accidental commit ... backout

8 files changed, 126 insertions, 210 deletions

diff --git a/sys/kern/kern_exec.c b/sys/kern/kern_exec.c
index aa15c0c7997..50b19421943 100644
--- a/sys/kern/kern_exec.c
+++ b/sys/kern/kern_exec.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: kern_exec.c,v 1.107 2008/10/31 17:15:29 deraadt Exp $	*/
+/*	$OpenBSD: kern_exec.c,v 1.108 2008/10/31 17:17:00 deraadt Exp $	*/
 /*	$NetBSD: kern_exec.c,v 1.75 1996/02/09 18:59:28 christos Exp $	*/
 
 /*-
@@ -500,11 +500,8 @@ sys_execve(struct proc *p, void *v, register_t *retval)
 		 * root set it.
 		 */
 		if (p->p_tracep && !(p->p_traceflag & KTRFAC_ROOT)) {
-			struct vnode *vp = p->p_tracep;
-
 			p->p_traceflag = 0;
-			if (ktrsettracevnode(p, NULL) == 1)
-				vrele(vp);
+			ktrsettracevnode(p, NULL);
 		}
 #endif
 		p->p_ucred = crcopy(cred);
diff --git a/sys/kern/kern_exit.c b/sys/kern/kern_exit.c
index 9a35b7d4fa5..ef5d73786f5 100644
--- a/sys/kern/kern_exit.c
+++ b/sys/kern/kern_exit.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: kern_exit.c,v 1.78 2008/10/31 17:15:30 deraadt Exp $	*/
+/*	$OpenBSD: kern_exit.c,v 1.79 2008/10/31 17:17:01 deraadt Exp $	*/
 /*	$NetBSD: kern_exit.c,v 1.39 1996/04/22 01:38:25 christos Exp $	*/
 
 /*
@@ -225,12 +225,8 @@ exit1(struct proc *p, int rv, int flags)
 	 * release trace file
 	 */
 	p->p_traceflag = 0;	/* don't trace the vrele() */
-	if (p->p_tracep) {
-		struct vnode *vp = p->p_tracep;
-		if (ktrsettracevnode(p, NULL) == 1)
-			vrele(vp);
-	}
-		
+	if (p->p_tracep)
+		ktrsettracevnode(p, NULL);
 #endif
 #if NSYSTRACE > 0
 	if (ISSET(p->p_flag, P_SYSTRACE))
diff --git a/sys/kern/kern_ktrace.c b/sys/kern/kern_ktrace.c
index 45bc33a6f00..91ec8956813 100644
--- a/sys/kern/kern_ktrace.c
+++ b/sys/kern/kern_ktrace.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: kern_ktrace.c,v 1.44 2008/10/31 17:15:30 deraadt Exp $	*/
+/*	$OpenBSD: kern_ktrace.c,v 1.45 2008/10/31 17:17:02 deraadt Exp $	*/
 /*	$NetBSD: kern_ktrace.c,v 1.23 1996/02/09 18:59:36 christos Exp $	*/
 
 /*
@@ -53,23 +53,22 @@
 #include <uvm/uvm_extern.h>
 
 void ktrinitheader(struct ktr_header *, struct proc *, int);
-int ktrops(struct proc *, struct proc *, int, int, struct vnode *, int *);
+int ktrops(struct proc *, struct proc *, int, int, struct vnode *);
 int ktrsetchildren(struct proc *, struct proc *, int, int,
-			struct vnode *, int *);
+			struct vnode *);
 int ktrwrite(struct proc *, struct ktr_header *);
 int ktrcanset(struct proc *, struct proc *);
 
 /*
  * Change the trace vnode in a correct way (to avoid races).
- * Returns 1 if a vrele() should be done later.
  */
-int
+void
 ktrsettracevnode(struct proc *p, struct vnode *newvp)
 {
 	struct vnode *vp;
 
 	if (p->p_tracep == newvp)	/* avoid work */
-		return (0);
+		return;
 
 	if (newvp != NULL)
 		VREF(newvp);
@@ -78,8 +77,7 @@ ktrsettracevnode(struct proc *p, struct vnode *newvp)
 	p->p_tracep = newvp;
 
 	if (vp != NULL)
-		return (1);	/* caller must do a vrele() after */
-	return (0);
+		vrele(vp);
 }
 
 void
@@ -296,7 +294,7 @@ sys_ktrace(struct proc *curp, void *v, register_t *retval)
 	int facs = SCARG(uap, facs) & ~((unsigned) KTRFAC_ROOT);
 	int ops = KTROP(SCARG(uap, ops));
 	int descend = SCARG(uap, ops) & KTRFLAG_DESCEND;
-	int ret = 0, nvrele = 0;
+	int ret = 0;
 	int error = 0;
 	struct nameidata nd;
 
@@ -328,7 +326,7 @@ sys_ktrace(struct proc *curp, void *v, register_t *retval)
 			if (p->p_tracep == vp) {
 				if (ktrcanset(curp, p)) {
 					p->p_traceflag = 0;
-					nvrele += ktrsettracevnode(p, NULL);
+					ktrsettracevnode(p, NULL);
 				} else
 					error = EPERM;
 			}
@@ -356,10 +354,10 @@ sys_ktrace(struct proc *curp, void *v, register_t *retval)
 		}
 		LIST_FOREACH(p, &pg->pg_members, p_pglist)
 			if (descend)
-				ret |= ktrsetchildren(curp, p, ops, facs, vp,
-				    &nvrele);
+				ret |= ktrsetchildren(curp, p, ops, facs, vp);
 			else 
-				ret |= ktrops(curp, p, ops, facs, vp, &nvrele);
+				ret |= ktrops(curp, p, ops, facs, vp);
+					
 	} else {
 		/*
 		 * by pid
@@ -370,30 +368,27 @@ sys_ktrace(struct proc *curp, void *v, register_t *retval)
 			goto done;
 		}
 		if (descend)
-			ret |= ktrsetchildren(curp, p, ops, facs, vp, &nvrele);
+			ret |= ktrsetchildren(curp, p, ops, facs, vp);
 		else
-			ret |= ktrops(curp, p, ops, facs, vp, &nvrele);
+			ret |= ktrops(curp, p, ops, facs, vp);
 	}
 	if (!ret)
 		error = EPERM;
 done:
-	if (vp != NULL) {
-		while (nvrele--)
-			vrele(vp);
+	if (vp != NULL)
 		(void) vn_close(vp, FWRITE, curp->p_ucred, curp);
-	}
 	curp->p_traceflag &= ~KTRFAC_ACTIVE;
 	return (error);
 }
 
 int
-ktrops(struct proc *curp, struct proc *p, int ops, int facs, struct vnode *vp,
-    int *vrelep)
+ktrops(struct proc *curp, struct proc *p, int ops, int facs, struct vnode *vp)
 {
+
 	if (!ktrcanset(curp, p))
 		return (0);
 	if (ops == KTROP_SET) {
-		*vrelep += ktrsettracevnode(p, vp);
+		ktrsettracevnode(p, vp);
 		p->p_traceflag |= facs;
 		if (curp->p_ucred->cr_uid == 0)
 			p->p_traceflag |= KTRFAC_ROOT;
@@ -402,7 +397,7 @@ ktrops(struct proc *curp, struct proc *p, int ops, int facs, struct vnode *vp,
 		if (((p->p_traceflag &= ~facs) & KTRFAC_MASK) == 0) {
 			/* no more tracing */
 			p->p_traceflag = 0;
-			*vrelep += ktrsettracevnode(p, NULL);
+			ktrsettracevnode(p, NULL);
 		}
 	}
 
@@ -418,14 +413,14 @@ ktrops(struct proc *curp, struct proc *p, int ops, int facs, struct vnode *vp,
 
 int
 ktrsetchildren(struct proc *curp, struct proc *top, int ops, int facs,
-    struct vnode *vp, int *vrelep)
+    struct vnode *vp)
 {
 	struct proc *p;
 	int ret = 0;
 
 	p = top;
 	for (;;) {
-		ret |= ktrops(curp, p, ops, facs, vp, vrelep);
+		ret |= ktrops(curp, p, ops, facs, vp);
 		/*
 		 * If this process has children, descend to them next,
 		 * otherwise do any siblings, and if done with this level,
@@ -451,7 +446,7 @@ ktrwrite(struct proc *p, struct ktr_header *kth)
 {
 	struct uio auio;
 	struct iovec aiov[2];
-	int error, nvrele = 0;
+	int error;
 	struct vnode *vp = p->p_tracep;
 
 	if (vp == NULL)
@@ -484,11 +479,9 @@ ktrwrite(struct proc *p, struct ktr_header *kth)
 	LIST_FOREACH(p, &allproc, p_list) {
 		if (p->p_tracep == vp) {
 			p->p_traceflag = 0;
-			nvrele += ktrsettracevnode(p, NULL);
+			ktrsettracevnode(p, NULL);
 		}
 	}
-	while (nvrele--)
-		vrele(vp);
 
 	return error;
 }
diff --git a/sys/kern/kern_proc.c b/sys/kern/kern_proc.c
index 44c2691e4dd..e97e929255d 100644
--- a/sys/kern/kern_proc.c
+++ b/sys/kern/kern_proc.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: kern_proc.c,v 1.37 2008/10/31 17:15:30 deraadt Exp $	*/
+/*	$OpenBSD: kern_proc.c,v 1.38 2008/10/31 17:17:03 deraadt Exp $	*/
 /*	$NetBSD: kern_proc.c,v 1.14 1996/02/09 18:59:41 christos Exp $	*/
 
 /*
@@ -193,16 +193,14 @@ pgfind(pid_t pgid)
 
 /*
  * Move p to a new or existing process group (and session)
- * Caller provides a pre-allocated pgrp and session that should
- * be freed if they are not used.
  */
 int
-enterpgrp(struct proc *p, pid_t pgid, struct pgrp *npgrp, struct session *nsess)
+enterpgrp(struct proc *p, pid_t pgid, int mksess)
 {
 	struct pgrp *pgrp = pgfind(pgid);
 
 #ifdef DIAGNOSTIC
-	if (pgrp != NULL && nsess)	/* firewalls */
+	if (pgrp != NULL && mksess)	/* firewalls */
 		panic("enterpgrp: setsid into non-empty pgrp");
 	if (SESS_LEADER(p))
 		panic("enterpgrp: session leader attempted setpgrp");
@@ -217,27 +215,24 @@ enterpgrp(struct proc *p, pid_t pgid, struct pgrp *npgrp, struct session *nsess)
 		if (p->p_pid != pgid)
 			panic("enterpgrp: new pgrp and pid != pgid");
 #endif
-
-		if ((np = pfind(savepid)) == NULL || np != p) {
-			pool_put(&pgrp_pool, npgrp);
-			if (nsess)
-				pool_put(&session_pool, nsess);
+		if ((np = pfind(savepid)) == NULL || np != p)
 			return (ESRCH);
-		}
+		pgrp = pool_get(&pgrp_pool, PR_WAITOK);
+		if (mksess) {
+			struct session *sess;
 
-		pgrp = npgrp;
-		if (nsess) {
 			/*
 			 * new session
 			 */
-			nsess->s_leader = p;
-			nsess->s_count = 1;
-			nsess->s_ttyvp = NULL;
-			nsess->s_ttyp = NULL;
-			bcopy(p->p_session->s_login, nsess->s_login,
-			    sizeof(nsess->s_login));
+			sess = pool_get(&session_pool, PR_WAITOK);
+			sess->s_leader = p;
+			sess->s_count = 1;
+			sess->s_ttyvp = NULL;
+			sess->s_ttyp = NULL;
+			bcopy(p->p_session->s_login, sess->s_login,
+			    sizeof(sess->s_login));
 			atomic_clearbits_int(&p->p_flag, P_CONTROLT);
-			pgrp->pg_session = nsess;
+			pgrp->pg_session = sess;
 #ifdef DIAGNOSTIC
 			if (p != curproc)
 				panic("enterpgrp: mksession and p != curproc");
@@ -250,16 +245,8 @@ enterpgrp(struct proc *p, pid_t pgid, struct pgrp *npgrp, struct session *nsess)
 		LIST_INIT(&pgrp->pg_members);
 		LIST_INSERT_HEAD(PGRPHASH(pgid), pgrp, pg_hash);
 		pgrp->pg_jobc = 0;
-	} else if (pgrp == p->p_pgrp) {
-		if (nsess)
-			pool_put(&session_pool, nsess);
-		pool_put(&pgrp_pool, npgrp);
+	} else if (pgrp == p->p_pgrp)
 		return (0);
-	} else {
-		if (nsess)
-			pool_put(&session_pool, nsess);
-		pool_put(&pgrp_pool, npgrp);
-	}
 
 	/*
 	 * Adjust eligibility of affected pgrps to participate in job control.
@@ -448,16 +435,9 @@ db_show_all_procs(db_expr_t addr, int haddr, db_expr_t count, char *modif)
 		pp = p->p_pptr;
 		if (p->p_stat) {
 
-#ifdef MULTIPROCESSOR
-			if (p == curproc) {
-				if (p->p_cpu == curcpu())
-					db_printf("%2d", curcpu()->ci_cpuid);
-				else
-					db_printf(" *");
-			} else
-#endif
-				db_printf(" %c", p == curproc ? '*' : ' ');
-			db_printf("%5d  ",p->p_pid);
+			db_printf("%c%5d  ", p == curproc ? '*' : ' ',
+				p->p_pid);
+
 			switch (*mode) {
 
 			case 'a':
diff --git a/sys/kern/kern_prot.c b/sys/kern/kern_prot.c
index fa3f48bcb6d..7379a924540 100644
--- a/sys/kern/kern_prot.c
+++ b/sys/kern/kern_prot.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: kern_prot.c,v 1.35 2008/10/31 17:15:30 deraadt Exp $	*/
+/*	$OpenBSD: kern_prot.c,v 1.36 2008/10/31 17:17:04 deraadt Exp $	*/
 /*	$NetBSD: kern_prot.c,v 1.33 1996/02/09 18:59:42 christos Exp $	*/
 
 /*
@@ -234,18 +234,10 @@ int
 sys_setsid(struct proc *p, void *v, register_t *retval)
 {
 
-	struct session *nsess;
-	struct pgrp *npgrp;
-
-	nsess = pool_get(&session_pool, PR_WAITOK);
-	npgrp = pool_get(&pgrp_pool, PR_WAITOK);
-
 	if (p->p_pgid == p->p_pid || pgfind(p->p_pid)) {
-		pool_put(&pgrp_pool, npgrp);
-		pool_put(&session_pool, nsess);
 		return (EPERM);
 	} else {
-		(void) enterpgrp(p, p->p_pid, npgrp, nsess);
+		(void)enterpgrp(p, p->p_pid, 1);
 		*retval = p->p_pid;
 		return (0);
 	}
@@ -273,9 +265,9 @@ sys_setpgid(struct proc *curp, void *v, register_t *retval)
 		syscallarg(int) pgid;
 	} */ *uap = v;
 	struct proc *targp;		/* target process */
-	struct pgrp *pgrp, *npgrp;	/* target pgrp */
+	struct pgrp *pgrp;		/* target pgrp */
 	pid_t pid;
-	int pgid, error;
+	int pgid;
 
 	pid = SCARG(uap, pid);
 	pgid = SCARG(uap, pgid);
@@ -283,40 +275,24 @@ sys_setpgid(struct proc *curp, void *v, register_t *retval)
 	if (pgid < 0)
 		return (EINVAL);
 
-	npgrp = pool_get(&pgrp_pool, PR_WAITOK);
-
 	if (pid != 0 && pid != curp->p_pid) {
-		if ((targp = pfind(pid)) == 0 || !inferior(targp)) {
-			error = ESRCH;
-			goto out;
-		}
-		if (targp->p_session != curp->p_session) {
-			error = EPERM;
-			goto out;
-		}
-		if (targp->p_flag & P_EXEC) {
-			error = EACCES;
-			goto out;
-		}
+		if ((targp = pfind(pid)) == 0 || !inferior(targp))
+			return (ESRCH);
+		if (targp->p_session != curp->p_session)
+			return (EPERM);
+		if (targp->p_flag & P_EXEC)
+			return (EACCES);
 	} else
 		targp = curp;
-	if (SESS_LEADER(targp)) {
-		error = EPERM;
-		goto out;
-	}
+	if (SESS_LEADER(targp))
+		return (EPERM);
 	if (pgid == 0)
 		pgid = targp->p_pid;
 	else if (pgid != targp->p_pid)
 		if ((pgrp = pgfind(pgid)) == 0 ||
-		    pgrp->pg_session != curp->p_session) {
-			error = EPERM;
-			goto out;
-		}
-	return (enterpgrp(targp, pgid, npgrp, NULL));
-out:
-	if (npgrp)
-		pool_put(&pgrp_pool, npgrp);
-	return (error);
+		    pgrp->pg_session != curp->p_session)
+			return (EPERM);
+	return (enterpgrp(targp, pgid, 0));
 }
 
 /* ARGSUSED */
diff --git a/sys/kern/kern_sysctl.c b/sys/kern/kern_sysctl.c
index 25b2c077b46..fe1d4fd91e6 100644
--- a/sys/kern/kern_sysctl.c
+++ b/sys/kern/kern_sysctl.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: kern_sysctl.c,v 1.164 2008/10/31 17:15:30 deraadt Exp $	*/
+/*	$OpenBSD: kern_sysctl.c,v 1.165 2008/10/31 17:17:05 deraadt Exp $	*/
 /*	$NetBSD: kern_sysctl.c,v 1.17 1996/05/20 17:49:05 mrg Exp $	*/
 
 /*-
@@ -1367,14 +1367,16 @@ sysctl_proc_args(int *name, u_int namelen, void *oldp, size_t *oldlenp,
 {
 	struct proc *vp;
 	pid_t pid;
+	int op;
 	struct ps_strings pss;
 	struct iovec iov;
 	struct uio uio;
-	int error, cnt, op;
+	int error;
 	size_t limit;
+	int cnt;
 	char **rargv, **vargv;		/* reader vs. victim */
-	char *rarg, *varg, *buf;
-	struct vmspace *vm;
+	char *rarg, *varg;
+	char *buf;
 
 	if (namelen > 2)
 		return (ENOTDIR);
@@ -1416,10 +1418,7 @@ sysctl_proc_args(int *name, u_int namelen, void *oldp, size_t *oldlenp,
 	if ((vp->p_flag & P_INEXEC))
 		return (EBUSY);
 
-	vm = vp->p_vmspace;
-	vm->vm_refcnt++;
-	vp = NULL;
-
+	vp->p_vmspace->vm_refcnt++;	/* XXX */
 	buf = malloc(PAGE_SIZE, M_TEMP, M_WAITOK);
 
 	iov.iov_base = &pss;
@@ -1432,7 +1431,7 @@ sysctl_proc_args(int *name, u_int namelen, void *oldp, size_t *oldlenp,
 	uio.uio_rw = UIO_READ;
 	uio.uio_procp = cp;
 
-	if ((error = uvm_io(&vm->vm_map, &uio, 0)) != 0)
+	if ((error = uvm_io(&vp->p_vmspace->vm_map, &uio, 0)) != 0)
 		goto out;
 
 	if (op == KERN_PROC_NARGV) {
@@ -1489,7 +1488,7 @@ sysctl_proc_args(int *name, u_int namelen, void *oldp, size_t *oldlenp,
 		uio.uio_segflg = UIO_SYSSPACE;
 		uio.uio_rw = UIO_READ;
 		uio.uio_procp = cp;
-		if ((error = uvm_io(&vm->vm_map, &uio, 0)) != 0)
+		if ((error = uvm_io(&vp->p_vmspace->vm_map, &uio, 0)) != 0)
 			goto out;
 
 		if (varg == NULL)
@@ -1511,7 +1510,7 @@ more:
 		uio.uio_segflg = UIO_SYSSPACE;
 		uio.uio_rw = UIO_READ;
 		uio.uio_procp = cp;
-		if ((error = uvm_io(&vm->vm_map, &uio, 0)) != 0)
+		if ((error = uvm_io(&vp->p_vmspace->vm_map, &uio, 0)) != 0)
 			goto out;
 
