6800529 panic in contract_process_kill() due to null p_pgidp pointer

6781092 Kernel panic when running emacs-x/slime with ssh -X from a zone

3 files changed, 17 insertions, 6 deletions

diff --git a/usr/src/uts/common/contract/process.c b/usr/src/uts/common/contract/process.c
index 4b5d4d0ae8..9fd23fdb61 100644
--- a/usr/src/uts/common/contract/process.c
+++ b/usr/src/uts/common/contract/process.c
@@ -19,7 +19,7 @@
  * CDDL HEADER END
  */
 /*
- * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
+ * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  */
 
@@ -522,7 +522,8 @@ contract_process_kill(contract_t *ct, proc_t *ex, int checkpriv)
 
 	for (p = list_head(&ctp->conp_members); p != NULL;
 	    p = list_next(&ctp->conp_members, p)) {
-		if ((p == ex) || (pgrp != -1 && p->p_pgrp != pgrp) ||
+		if ((p == ex) ||
+		    (pgrp != -1 && (p->p_stat == SIDL || p->p_pgrp != pgrp)) ||
 		    (checkpriv && !contract_process_cankill(p, ex, ctp)))
 			continue;
 
diff --git a/usr/src/uts/common/fs/proc/prioctl.c b/usr/src/uts/common/fs/proc/prioctl.c
index 7d2c93d8d8..5630219ef3 100644
--- a/usr/src/uts/common/fs/proc/prioctl.c
+++ b/usr/src/uts/common/fs/proc/prioctl.c
@@ -19,7 +19,7 @@
  * CDDL HEADER END
  */
 /*
- * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
+ * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  */
 
@@ -1249,9 +1249,11 @@ startover:
 	{
 		int n;
 
+		mutex_exit(&p->p_lock);
 		mutex_enter(&p->p_ldtlock);
 		n = prnldt(p);
 		mutex_exit(&p->p_ldtlock);
+		mutex_enter(&p->p_lock);
 		prunlock(pnp);
 		if (copyout(&n, cmaddr, sizeof (n)))
 			error = EFAULT;
@@ -1263,6 +1265,7 @@ startover:
 		struct ssd *ssd;
 		int n;
 
+		mutex_exit(&p->p_lock);
 		mutex_enter(&p->p_ldtlock);
 		n = prnldt(p);
 
@@ -1276,6 +1279,7 @@ startover:
 		}
 		if (thing == NULL) {
 			mutex_exit(&p->p_ldtlock);
+			mutex_enter(&p->p_lock);
 			prunlock(pnp);
 			goto startover;
 		}
@@ -1285,6 +1289,7 @@ startover:
 		if (n != 0)
 			prgetldt(p, ssd);
 		mutex_exit(&p->p_ldtlock);
+		mutex_enter(&p->p_lock);
 		prunlock(pnp);
 
 		/* mark the end of the list with a null entry */
@@ -2884,9 +2889,11 @@ startover:
 	{
 		int n;
 
+		mutex_exit(&p->p_lock);
 		mutex_enter(&p->p_ldtlock);
 		n = prnldt(p);
 		mutex_exit(&p->p_ldtlock);
+		mutex_enter(&p->p_lock);
 		prunlock(pnp);
 		if (copyout(&n, cmaddr, sizeof (n)))
 			error = EFAULT;
@@ -2898,6 +2905,7 @@ startover:
 		struct ssd *ssd;
 		int n;
 
+		mutex_exit(&p->p_lock);
 		mutex_enter(&p->p_ldtlock);
 		n = prnldt(p);
 
@@ -2911,6 +2919,7 @@ startover:
 		}
 		if (thing == NULL) {
 			mutex_exit(&p->p_ldtlock);
+			mutex_enter(&p->p_lock);
 			prunlock(pnp);
 			goto startover;
 		}
@@ -2920,6 +2929,7 @@ startover:
 		if (n != 0)
 			prgetldt(p, ssd);
 		mutex_exit(&p->p_ldtlock);
+		mutex_enter(&p->p_lock);
 		prunlock(pnp);
 
 		/* mark the end of the list with a null entry */
diff --git a/usr/src/uts/common/fs/proc/prvnops.c b/usr/src/uts/common/fs/proc/prvnops.c
index e8fae94160..a78a84fa1a 100644
--- a/usr/src/uts/common/fs/proc/prvnops.c
+++ b/usr/src/uts/common/fs/proc/prvnops.c
@@ -19,7 +19,7 @@
  * CDDL HEADER END
  */
 /*
- * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
+ * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  */
 
@@ -27,8 +27,6 @@
 /*	  All Rights Reserved  	*/
 
 
-#pragma ident	"%Z%%M%	%I%	%E% SMI"
-
 #include <sys/types.h>
 #include <sys/param.h>
 #include <sys/time.h>
@@ -2974,9 +2972,11 @@ prgetattr(vnode_t *vp, vattr_t *vap, int flags, cred_t *cr,
 		break;
 #if defined(__x86)
 	case PR_LDT:
+		mutex_exit(&p->p_lock);
 		mutex_enter(&p->p_ldtlock);
 		vap->va_size = prnldt(p) * sizeof (struct ssd);
 		mutex_exit(&p->p_ldtlock);
+		mutex_enter(&p->p_lock);
 		break;
 #endif
 	case PR_USAGE: