Index: sys/kern/uipc_usrreq.c
===================================================================
--- sys/kern/uipc_usrreq.c
+++ sys/kern/uipc_usrreq.c
@@ -257,13 +257,19 @@
 #define	UNP_DEFERRED_LOCK()		mtx_lock(&unp_defers_lock)
 #define	UNP_DEFERRED_UNLOCK()		mtx_unlock(&unp_defers_lock)
 
+#define UNP_REF_LIST_LOCK()		UNP_DEFERRED_LOCK();
+#define UNP_REF_LIST_UNLOCK()		UNP_DEFERRED_UNLOCK();
+
 #define UNP_PCB_LOCK_INIT(unp)		mtx_init(&(unp)->unp_mtx,	\
 					    "unp_mtx", "unp_mtx",	\
-					    MTX_DUPOK|MTX_DEF|MTX_RECURSE)
+					    MTX_DUPOK|MTX_DEF)
 #define	UNP_PCB_LOCK_DESTROY(unp)	mtx_destroy(&(unp)->unp_mtx)
 #define	UNP_PCB_LOCK(unp)		mtx_lock(&(unp)->unp_mtx)
+#define	UNP_PCB_TRYLOCK(unp)		mtx_trylock(&(unp)->unp_mtx)
 #define	UNP_PCB_UNLOCK(unp)		mtx_unlock(&(unp)->unp_mtx)
+#define	UNP_PCB_OWNED(unp)		mtx_owned(&(unp)->unp_mtx)
 #define	UNP_PCB_LOCK_ASSERT(unp)	mtx_assert(&(unp)->unp_mtx, MA_OWNED)
+#define	UNP_PCB_UNLOCK_ASSERT(unp)	mtx_assert(&(unp)->unp_mtx, MA_NOTOWNED)
 
 static int	uipc_connect2(struct socket *, struct socket *);
 static int	uipc_ctloutput(struct socket *, struct sockopt *);
@@ -289,6 +295,63 @@
 static struct mbuf	*unp_addsockcred(struct thread *, struct mbuf *);
 static void	unp_process_defers(void * __unused, int);
 
+
+static void
+unp_pcb_hold(struct unpcb *unp)
+{
+	MPASS(unp->unp_refcount);
+	refcount_acquire(&unp->unp_refcount);
+}
+
+static int
+unp_pcb_rele(struct unpcb *unp)
+{
+	int freed;
+
+	UNP_PCB_LOCK_ASSERT(unp);
+	MPASS(unp->unp_refcount);
+	if ((freed = refcount_release(&unp->unp_refcount))) {
+		/* we got here with having detached? */
+		MPASS(unp->unp_socket == NULL);
+		UNP_PCB_UNLOCK(unp);
+		UNP_PCB_LOCK_DESTROY(unp);
+		uma_zfree(unp_zone, unp);
+	}
+	return (freed);
+}
+
+static void
+unp_pcb_lock2(struct unpcb *unp, struct unpcb *unp2)
+{
+	UNP_PCB_UNLOCK_ASSERT(unp);
+	UNP_PCB_UNLOCK_ASSERT(unp2);
+	if ((uintptr_t)unp2 > (uintptr_t)unp) {
+		UNP_PCB_LOCK(unp);
+		UNP_PCB_LOCK(unp2);
+	} else {
+		UNP_PCB_LOCK(unp2);
+		UNP_PCB_LOCK(unp);
+	}
+}
+
+#define unp_pcb_owned_lock2(unp, unp2, freed) do {	\
+		freed = 0;											\
+		UNP_PCB_LOCK_ASSERT((unp));							\
+		UNP_PCB_UNLOCK_ASSERT((unp2));						\
+		if (__predict_true(UNP_PCB_TRYLOCK((unp2))))		\
+			;												\
+		else if ((uintptr_t)(unp2) > (uintptr_t)(unp))		\
+			UNP_PCB_LOCK((unp2));							\
+		else {												\
+			unp_pcb_hold((unp2));							\
+			UNP_PCB_UNLOCK((unp));							\
+			UNP_PCB_LOCK((unp2));							\
+			UNP_PCB_LOCK((unp));							\
+			freed = unp_pcb_rele((unp2));					\
+		}													\
+} while (0)
+
+
 /*
  * Definitions of protocols supported in the LOCAL domain.
  */
@@ -344,17 +407,15 @@
 
 	unp = sotounpcb(so);
 	KASSERT(unp != NULL, ("uipc_abort: unp == NULL"));
+	UNP_PCB_UNLOCK_ASSERT(unp);
 
