5 files changed, 18 insertions, 1 deletions
diff --git a/sys/fs/coda/coda_namecache.c b/sys/fs/coda/coda_namecache.c
index 3b73a679824e..9dfaf19750b6 100644
--- a/sys/fs/coda/coda_namecache.c
+++ b/sys/fs/coda/coda_namecache.c
@@ -81,6 +81,7 @@
 #include <sys/errno.h>
 #include <sys/lock.h>
 #include <sys/malloc.h>
+#include <sys/mutex.h>
 #include <sys/ucred.h>
 
 #include <vm/vm.h>
diff --git a/sys/fs/procfs/procfs_map.c b/sys/fs/procfs/procfs_map.c
index 5e4a30c78c22..5c21993f50ca 100644
--- a/sys/fs/procfs/procfs_map.c
+++ b/sys/fs/procfs/procfs_map.c
@@ -42,6 +42,7 @@
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/lock.h>
+#include <sys/mutex.h>
 #include <sys/proc.h>
 #include <sys/vnode.h>
 
diff --git a/sys/fs/procfs/procfs_mem.c b/sys/fs/procfs/procfs_mem.c
index 3a2f8d2e7932..1e28870675e5 100644
--- a/sys/fs/procfs/procfs_mem.c
+++ b/sys/fs/procfs/procfs_mem.c
@@ -48,6 +48,7 @@
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/lock.h>
+#include <sys/mutex.h>
 #include <sys/proc.h>
 #include <sys/ptrace.h>
 #include <sys/user.h>
@@ -88,8 +89,14 @@ procfs_rwmem(curp, p, uio)
 	 * usage in that process can be messed up.
 	 */
 	vm = p->p_vmspace;
-	if ((p->p_flag & P_WEXIT) || (vm->vm_refcnt < 1))
+	if ((p->p_flag & P_WEXIT))
 		return EFAULT;
+
+	mtx_lock(&vm_mtx);
+	if (vm->vm_refcnt < 1) {
+		mtx_unlock(&vm_mtx);
+		return EFAULT;
+	}
 	++vm->vm_refcnt;
 	/*
 	 * The map we want...
@@ -207,7 +214,9 @@ procfs_rwmem(curp, p, uio)
 		/*
 		 * Now do the i/o move.
 		 */
+		mtx_unlock(&vm_mtx);
 		error = uiomove((caddr_t)(kva + page_offset), len, uio);
+		mtx_lock(&vm_mtx);
 
 		pmap_kremove(kva);
 
@@ -226,6 +235,7 @@ procfs_rwmem(curp, p, uio)
 
 	kmem_free(kernel_map, kva, PAGE_SIZE);
 	vmspace_free(vm);
+	mtx_unlock(&vm_mtx);
 	return (error);
 }
 
diff --git a/sys/fs/specfs/spec_vnops.c b/sys/fs/specfs/spec_vnops.c
index 2940f404b779..ba812293e4ac 100644
--- a/sys/fs/specfs/spec_vnops.c
+++ b/sys/fs/specfs/spec_vnops.c
@@ -731,6 +731,8 @@ spec_getpages(ap)
 	cnt.v_vnodein++;
 	cnt.v_vnodepgsin += pcount;
 
+	mtx_unlock(&vm_mtx);
+	mtx_lock(&Giant);
 	/* Do the input. */
 	BUF_STRATEGY(bp);
 
@@ -741,6 +743,8 @@ spec_getpages(ap)
 		tsleep(bp, PVM, "spread", 0);
 
 	splx(s);
+	mtx_unlock(&Giant);
+	mtx_lock(&vm_mtx);
 
 	if ((bp->b_ioflags & BIO_ERROR) != 0) {
 		if (bp->b_error)
diff --git a/sys/fs/unionfs/union_subr.c b/sys/fs/unionfs/union_subr.c
index 869818f28067..3ac98bf508bb 100644
--- a/sys/fs/unionfs/union_subr.c
+++ b/sys/fs/unionfs/union_subr.c
@@ -45,6 +45,7 @@
 #include <sys/filedesc.h>
 #include <sys/kernel.h>
 #include <sys/lock.h>
+#include <sys/mutex.h>
 #include <sys/malloc.h>
 #include <sys/module.h>
 #include <sys/mount.h>