Index: fs/devfs/devfs_vnops.c
===================================================================
RCS file: /usr/repo/src/sys/fs/devfs/devfs_vnops.c,v
retrieving revision 1.146
diff -u -p -r1.146 devfs_vnops.c
--- fs/devfs/devfs_vnops.c	31 May 2007 11:51:49 -0000	1.146
+++ fs/devfs/devfs_vnops.c	3 Jun 2007 23:58:24 -0000
@@ -230,6 +230,7 @@ devfs_allocv(struct devfs_dirent *de, st
 		VI_LOCK(vp);
 		dev_lock();
 		dev_refl(dev);
+		/* XXX: v_rdev should be protect by vnode lock */
 		vp->v_rdev = dev;
 		KASSERT(vp->v_usecount == 1,
 		    ("%s %d (%d)\n", __func__, __LINE__, vp->v_usecount));
Index: kern/uipc_usrreq.c
===================================================================
RCS file: /usr/repo/src/sys/kern/uipc_usrreq.c,v
retrieving revision 1.205
diff -u -p -r1.205 uipc_usrreq.c
--- kern/uipc_usrreq.c	29 May 2007 12:36:00 -0000	1.205
+++ kern/uipc_usrreq.c	3 Jun 2007 23:58:36 -0000
@@ -463,7 +463,7 @@ restart:
 		goto error;
 	}
 	vp = nd.ni_vp;
-	ASSERT_VOP_LOCKED(vp, "uipc_bind");
+	ASSERT_VOP_ELOCKED(vp, "uipc_bind");
 	soun = (struct sockaddr_un *)sodupsockaddr(nam, M_WAITOK);
 
 	UNP_GLOBAL_WLOCK();
Index: kern/vfs_mount.c
===================================================================
RCS file: /usr/repo/src/sys/kern/vfs_mount.c,v
retrieving revision 1.259
diff -u -p -r1.259 vfs_mount.c
--- kern/vfs_mount.c	26 Apr 2007 08:56:56 -0000	1.259
+++ kern/vfs_mount.c	3 Jun 2007 18:17:45 -0000
@@ -1499,8 +1499,8 @@ devfs_fixup(struct thread *td)
 	VFS_ROOT(mp, LK_EXCLUSIVE, &dvp, td);
 	VI_LOCK(dvp);
 	dvp->v_iflag &= ~VI_MOUNT;
-	dvp->v_mountedhere = NULL;
 	VI_UNLOCK(dvp);
+	dvp->v_mountedhere = NULL;
 
 	/* Set up the real rootvnode, and purge the cache */
 	TAILQ_FIRST(&mountlist)->mnt_vnodecovered = NULL;
Index: fs/fifofs/fifo_vnops.c
===================================================================
RCS file: /usr/repo/src/sys/fs/fifofs/fifo_vnops.c,v
retrieving revision 1.137
diff -u -p -r1.137 fifo_vnops.c
--- fs/fifofs/fifo_vnops.c	31 May 2007 11:51:50 -0000	1.137
+++ fs/fifofs/fifo_vnops.c	6 Jun 2007 10:18:23 -0000
@@ -177,12 +177,21 @@ fifo_open(ap)
 	struct ucred *cred = ap->a_cred;
 	struct file *fp = ap->a_fp;
 	struct socket *rso, *wso;
-	int error;
+	int downgrade = 0, error;
 
 	ASSERT_VOP_LOCKED(vp, "fifo_open");
 	if (fp == NULL)
 		return (EINVAL);
+recheck:
 	if ((fip = vp->v_fifoinfo) == NULL) {
+		if (VOP_ISLOCKED(vp, td) == LK_SHARED) {
+			vn_lock(vp, LK_UPGRADE | LK_RETRY, td);
+			downgrade = 1;
+			/*
+			 * LK_UPGRADE can drop shared lock, so we need to recheck.
+			 */
+			goto recheck;
+		}
 		MALLOC(fip, struct fifoinfo *, sizeof(*fip), M_VNODE, M_WAITOK);
 		error = socreate(AF_LOCAL, &rso, SOCK_STREAM, 0, cred, td);
 		if (error)
@@ -210,6 +219,8 @@ fail1:
 		    ("fifo_open: v_fifoinfo race"));
 		vp->v_fifoinfo = fip;
 	}
+	if (downgrade)
+		vn_lock(vp, LK_DOWNGRADE | LK_RETRY, td);
 
 	/*
 	 * General access to fi_readers and fi_writers is protected using