-	UNP_LINK_WLOCK();
 	UNP_PCB_LOCK(unp);
 	unp2 = unp->unp_conn;
 	if (unp2 != NULL) {
-		UNP_PCB_LOCK(unp2);
+		unp_pcb_hold(unp2);
 		unp_drop(unp2);
-		UNP_PCB_UNLOCK(unp2);
 	}
 	UNP_PCB_UNLOCK(unp);
-	UNP_LINK_WUNLOCK();
 }
 
 static int
@@ -551,14 +612,12 @@
 	ASSERT_VOP_ELOCKED(vp, "uipc_bind");
 	soun = (struct sockaddr_un *)sodupsockaddr(nam, M_WAITOK);
 
-	UNP_LINK_WLOCK();
 	UNP_PCB_LOCK(unp);
 	VOP_UNP_BIND(vp, unp);
 	unp->unp_vnode = vp;
 	unp->unp_addr = soun;
 	unp->unp_flags &= ~UNP_BINDING;
 	UNP_PCB_UNLOCK(unp);
-	UNP_LINK_WUNLOCK();
 	VOP_UNLOCK(vp, 0);
 	vn_finished_write(mp);
 	free(buf, M_TEMP);
@@ -585,9 +644,7 @@
 	int error;
 
 	KASSERT(td == curthread, ("uipc_connect: td != curthread"));
-	UNP_LINK_WLOCK();
 	error = unp_connect(so, nam, td);
-	UNP_LINK_WUNLOCK();
 	return (error);
 }
 
@@ -598,9 +655,7 @@
 	int error;
 
 	KASSERT(td == curthread, ("uipc_connectat: td != curthread"));
-	UNP_LINK_WLOCK();
 	error = unp_connectat(fd, so, nam, td);
-	UNP_LINK_WUNLOCK();
 	return (error);
 }
 
@@ -609,26 +664,36 @@
 {
 	struct unpcb *unp, *unp2;
 	struct vnode *vp = NULL;
-
+	struct mtx *vplock;
+	int freed;
 	unp = sotounpcb(so);
 	KASSERT(unp != NULL, ("uipc_close: unp == NULL"));
 
-	UNP_LINK_WLOCK();
+
+	if ((vp = unp->unp_vnode) != NULL) {
+		vplock = mtx_pool_find(mtxpool_sleep, vp);
+		mtx_lock(vplock);
+	}
 	UNP_PCB_LOCK(unp);
 	unp2 = unp->unp_conn;
-	if (unp2 != NULL) {
-		UNP_PCB_LOCK(unp2);
-		unp_disconnect(unp, unp2);
-		UNP_PCB_UNLOCK(unp2);
-	}
 	if (SOLISTENING(so) && ((vp = unp->unp_vnode) != NULL)) {
 		VOP_UNP_DETACH(vp);
 		unp->unp_vnode = NULL;
 	}
-	UNP_PCB_UNLOCK(unp);
-	UNP_LINK_WUNLOCK();
-	if (vp)
+	unp_pcb_hold(unp);
+	if (unp2 != NULL) {
+		unp_pcb_hold(unp2);
+		unp_pcb_owned_lock2(unp, unp2, freed);
+		unp_disconnect(unp, unp2);
+		if (unp_pcb_rele(unp2) == 0)
+			UNP_PCB_UNLOCK(unp2);
+	}
+	if (unp_pcb_rele(unp) == 0)
+		UNP_PCB_UNLOCK(unp);
+	if (vp) {
+		mtx_unlock(vplock);
 		vrele(vp);
+	}
 }
 
 static int
@@ -637,17 +702,14 @@
 	struct unpcb *unp, *unp2;
 	int error;
 
-	UNP_LINK_WLOCK();
 	unp = so1->so_pcb;
 	KASSERT(unp != NULL, ("uipc_connect2: unp == NULL"));
-	UNP_PCB_LOCK(unp);
 	unp2 = so2->so_pcb;
 	KASSERT(unp2 != NULL, ("uipc_connect2: unp2 == NULL"));
-	UNP_PCB_LOCK(unp2);
+	unp_pcb_lock2(unp, unp2);
 	error = unp_connect2(so1, so2, PRU_CONNECT2);
 	UNP_PCB_UNLOCK(unp2);
 	UNP_PCB_UNLOCK(unp);
-	UNP_LINK_WUNLOCK();
 	return (error);
 }
 
@@ -658,6 +720,7 @@
 	struct sockaddr_un *saved_unp_addr;
 	struct vnode *vp;
 	int freeunp, local_unp_rights;
+	struct mtx *vplock;
 
 	unp = sotounpcb(so);
 	KASSERT(unp != NULL, ("uipc_detach: unp == NULL"));
@@ -669,49 +732,77 @@
 	LIST_REMOVE(unp, unp_link);
 	unp->unp_gencnt = ++unp_gencnt;
 	--unp_count;
+	UNP_LINK_WUNLOCK();
+
+	UNP_PCB_UNLOCK_ASSERT(unp);
+ restart:
+	if ((vp = unp->unp_vnode) != NULL) {
+		vplock = mtx_pool_find(mtxpool_sleep, vp);
+		mtx_lock(vplock);
+	}
 	UNP_PCB_LOCK(unp);
-	if ((unp->unp_flags & UNP_NASCENT) != 0)
+	if ((unp2 = unp->unp_conn) != NULL) {
+		unp_pcb_owned_lock2(unp, unp2, freeunp);
+		if (freeunp)
+			unp2 = NULL;
+	}
+	if (unp->unp_vnode != vp &&
+		unp->unp_vnode != NULL) {
+		mtx_unlock(vplock);
+		UNP_PCB_UNLOCK(unp);
+		if (unp2)
+			UNP_PCB_UNLOCK(unp2);
+		goto restart;
+	}
+	if ((unp->unp_flags & UNP_NASCENT) != 0) {
+		if (unp2)
+			UNP_PCB_UNLOCK(unp2);
 		goto teardown;
-
+	}
 	if ((vp = unp->unp_vnode) != NULL) {
 		VOP_UNP_DETACH(vp);
 		unp->unp_vnode = NULL;
 	}
-	unp2 = unp->unp_conn;
+	unp_pcb_hold(unp);
 	if (unp2 != NULL) {
-		UNP_PCB_LOCK(unp2);
+		unp_pcb_hold(unp2);
 		unp_disconnect(unp, unp2);
-		UNP_PCB_UNLOCK(unp2);
+		if (unp_pcb_rele(unp2) == 0)
+			UNP_PCB_UNLOCK(unp2);
 	}
-
-	/*
-	 * We hold the linkage lock exclusively, so it's OK to acquire
-	 * multiple pcb locks at a time.
-	 */
+	UNP_PCB_UNLOCK(unp);
+	UNP_REF_LIST_LOCK();
 	while (!LIST_EMPTY(&unp->unp_refs)) {
 		struct unpcb *ref = LIST_FIRST(&unp->unp_refs);
 
-		UNP_PCB_LOCK(ref);
+		unp_pcb_hold(ref);
+		UNP_REF_LIST_UNLOCK();
+
+		MPASS(ref != unp);
+		UNP_PCB_UNLOCK_ASSERT(ref);
 		unp_drop(ref);
-		UNP_PCB_UNLOCK(ref);
+		UNP_REF_LIST_LOCK();
 	}
+
+	UNP_REF_LIST_UNLOCK();
+	UNP_PCB_LOCK(unp);
+	freeunp = unp_pcb_rele(unp);
+	MPASS(freeunp == 0);
 	local_unp_rights = unp_rights;
 teardown:
-	UNP_LINK_WUNLOCK();
 	unp->unp_socket->so_pcb = NULL;
 	saved_unp_addr = unp->unp_addr;
 	unp->unp_addr = NULL;
-	unp->unp_refcount--;
-	freeunp = (unp->unp_refcount == 0);
+	unp->unp_socket = NULL;
+	freeunp = unp_pcb_rele(unp);
 	if (saved_unp_addr != NULL)
 		free(saved_unp_addr, M_SONAME);
-	if (freeunp) {
-		UNP_PCB_LOCK_DESTROY(unp);
-		uma_zfree(unp_zone, unp);
-	} else
+	if (!freeunp)
 		UNP_PCB_UNLOCK(unp);
-	if (vp)
+	if (vp) {
+		mtx_unlock(vplock);
 		vrele(vp);
+	}
 	if (local_unp_rights)
 		taskqueue_enqueue_timeout(taskqueue_thread, &unp_gc_task, -1);
 }
@@ -720,20 +811,28 @@
 uipc_disconnect(struct socket *so)
 {
 	struct unpcb *unp, *unp2;
+	int freed;
 
 	unp = sotounpcb(so);
 	KASSERT(unp != NULL, ("uipc_disconnect: unp == NULL"));
 
-	UNP_LINK_WLOCK();
 	UNP_PCB_LOCK(unp);
-	unp2 = unp->unp_conn;
-	if (unp2 != NULL) {
-		UNP_PCB_LOCK(unp2);
-		unp_disconnect(unp, unp2);
-		UNP_PCB_UNLOCK(unp2);
+	if ((unp2 = unp->unp_conn) == NULL) {
+		UNP_PCB_UNLOCK(unp);
+		return (0);
 	}
-	UNP_PCB_UNLOCK(unp);
-	UNP_LINK_WUNLOCK();
+	unp_pcb_owned_lock2(unp, unp2, freed);
+	if (__predict_false(freed)) {
+		UNP_PCB_UNLOCK(unp);
+		return (0);
+	}
+	unp_pcb_hold(unp2);
+	unp_pcb_hold(unp);
+	unp_disconnect(unp, unp2);
+	if (unp_pcb_rele(unp) == 0)
+		UNP_PCB_UNLOCK(unp);
+	if (unp_pcb_rele(unp2) == 0)
+		UNP_PCB_UNLOCK(unp2);
 	return (0);
 }
 
@@ -851,6 +950,28 @@
 	return (0);
 }
 
+static int
+connect_internal(struct socket *so, struct sockaddr *nam, struct thread *td)
+{
+	int error;
+	struct unpcb *unp;
+
+	unp = so->so_pcb;
+	if (unp->unp_conn != NULL)
+		return (EISCONN);
+	error = unp_connect(so, nam, td);
+	if (error)
+		return (error);
+	UNP_PCB_LOCK(unp);
+	if (unp->unp_conn == NULL) {
+		UNP_PCB_UNLOCK(unp);
+		if (error == 0)
+			error = ENOTCONN;
+	}
+	return (error);
+}
+
+
 static int
 uipc_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *nam,
     struct mbuf *control, struct thread *td)
@@ -858,7 +979,7 @@
 	struct unpcb *unp, *unp2;
 	struct socket *so2;
 	u_int mbcnt, sbcc;
-	int error = 0;
+	int freed, error;
 
 	unp = sotounpcb(so);
 	KASSERT(unp != NULL, ("%s: unp == NULL", __func__));
@@ -866,49 +987,48 @@
 	    so->so_type == SOCK_SEQPACKET,
 	    ("%s: socktype %d", __func__, so->so_type));
 
+	freed = error = 0;
 	if (flags & PRUS_OOB) {
 		error = EOPNOTSUPP;
 		goto release;
 	}
 	if (control != NULL && (error = unp_internalize(&control, td)))
 		goto release;
-	if ((nam != NULL) || (flags & PRUS_EOF))
-		UNP_LINK_WLOCK();
-	else
-		UNP_LINK_RLOCK();
+
+	unp2 = NULL;
 	switch (so->so_type) {
 	case SOCK_DGRAM:
 	{
 		const struct sockaddr *from;
 
-		unp2 = unp->unp_conn;
 		if (nam != NULL) {
-			UNP_LINK_WLOCK_ASSERT();
-			if (unp2 != NULL) {
-				error = EISCONN;
-				break;
-			}
-			error = unp_connect(so, nam, td);
-			if (error)
+			/*
+			 * We return with UNP_PCB_LOCK_HELD so we know that
+			 * the reference is live if the pointer is valid.
+			 */
+			if ((error = connect_internal(so, nam, td)))
 				break;
+			MPASS(unp->unp_conn != NULL);
 			unp2 = unp->unp_conn;
-		}
+		} else  {
+			UNP_PCB_LOCK(unp);
 
-		/*
-		 * Because connect() and send() are non-atomic in a sendto()
-		 * with a target address, it's possible that the socket will
-		 * have disconnected before the send() can run.  In that case
-		 * return the slightly counter-intuitive but otherwise
-		 * correct error that the socket is not connected.
-		 */
-		if (unp2 == NULL) {
-			error = ENOTCONN;
-			break;
+			/*
+			 * Because connect() and send() are non-atomic in a sendto()
+			 * with a target address, it's possible that the socket will
+			 * have disconnected before the send() can run.  In that case
+			 * return the slightly counter-intuitive but otherwise
+			 * correct error that the socket is not connected.
+			 */
+			if ((unp2 = unp->unp_conn)  == NULL) {
+				UNP_PCB_UNLOCK(unp);
+				error = ENOTCONN;
+				break;
+			}
 		}
 		/* Lockless read. */
 		if (unp2->unp_flags & UNP_WANTCRED)
 			control = unp_addsockcred(td, control);
-		UNP_PCB_LOCK(unp);
 		if (unp->unp_addr != NULL)
 			from = (struct sockaddr *)unp->unp_addr;
 		else
@@ -925,12 +1045,16 @@
 			error = ENOBUFS;
 		}
 		if (nam != NULL) {
-			UNP_LINK_WLOCK_ASSERT();
-			UNP_PCB_LOCK(unp2);
+			unp_pcb_hold(unp);
+			unp_pcb_hold(unp2);
+			unp_pcb_owned_lock2(unp, unp2, freed);
 			unp_disconnect(unp, unp2);
-			UNP_PCB_UNLOCK(unp2);
-		}
-		UNP_PCB_UNLOCK(unp);
+			if (unp_pcb_rele(unp2) == 0)
+				UNP_PCB_UNLOCK(unp2);
+			if (unp_pcb_rele(unp) == 0)
+				UNP_PCB_UNLOCK(unp);
+		} else
+			UNP_PCB_UNLOCK(unp);
 		break;
 	}
 
@@ -938,42 +1062,36 @@
 	case SOCK_STREAM:
 		if ((so->so_state & SS_ISCONNECTED) == 0) {
 			if (nam != NULL) {
-				UNP_LINK_WLOCK_ASSERT();
-				error = unp_connect(so, nam, td);
-				if (error)
-					break;	/* XXX */
-			} else {
+				if ((error = connect_internal(so, nam, td)))
+					break;
+			} else  {
 				error = ENOTCONN;
 				break;
 			}
-		}
-
-		/* Lockless read. */
-		if (so->so_snd.sb_state & SBS_CANTSENDMORE) {
+		} else if ((unp2 = unp->unp_conn) == NULL) {
+			error = ENOTCONN;
+			break;
+		} else if (so->so_snd.sb_state & SBS_CANTSENDMORE) {
 			error = EPIPE;
 			break;
+		} else {
+			UNP_PCB_LOCK(unp);
+			if ((unp2 = unp->unp_conn) == NULL) {
+				UNP_PCB_UNLOCK(unp);
+				error = ENOTCONN;
+				break;
+			}
 		}
-
-		/*
-		 * Because connect() and send() are non-atomic in a sendto()
-		 * with a target address, it's possible that the socket will
-		 * have disconnected before the send() can run.  In that case
-		 * return the slightly counter-intuitive but otherwise
-		 * correct error that the socket is not connected.
-		 *
-		 * Locking here must be done carefully: the linkage lock
-		 * prevents interconnections between unpcbs from changing, so
-		 * we can traverse from unp to unp2 without acquiring unp's
-		 * lock.  Socket buffer locks follow unpcb locks, so we can
-		 * acquire both remote and lock socket buffer locks.
-		 */
-		unp2 = unp->unp_conn;
-		if (unp2 == NULL) {
+		unp_pcb_hold(unp2);
+		UNP_PCB_UNLOCK(unp);
+		UNP_PCB_LOCK(unp2);
+		if ((so2 = unp2->unp_socket) == NULL) {
+			UNP_PCB_UNLOCK(unp2);
+			unp_pcb_rele(unp2);
 			error = ENOTCONN;
 			break;
 		}
-		so2 = unp2->unp_socket;
-		UNP_PCB_LOCK(unp2);
+		unp_pcb_rele(unp2);
 		SOCKBUF_LOCK(&so2->so_rcv);
 		if (unp2->unp_flags & UNP_WANTCRED) {
 			/*
@@ -1046,12 +1164,6 @@
 		unp_shutdown(unp);
 		UNP_PCB_UNLOCK(unp);
 	}
-
-	if ((nam != NULL) || (flags & PRUS_EOF))
-		UNP_LINK_WUNLOCK();
-	else
-		UNP_LINK_RUNLOCK();
-
 	if (control != NULL && error != 0)
 		unp_dispose_mbuf(control);
 
