Fix locking on td_flags for TDF_DEADLKTREAT. If the comments in the code

are true that curthread can change during this function, then this flag
needs to become a KSE flag, not a thread flag.

2 files changed, 10 insertions, 9 deletions

diff --git a/sys/kern/kern_lock.c b/sys/kern/kern_lock.c
index 3f8373b..a2835c3 100644
--- a/sys/kern/kern_lock.c
+++ b/sys/kern/kern_lock.c
@@ -263,14 +263,10 @@ debuglockmgr(lkp, flags, interlkp, td, name, file, line)
 		 */
 		if (lkp->lk_lockholder != pid) {
 			lockflags = LK_HAVE_EXCL;
-			if (td) {
-				PROC_LOCK(td->td_proc);
-				if (!(td->td_flags & TDF_DEADLKTREAT)) {
-					lockflags |= LK_WANT_EXCL |
-					    LK_WANT_UPGRADE;
-				}
-				PROC_UNLOCK(td->td_proc);
-			}
+			mtx_lock_spin(&sched_lock);
+			if (td != NULL && !(td->td_flags & TDF_DEADLKTREAT))
+				lockflags |= LK_WANT_EXCL | LK_WANT_UPGRADE;
+			mtx_unlock_spin(&sched_lock);
 			error = acquire(lkp, extflags, lockflags);
 			if (error)
 				break;
diff --git a/sys/kern/kern_subr.c b/sys/kern/kern_subr.c
index 31cde4f..9f53d2d 100644
--- a/sys/kern/kern_subr.c
+++ b/sys/kern/kern_subr.c
@@ -78,8 +78,10 @@ uiomove(cp, n, uio)
 	    ("uiomove proc"));
 
 	if (td) {
+		mtx_lock_spin(&sched_lock);
 		save = td->td_flags & TDF_DEADLKTREAT;
 		td->td_flags |= TDF_DEADLKTREAT;
+		mtx_unlock_spin(&sched_lock);
 	}
 
 	while (n > 0 && uio->uio_resid) {
@@ -125,8 +127,11 @@ uiomove(cp, n, uio)
 	}
 	if (td != curthread) printf("uiomove: IT CHANGED!");
 	td = curthread;	/* Might things have changed in copyin/copyout? */
-	if (td)
+	if (td) {
+		mtx_lock_spin(&sched_lock);
 		td->td_flags = (td->td_flags & ~TDF_DEADLKTREAT) | save;
+		mtx_unlock_spin(&sched_lock);
+	}
 	return (error);
 }