- Push down Giant into crfree() in the case that we actually free a ucred.

- Add a cred_free_thread() function (conditional on DIAGNOSTICS) that drops
  a per-thread ucred reference to be used in debugging code when leaving
  the kernel.

sys/kern/kern_prot.c

@@ -1699,6 +1699,7 @@ crfree(cr)
 		 * allocate a uidinfo structure.
 		 */
 		mtx_unlock(mtxp);
+		mtx_lock(&Giant);
 		if (cr->cr_uidinfo != NULL)
 			uifree(cr->cr_uidinfo);
 		if (cr->cr_ruidinfo != NULL)
@@ -1709,6 +1710,7 @@ crfree(cr)
 		if (jailed(cr))
 			prison_free(cr->cr_prison);
 		FREE((caddr_t)cr, M_CRED);
+		mtx_unlock(&Giant);
 	} else {
 		mtx_unlock(mtxp);
 	}
@@ -1761,6 +1763,19 @@ crdup(cr)
 	return (newcr);
 }
 
+#ifdef DIAGNOSTIC
+void
+cred_free_thread(struct thread *td)
+{
+	struct ucred *cred;
+
+	cred = td->td_ucred;
+	td->td_ucred = NULL;
+	if (cred != NULL)
+		crfree(cred);
+}
+#endif
+
 /*
  * Fill in a struct xucred based on a struct ucred.
  */

sys/sys/ucred.h

@@ -83,7 +83,9 @@ struct xucred {
 
 #ifdef _KERNEL
 
-
+#ifdef DIAGNOSTIC
+void		cred_free_thread(struct thread *td);
+#endif
 void		cred_update_thread(struct thread *td);
 void		change_egid(struct ucred *newcred, gid_t egid);
 void		change_euid(struct ucred *newcred, uid_t euid);