@@ -1124,12 +1236,10 @@
 	unp = sotounpcb(so);
 	KASSERT(unp != NULL, ("uipc_shutdown: unp == NULL"));
 
-	UNP_LINK_WLOCK();
 	UNP_PCB_LOCK(unp);
 	socantsendmore(so);
 	unp_shutdown(unp);
 	UNP_PCB_UNLOCK(unp);
-	UNP_LINK_WUNLOCK();
 	return (0);
 }
 
@@ -1333,16 +1443,11 @@
 	char buf[SOCK_MAXADDRLEN];
 	struct sockaddr *sa;
 	cap_rights_t rights;
-	int error, len;
+	int error, len, freed;
+	struct mtx *vplock;
 
 	if (nam->sa_family != AF_UNIX)
 		return (EAFNOSUPPORT);
-
-	UNP_LINK_WLOCK_ASSERT();
-
-	unp = sotounpcb(so);
-	KASSERT(unp != NULL, ("unp_connect: unp == NULL"));
-
 	if (nam->sa_len > sizeof(struct sockaddr_un))
 		return (EINVAL);
 	len = nam->sa_len - offsetof(struct sockaddr_un, sun_path);
@@ -1351,12 +1456,13 @@
 	bcopy(soun->sun_path, buf, len);
 	buf[len] = 0;
 
+	unp = sotounpcb(so);
+	KASSERT(unp != NULL, ("unp_connect: unp == NULL"));
 	UNP_PCB_LOCK(unp);
 	if (unp->unp_flags & UNP_CONNECTING) {
 		UNP_PCB_UNLOCK(unp);
 		return (EALREADY);
 	}
-	UNP_LINK_WUNLOCK();
 	unp->unp_flags |= UNP_CONNECTING;
 	UNP_PCB_UNLOCK(unp);
 
@@ -1393,7 +1499,8 @@
 	 * Lock linkage lock for two reasons: make sure v_socket is stable,
 	 * and to protect simultaneous locking of multiple pcbs.
 	 */
-	UNP_LINK_WLOCK();
+	vplock = mtx_pool_find(mtxpool_sleep, vp);
+	mtx_lock(vplock);
 	VOP_UNP_CONNECT(vp, &unp2);
 	if (unp2 == NULL) {
 		error = ECONNREFUSED;
@@ -1404,8 +1511,7 @@
 		error = EPROTOTYPE;
 		goto bad2;
 	}
-	UNP_PCB_LOCK(unp);
-	UNP_PCB_LOCK(unp2);
+	unp_pcb_lock2(unp, unp2);
 	if (so->so_proto->pr_flags & PR_CONNREQUIRED) {
 		if (so2->so_options & SO_ACCEPTCONN) {
 			CURVNET_SET(so2->so_vnet);
@@ -1418,7 +1524,9 @@
 			goto bad3;
 		}
 		unp3 = sotounpcb(so2);
-		UNP_PCB_LOCK(unp3);
+		UNP_PCB_UNLOCK(unp);
+		unp_pcb_owned_lock2(unp2, unp3, freed);
+		MPASS(!freed);
 		if (unp2->unp_addr != NULL) {
 			bcopy(unp2->unp_addr, sa, unp2->unp_addr->sun_len);
 			unp3->unp_addr = (struct sockaddr_un *) sa;
@@ -1445,6 +1553,8 @@
 			unp3->unp_flags |= UNP_WANTCRED;
 		UNP_PCB_UNLOCK(unp2);
 		unp2 = unp3;
+		unp_pcb_owned_lock2(unp2, unp, freed);
+		MPASS(!freed);
 #ifdef MAC
 		mac_socketpeer_set_from_socket(so, so2);
 		mac_socketpeer_set_from_socket(so2, so);
@@ -1459,12 +1569,12 @@
 	UNP_PCB_UNLOCK(unp2);
 	UNP_PCB_UNLOCK(unp);
 bad2:
-	UNP_LINK_WUNLOCK();
+	mtx_unlock(vplock);
 bad:
-	if (vp != NULL)
+	if (vp != NULL) {
 		vput(vp);
+	}
 	free(sa, M_SONAME);
-	UNP_LINK_WLOCK();
 	UNP_PCB_LOCK(unp);
 	unp->unp_flags &= ~UNP_CONNECTING;
 	UNP_PCB_UNLOCK(unp);
@@ -1482,7 +1592,6 @@
 	unp2 = sotounpcb(so2);
 	KASSERT(unp2 != NULL, ("unp_connect2: unp2 == NULL"));
 
