6924278 lwp_exit() race causes proc with bad p_tlist, panicking ps(1)

1 files changed, 9 insertions, 12 deletions

diff --git a/usr/src/uts/common/os/lwp.c b/usr/src/uts/common/os/lwp.c
index 94f29b918e..64c541187d 100644
--- a/usr/src/uts/common/os/lwp.c
+++ b/usr/src/uts/common/os/lwp.c
@@ -887,6 +887,8 @@ lwp_exit(void)
 	if (PROC_IS_BRANDED(p))
 		BROP(p)->b_lwpexit(lwp);
 
+	lwp_pcb_exit();
+
 	mutex_enter(&p->p_lock);
 	lwp_cleanup();
 
@@ -899,6 +901,12 @@ lwp_exit(void)
 		stop(PR_SUSPENDED, SUSPEND_NORMAL);
 
 	/*
+	 * Block the process against /proc now that we have really acquired
+	 * p->p_lock (to decrement p_lwpcnt and manipulate p_tlist at least).
+	 */
+	prbarrier(p);
+
+	/*
 	 * Call proc_exit() if this is the last non-daemon lwp in the process.
 	 */
 	if (!(t->t_proc_flag & TP_DAEMON) &&
@@ -916,20 +924,9 @@ lwp_exit(void)
 		 */
 		mutex_enter(&p->p_lock);
 		ASSERT(curproc->p_flag & SEXITLWPS);
+		prbarrier(p);
 	}
 
-	mutex_exit(&p->p_lock);
-
-	lwp_pcb_exit();
-
-	mutex_enter(&p->p_lock);
-
-	/*
-	 * Block the process against /proc now that we have really acquired
-	 * p->p_lock (to decrement p_lwpcnt and manipulate p_tlist at least).
-	 */
-	prbarrier(p);
-
 	DTRACE_PROC(lwp__exit);
 
 	/*