Index: tty.c
===================================================================
RCS file: /home/ncvs/src/sys/kern/tty.c,v
retrieving revision 1.249
diff -u -r1.249 tty.c
--- tty.c	13 Apr 2005 13:56:17 -0000	1.249
+++ tty.c	9 May 2005 00:13:41 -0000
@@ -329,8 +329,10 @@
 	tp->t_gen++;
 	tp->t_line = TTYDISC;
 	tp->t_hotchar = 0;
+	sx_slock(&proctree_lock);
 	tp->t_pgrp = NULL;
 	tp->t_session = NULL;
+	sx_sunlock(&proctree_lock);
 	tp->t_state = 0;
 	knlist_clear(&tp->t_rsel.si_note, 0);
 	knlist_clear(&tp->t_wsel.si_note, 0);
@@ -1229,8 +1231,8 @@
 			sx_sunlock(&proctree_lock);
 			return (EPERM);
 		}
-		sx_sunlock(&proctree_lock);
 		tp->t_pgrp = pgrp;
+		sx_sunlock(&proctree_lock);
 		break;
 	}
 	case TIOCSTAT:			/* simulate control-T */
@@ -1242,11 +1244,13 @@
 		if (bcmp((caddr_t)&tp->t_winsize, data,
 		    sizeof (struct winsize))) {
 			tp->t_winsize = *(struct winsize *)data;
+			sx_slock(&proctree_lock);
 			if (tp->t_pgrp != NULL) {
 				PGRP_LOCK(tp->t_pgrp);
 				pgsignal(tp->t_pgrp, SIGWINCH, 1);
 				PGRP_UNLOCK(tp->t_pgrp);
 			}
+			sx_sunlock(&proctree_lock);
 		}
 		break;
 	case TIOCSDRAINWAIT:
@@ -1937,11 +1941,13 @@
 		 */
 		if (CCEQ(cc[VDSUSP], c) &&
 		    ISSET(lflag, IEXTEN | ISIG) == (IEXTEN | ISIG)) {
+			sx_slock(&proctree_lock);
 			if (tp->t_pgrp != NULL) {
 				PGRP_LOCK(tp->t_pgrp);
 				pgsignal(tp->t_pgrp, SIGTSTP, 1);
 				PGRP_UNLOCK(tp->t_pgrp);
 			}
+			sx_sunlock(&proctree_lock);
 			if (first) {
 				error = ttysleep(tp, &lbolt, TTIPRI | PCATCH,
 						 "ttybg3", 0);
@@ -2551,6 +2557,7 @@
 	 * On return following a ttyprintf(), we set tp->t_rocount to 0 so
 	 * that pending input will be retyped on BS.
 	 */
+	sx_slock(&proctree_lock);
 	if (tp->t_session == NULL) {
 		ttyprintf(tp, "not a controlling terminal\n");
 		tp->t_rocount = 0;
@@ -2561,7 +2568,6 @@
 		tp->t_rocount = 0;
 		return;
 	}
-	sx_slock(&proctree_lock);
 	if ((p = LIST_FIRST(&tp->t_pgrp->pg_members)) == NULL) {
 		sx_sunlock(&proctree_lock);
 		ttyprintf(tp, "empty foreground process group\n");
@@ -3041,10 +3047,12 @@
 		XT_COPY(state);
 		XT_COPY(flags);
 		XT_COPY(timeout);
+		sx_slock(&proctree_lock);
 		if (tp->t_pgrp != NULL)
 			xt.xt_pgid = tp->t_pgrp->pg_id;
 		if (tp->t_session != NULL)
 			xt.xt_sid = tp->t_session->s_sid;
+		sx_sunlock(&proctree_lock);
 		XT_COPY(termios);
 		XT_COPY(winsize);
 		XT_COPY(column);