-	UNP_LINK_WLOCK_ASSERT();
 	UNP_PCB_LOCK_ASSERT(unp);
 	UNP_PCB_LOCK_ASSERT(unp2);
 
@@ -1490,10 +1599,13 @@
 		return (EPROTOTYPE);
 	unp2->unp_flags &= ~UNP_NASCENT;
 	unp->unp_conn = unp2;
-
+	unp_pcb_hold(unp2);
+	unp_pcb_hold(unp);
 	switch (so->so_type) {
 	case SOCK_DGRAM:
+		UNP_REF_LIST_LOCK();
 		LIST_INSERT_HEAD(&unp2->unp_refs, unp, unp_reflink);
+		UNP_REF_LIST_UNLOCK();
 		soisconnected(so);
 		break;
 
@@ -1517,31 +1629,48 @@
 static void
 unp_disconnect(struct unpcb *unp, struct unpcb *unp2)
 {
-	struct socket *so;
+	struct socket *so, *so2;
+	int rele, freed;
 
 	KASSERT(unp2 != NULL, ("unp_disconnect: unp2 == NULL"));
 
-	UNP_LINK_WLOCK_ASSERT();
 	UNP_PCB_LOCK_ASSERT(unp);
 	UNP_PCB_LOCK_ASSERT(unp2);
 
+	if (unp->unp_conn == NULL && unp2->unp_conn == NULL)
+		return;
+
+	MPASS(unp->unp_conn == unp2);
 	unp->unp_conn = NULL;
+	rele = 0;
+	so = unp->unp_socket;
+	so2 = unp2->unp_socket;
 	switch (unp->unp_socket->so_type) {
 	case SOCK_DGRAM:
+		UNP_REF_LIST_LOCK();
 		LIST_REMOVE(unp, unp_reflink);
-		so = unp->unp_socket;
-		SOCK_LOCK(so);
-		so->so_state &= ~SS_ISCONNECTED;
-		SOCK_UNLOCK(so);
+		UNP_REF_LIST_UNLOCK();
+		if (so) {
+			SOCK_LOCK(so);
+			so->so_state &= ~SS_ISCONNECTED;
+			SOCK_UNLOCK(so);
+		}
 		break;
 
 	case SOCK_STREAM:
 	case SOCK_SEQPACKET:
-		soisdisconnected(unp->unp_socket);
+		if (so)
+			soisdisconnected(so);
+		MPASS(unp2->unp_conn == unp);
 		unp2->unp_conn = NULL;
-		soisdisconnected(unp2->unp_socket);
+		if (so2)
+			soisdisconnected(so2);
 		break;
 	}
+	freed = unp_pcb_rele(unp);
+	MPASS(freed == 0);
+	freed = unp_pcb_rele(unp2);
+	MPASS(freed == 0);
 }
 
