M_ZERO);
+	mtx_unlock(&Giant);
 
 	sx_xlock(&proctree_lock);
 	if (uap->pid != 0 && uap->pid != curp->p_pid) {
@@ -476,9 +479,11 @@ done:
 	sx_xunlock(&proctree_lock);
 	KASSERT((error == 0) || (newpgrp != NULL),
 	    ("setpgid failed and newpgrp is NULL"));
-	if (newpgrp != NULL)
+	if (newpgrp != NULL) {
+		mtx_lock(&Giant);
 		FREE(newpgrp, M_PGRP);
-	mtx_unlock(&Giant);
+		mtx_unlock(&Giant);
+	}
 	return (error);
 }
 
@@ -1808,7 +1813,6 @@ getlogin(struct thread *td, struct getlogin_args *uap)
 	char login[MAXLOGNAME];
 	struct proc *p = td->td_proc;
 
-	mtx_lock(&Giant);
 	if (uap->namelen > MAXLOGNAME)
 		uap->namelen = MAXLOGNAME;
 	PROC_LOCK(p);
@@ -1817,7 +1821,6 @@ getlogin(struct thread *td, struct getlogin_args *uap)
 	SESS_UNLOCK(p->p_session);
 	PROC_UNLOCK(p);
 	error = copyout((caddr_t) login, (caddr_t) uap->namebuf, uap->namelen);
-	mtx_unlock(&Giant);
 	return(error);
 }
 
diff --git a/sys/kern/vfs_aio.c b/sys/kern/vfs_aio.c
index a7e630c..46c227e 100644
--- a/sys/kern/vfs_aio.c
+++ b/sys/kern/vfs_aio.c
@@ -794,9 +794,11 @@ aio_daemon(void *uproc)
 	MALLOC(newsess, struct session *, sizeof(struct session), M_SESSION,
 		M_WAITOK | M_ZERO);
 
+	mtx_unlock(&Giant);
 	sx_xlock(&proctree_lock);
 	enterpgrp(mycp, mycp->p_pid, newpgrp, newsess);
 	sx_xunlock(&proctree_lock);
+	mtx_lock(&Giant);
 
 	/* Mark special process type. */
 	mycp->p_flag |= P_SYSTEM;