Index: kern/kern_verifiedexec.c
===================================================================
RCS file: /cvsroot/src/sys/kern/kern_verifiedexec.c,v
retrieving revision 1.128
diff -u -p -r1.128 kern_verifiedexec.c
--- kern/kern_verifiedexec.c	20 Nov 2011 10:32:33 -0000	1.128
+++ kern/kern_verifiedexec.c	18 Jan 2012 17:24:00 -0000
@@ -411,11 +411,9 @@ veriexec_fp_calc(struct lwp *l, struct v
 	size_t resid, npages;
 	int error, do_perpage, pagen;
 
-	if (lock_state == VERIEXEC_UNLOCKED)
-		vn_lock(vp, LK_SHARED | LK_RETRY);
+	KASSERT(VOP_ISLOCKED(vp));
+
 	error = VOP_GETATTR(vp, &va, l->l_cred);
-	if (lock_state == VERIEXEC_UNLOCKED)
-		VOP_UNLOCK(vp);
 	if (error)
 		return (error);
 
@@ -450,9 +448,7 @@ veriexec_fp_calc(struct lwp *l, struct v
 		    (va.va_size - offset) : PAGE_SIZE;
 
 		error = vn_rdwr(UIO_READ, vp, buf, len, offset,
-				UIO_SYSSPACE,
-				((lock_state == VERIEXEC_LOCKED)?
-				 IO_NODELOCKED : 0),
+				UIO_SYSSPACE, IO_NODELOCKED,
 				l->l_cred, &resid, NULL);
 
 		if (error) {
@@ -1299,8 +1295,10 @@ veriexec_file_add(struct lwp *l, prop_di
 
 		digest = kmem_zalloc(vfe->ops->hash_len, KM_SLEEP);
 
+		vn_lock(vp, LK_SHARED | LK_RETRY);
 		error = veriexec_fp_calc(l, vp, VERIEXEC_UNLOCKED,
 					 vfe, digest);
+		VOP_UNLOCK(vp);
 		if (error) {
 			kmem_free(digest, vfe->ops->hash_len);
 			goto unlock_out;
Index: uvm/uvm_mmap.c
===================================================================
RCS file: /cvsroot/src/sys/uvm/uvm_mmap.c,v
retrieving revision 1.143
diff -u -p -r1.143 uvm_mmap.c
--- uvm/uvm_mmap.c	5 Jan 2012 15:19:53 -0000	1.143
+++ uvm/uvm_mmap.c	18 Jan 2012 17:24:00 -0000
@@ -507,8 +507,10 @@ sys_mmap(struct lwp *l, const struct sys
 		 * XXX: if the mapping is not executable. Harmless, but will be
 		 * XXX: fixed as part of other changes.
 		 */
-		if (veriexec_verify(l, handle, "(mmap)", VERIEXEC_INDIRECT,
-		    NULL)) {
+		vn_lock(vp, LK_SHARED | LK_RETRY);
+		error = veriexec_verify(l, handle, "(mmap)", VERIEXEC_INDIRECT, NULL);
+		VOP_UNLOCK(vp);
+		if (error) {
 			/*
 			 * Don't allow executable mappings if we can't
 			 * indirectly execute the file.