 /*
@@ -1625,7 +1754,7 @@
 				continue;
 			}
 			unp_list[i++] = unp;
-			unp->unp_refcount++;
+			unp_pcb_hold(unp);
 		}
 		UNP_PCB_UNLOCK(unp);
 	}
@@ -1637,8 +1766,9 @@
 	for (i = 0; i < n; i++) {
 		unp = unp_list[i];
 		UNP_PCB_LOCK(unp);
-		unp->unp_refcount--;
-	        if (unp->unp_refcount != 0 && unp->unp_gencnt <= gencnt) {
+		freeunp = unp_pcb_rele(unp);
+
+		if (freeunp == 0 && unp->unp_gencnt <= gencnt) {
 			xu->xu_len = sizeof *xu;
 			xu->xu_unpp = unp;
 			/*
@@ -1665,14 +1795,8 @@
 			sotoxsocket(unp->unp_socket, &xu->xu_socket);
 			UNP_PCB_UNLOCK(unp);
 			error = SYSCTL_OUT(req, xu, sizeof *xu);
-		} else {
-			freeunp = (unp->unp_refcount == 0);
+		} else  if (freeunp == 0)
 			UNP_PCB_UNLOCK(unp);
-			if (freeunp) {
-				UNP_PCB_LOCK_DESTROY(unp);
-				uma_zfree(unp_zone, unp);
-			}
-		}
 	}
 	free(xu, M_TEMP);
 	if (!error) {
@@ -1709,7 +1833,6 @@
 	struct unpcb *unp2;
 	struct socket *so;
 
-	UNP_LINK_WLOCK_ASSERT();
 	UNP_PCB_LOCK_ASSERT(unp);
 
 	unp2 = unp->unp_conn;
@@ -1726,22 +1849,27 @@
 {
 	struct socket *so = unp->unp_socket;
 	struct unpcb *unp2;
-
-	UNP_LINK_WLOCK_ASSERT();
-	UNP_PCB_LOCK_ASSERT(unp);
+	int freed;
 
 	/*
 	 * Regardless of whether the socket's peer dropped the connection
 	 * with this socket by aborting or disconnecting, POSIX requires
 	 * that ECONNRESET is returned.
 	 */
+	/* acquire a reference so that unp isn't freed from underneath us */
+
+	UNP_PCB_LOCK(unp);
 	so->so_error = ECONNRESET;
 	unp2 = unp->unp_conn;
-	if (unp2 == NULL)
-		return;
-	UNP_PCB_LOCK(unp2);
-	unp_disconnect(unp, unp2);
-	UNP_PCB_UNLOCK(unp2);
+	if (unp2 != NULL) {
+		unp_pcb_hold(unp2);
+		unp_pcb_owned_lock2(unp, unp2, freed);
+		unp_disconnect(unp, unp2);
+		if (unp_pcb_rele(unp2) == 0)
+			UNP_PCB_UNLOCK(unp2);
+	}
+	if (unp_pcb_rele(unp) == 0)
+		UNP_PCB_UNLOCK(unp);
 }
 
 static void
@@ -2464,13 +2592,15 @@
 {
 	struct unpcb *unp;
 	int active;
+	struct mtx *vplock;
 
 	ASSERT_VOP_ELOCKED(vp, "vfs_unp_reclaim");
 	KASSERT(vp->v_type == VSOCK,
 	    ("vfs_unp_reclaim: vp->v_type != VSOCK"));
 
 	active = 0;
-	UNP_LINK_WLOCK();
+	vplock = mtx_pool_find(mtxpool_sleep, vp);
+	mtx_lock(vplock);
 	VOP_UNP_CONNECT(vp, &unp);
 	if (unp == NULL)
 		goto done;
@@ -2481,8 +2611,8 @@
 		active = 1;
 	}
 	UNP_PCB_UNLOCK(unp);
-done:
-	UNP_LINK_WUNLOCK();
+ done:
+	mtx_unlock(vplock);
 	if (active)
 		vunref(vp);
 }
Index: sys/sys/unpcb.h
===================================================================
--- sys/sys/unpcb.h
+++ sys/sys/unpcb.h
@@ -82,7 +82,7 @@
 	short	unp_flags;		/* flags */
 	short	unp_gcflag;		/* Garbage collector flags. */
 	struct	xucred unp_peercred;	/* peer credentials, if applicable */
-	u_int	unp_refcount;
+	volatile u_int	unp_refcount;
 	u_int	unp_msgcount;		/* references from message queue */
 	struct	mtx unp_mtx;		/* mutex */
 };