 		for (vstrlen = 0; vstrlen < len; vstrlen++) {
@@ -1559,7 +1558,7 @@ more:
 	error = copyout(&rarg, rargv, sizeof(rarg));
 
 out:
-	uvmspace_free(vm);
+	uvmspace_free(vp->p_vmspace);
 	free(buf, M_TEMP);
 	return (error);
 }
diff --git a/sys/kern/subr_pool.c b/sys/kern/subr_pool.c
index 62c924939d7..8f8b72d9048 100644
--- a/sys/kern/subr_pool.c
+++ b/sys/kern/subr_pool.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: subr_pool.c,v 1.65 2008/10/31 17:15:30 deraadt Exp $	*/
+/*	$OpenBSD: subr_pool.c,v 1.66 2008/10/31 17:17:06 deraadt Exp $	*/
 /*	$NetBSD: subr_pool.c,v 1.61 2001/09/26 07:14:56 chs Exp $	*/
 
 /*-
@@ -152,7 +152,7 @@ pr_find_pagehead(struct pool *pp, caddr_t page)
  */
 void
 pr_rmpage(struct pool *pp, struct pool_item_header *ph,
-    struct pool_pagelist *pq)
+     struct pool_pagelist *pq)
 {
 
 	/*
@@ -226,7 +226,7 @@ pool_init(struct pool *pp, size_t size, u_int align, u_int ioff, int flags,
 #ifdef DIAGNOSTIC
 	if (size > palloc->pa_pagesz)
 		panic("pool_init: pool item size (%lu) too large",
-		    (u_long)size);
+		      (u_long)size);
 #endif
 
 	/*
@@ -314,7 +314,7 @@ pool_init(struct pool *pp, size_t size, u_int align, u_int ioff, int flags,
 	}
 
 	/* Insert this into the list of all pools. */
-	TAILQ_INSERT_HEAD(&pool_head, pp, pr_poollist);
+	TAILQ_INSERT_TAIL(&pool_head, pp, pr_poollist);
 }
 
 void
@@ -393,9 +393,6 @@ pool_do_get(struct pool *pp, int flags)
 	struct pool_item_header *ph;
 	void *v;
 	int slowdown = 0;
-#ifdef DIAGNOSTIC
-	int i, *ip;
-#endif
 
 #ifdef DIAGNOSTIC
 	if ((flags & PR_WAITOK) != 0)
@@ -441,7 +438,7 @@ startover:
 		 */
 		if (pp->pr_hardlimit_warning != NULL &&
 		    ratecheck(&pp->pr_hardlimit_warning_last,
-		    &pp->pr_hardlimit_ratecap))
+			      &pp->pr_hardlimit_ratecap))
 			log(LOG_ERR, "%s\n", pp->pr_hardlimit_warning);
 
 		pp->pr_nfail++;
@@ -515,18 +512,10 @@ startover:
 #endif
 
 #ifdef DIAGNOSTIC
-	if (__predict_false(pi->pi_magic != PI_MAGIC))
-		panic("pool_do_get(%s): free list modified: "
-		    "page %p; item addr %p; offset 0x%x=0x%x",
-		    pp->pr_wchan, ph->ph_page, pi, 0, pi->pi_magic);
-	for (ip = (int *)pi, i = sizeof(*pi) / sizeof(int);
-	    i < pp->pr_size / sizeof(int); i++) {
-		if (ip[i] != PI_MAGIC) {
-			panic("pool_do_get(%s): free list modified: "
-			    "page %p; item addr %p; offset 0x%x=0x%x",
-			    pp->pr_wchan, ph->ph_page, pi,
-			    i * sizeof(int), ip[i]);
-		}
+	if (__predict_false(pi->pi_magic != PI_MAGIC)) {
+		panic("pool_do_get(%s): free list modified: magic=%x; page %p;"
+		       " item addr %p",
+			pp->pr_wchan, pi->pi_magic, ph->ph_page, pi);
 	}
 #endif
 
@@ -604,12 +593,6 @@ pool_do_put(struct pool *pp, void *v)
 	struct pool_item *pi = v;
 	struct pool_item_header *ph;
 	caddr_t page;
-#ifdef DIAGNOSTIC
-	int i, *ip;
-#endif
-
-	if (v == NULL)
-		panic("pool_put of NULL");
 
 #ifdef MALLOC_DEBUG
 	if (pp->pr_roflags & PR_DEBUG) {
@@ -640,8 +623,15 @@ pool_do_put(struct pool *pp, void *v)
 	 */
 #ifdef DIAGNOSTIC
 	pi->pi_magic = PI_MAGIC;
-	for (ip = v, i = 0; i < pp->pr_size / sizeof(int); i++)
-		ip[i] = PI_MAGIC;
+#endif
+#ifdef DEBUG
+	{
+		int i, *ip = v;
+
+		for (i = 0; i < pp->pr_size / sizeof(int); i++) {
+			*ip++ = PI_MAGIC;
+		}
+	}
 #endif
 
 	TAILQ_INSERT_HEAD(&ph->ph_itemlist, pi, pi_list);
@@ -791,14 +781,6 @@ pool_prime_page(struct pool *pp, caddr_t storage, struct pool_item_header *ph)
 		TAILQ_INSERT_TAIL(&ph->ph_itemlist, pi, pi_list);
 #ifdef DIAGNOSTIC
 		pi->pi_magic = PI_MAGIC;
-		{
-			int i, *ip = (int *)pi;
-	
-			for (i = sizeof(*pi)/sizeof(int);
-			    i < pp->pr_size / sizeof(int); i++) {
-				ip[i] = PI_MAGIC;
-			}
-		}
 #endif
 		cp = (caddr_t)(cp + pp->pr_size);
 	}
@@ -1121,8 +1103,6 @@ db_show_all_pools(db_expr_t expr, int haddr, db_expr_t count, char *modif)
 		PRWORD(ovflw, " %*d", 6, 1, pp->pr_minpages);
 		PRWORD(ovflw, " %*s", 6, 1, maxp);
 		PRWORD(ovflw, " %*lu\n", 5, 1, pp->pr_nidle);
-
-		pool_chk(pp, pp->pr_wchan);
 	}
 }
 
@@ -1132,19 +1112,16 @@ pool_chk_page(struct pool *pp, const char *label, struct pool_item_header *ph)
 	struct pool_item *pi;
 	caddr_t page;
 	int n;
-#ifdef DIAGNOSTIC
-	int i, *ip;
-#endif
 
 	page = (caddr_t)((u_long)ph & pp->pr_alloc->pa_pagemask);
-	printf("checking page %x\n", page);
 	if (page != ph->ph_page &&
 	    (pp->pr_roflags & PR_PHINPAGE) != 0) {
 		if (label != NULL)
 			printf("%s: ", label);
-		printf("pool(%p:%s): page inconsistency: page %p; "
-		    "at page head addr %p (p %p)\n",
-		    pp, pp->pr_wchan, ph->ph_page, ph, page);
+		printf("pool(%p:%s): page inconsistency: page %p;"
+		       " at page head addr %p (p %p)\n", pp,
+			pp->pr_wchan, ph->ph_page,
+			ph, page);
 		return 1;
 	}
 
@@ -1156,24 +1133,13 @@ pool_chk_page(struct pool *pp, const char *label, struct pool_item_header *ph)
 		if (pi->pi_magic != PI_MAGIC) {
 			if (label != NULL)
 				printf("%s: ", label);
-			printf("pool(%s): free list modified: "
-			    "page %p; item ordinal %d; addr %p "
-			    "(p %p); offset 0x%x=0x%x\n",
-			    pp->pr_wchan, ph->ph_page, n, pi, page,
-			    0, pi->pi_magic);
+			printf("pool(%s): free list modified: magic=%x;"
+			       " page %p; item ordinal %d;"
+			       " addr %p (p %p)\n",
+				pp->pr_wchan, pi->pi_magic, ph->ph_page,
+				n, pi, page);
+			panic("pool");
 		}
-		for (ip = (int *)pi, i = sizeof(*pi) / sizeof(int);
-		    i < pp->pr_size / sizeof(int); i++) {
-			if (ip[i] != PI_MAGIC) {
-				printf("pool(%s): free list modified: "
-				    "page %p; item ordinal %d; addr %p "
-				    "(p %p); offset 0x%x=0x%x\n",
-				    pp->pr_wchan, ph->ph_page, n, pi,
-				    page,
-				    i * sizeof(int), ip[i]);
-			}
-		}
-
 #endif
 		page =
 		    (caddr_t)((u_long)pi & pp->pr_alloc->pa_pagemask);
@@ -1183,8 +1149,9 @@ pool_chk_page(struct pool *pp, const char *label, struct pool_item_header *ph)
 		if (label != NULL)
 			printf("%s: ", label);
 		printf("pool(%p:%s): page inconsistency: page %p;"
-		    " item ordinal %d; addr %p (p %p)\n", pp,
-		    pp->pr_wchan, ph->ph_page, n, pi, page);
+		       " item ordinal %d; addr %p (p %p)\n", pp,
+			pp->pr_wchan, ph->ph_page,
+			n, pi, page);
 		return 1;
 	}
 	return 0;
@@ -1196,13 +1163,26 @@ pool_chk(struct pool *pp, const char *label)
 	struct pool_item_header *ph;
 	int r = 0;
 
-	LIST_FOREACH(ph, &pp->pr_emptypages, ph_pagelist)
-		r += pool_chk_page(pp, label, ph);
-	LIST_FOREACH(ph, &pp->pr_fullpages, ph_pagelist)
-		r += pool_chk_page(pp, label, ph);
-	LIST_FOREACH(ph, &pp->pr_partpages, ph_pagelist)
-		r += pool_chk_page(pp, label, ph);
+	LIST_FOREACH(ph, &pp->pr_emptypages, ph_pagelist) {
+		r = pool_chk_page(pp, label, ph);
+		if (r) {
+			goto out;
+		}
+	}
+	LIST_FOREACH(ph, &pp->pr_fullpages, ph_pagelist) {
+		r = pool_chk_page(pp, label, ph);
+		if (r) {
+			goto out;
+		}
+	}
+	LIST_FOREACH(ph, &pp->pr_partpages, ph_pagelist) {
+		r = pool_chk_page(pp, label, ph);
+		if (r) {
+			goto out;
+		}
+	}
 
+out:
 	return (r);
 }
 #endif
diff --git a/sys/kern/sys_process.c b/sys/kern/sys_process.c
index d2245e50948..d972df7a2c7 100644
--- a/sys/kern/sys_process.c
+++ b/sys/kern/sys_process.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: sys_process.c,v 1.41 2008/10/31 17:15:30 deraadt Exp $	*/
+/*	$OpenBSD: sys_process.c,v 1.42 2008/10/31 17:17:07 deraadt Exp $	*/
 /*	$NetBSD: sys_process.c,v 1.55 1996/05/15 06:17:47 tls Exp $	*/
 
 /*-
@@ -589,7 +589,6 @@ process_checkioperm(struct proc *p, struct proc *t)
 int
 process_domem(struct proc *curp, struct proc *p, struct uio *uio, int req)
 {
-	struct vmspace *vm;
 	int error;
 	vaddr_t addr;
 	vsize_t len;
@@ -605,14 +604,10 @@ process_domem(struct proc *curp, struct proc *p, struct uio *uio, int req)
 	if ((p->p_flag & P_WEXIT) || (p->p_vmspace->vm_refcnt < 1)) 
 		return(EFAULT);
 	addr = uio->uio_offset;
-
-	vm = p->p_vmspace;
-	vm->vm_refcnt++;
-
-	error = uvm_io(&vm->vm_map, uio,
+	p->p_vmspace->vm_refcnt++;  /* XXX */
+	error = uvm_io(&p->p_vmspace->vm_map, uio,
 	    (req == PT_WRITE_I) ? UVM_IO_FIXPROT : 0);
-
-	uvmspace_free(vm);
+	uvmspace_free(p->p_vmspace);
 
 	if (error == 0 && req == PT_WRITE_I)
 		pmap_proc_iflush(p, addr, len);