Index: /trunk/src/VBox/VMM/VMMAll/PGMAllBth.h
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/PGMAllBth.h	(revision 19870)
+++ /trunk/src/VBox/VMM/VMMAll/PGMAllBth.h	(revision 19871)
@@ -421,5 +421,7 @@
                                 && !(uErr & X86_TRAP_PF_P))
                             {
+                                pgmLock(pVM);
                                 rc = PGM_BTH_NAME(SyncPage)(pVCpu, PdeSrc, pvFault, PGM_SYNC_NR_PAGES, uErr);
+                                pgmUnlock(pVM);
                                 if (    RT_FAILURE(rc)
                                     || !(uErr & X86_TRAP_PF_RW)
@@ -467,5 +469,7 @@
                             && !(uErr & X86_TRAP_PF_P))
                         {
+                            pgmLock(pVM);
                             rc = PGM_BTH_NAME(SyncPage)(pVCpu, PdeSrc, pvFault, PGM_SYNC_NR_PAGES, uErr);
+                            pgmUnlock(pVM);
                             if (    RT_FAILURE(rc)
                                 ||  rc == VINF_PGM_SYNCPAGE_MODIFIED_PDE
@@ -561,5 +565,7 @@
                         &&  !(uErr & X86_TRAP_PF_P))
                     {
+                        pgmLock(pVM);
                         rc = PGM_BTH_NAME(SyncPage)(pVCpu, PdeSrc, pvFault, PGM_SYNC_NR_PAGES, uErr);
+                        pgmUnlock(pVM);
                         if (    RT_FAILURE(rc)
                             ||  rc == VINF_PGM_SYNCPAGE_MODIFIED_PDE
@@ -695,5 +701,7 @@
                                  */
                                 LogFlow(("CSAM ring 3 job\n"));
+                                pgmLock(pVM);
                                 int rc2 = PGM_BTH_NAME(SyncPage)(pVCpu, PdeSrc, pvFault, 1, uErr);
+                                pgmUnlock(pVM);
                                 AssertRC(rc2);
 
@@ -743,5 +751,7 @@
                 }
 #   endif /* PGM_WITH_PAGING(PGM_GST_TYPE, PGM_SHW_TYPE) && !defined(IN_RING0) */
+                pgmLock(pVM);
                 rc = PGM_BTH_NAME(SyncPage)(pVCpu, PdeSrc, pvFault, PGM_SYNC_NR_PAGES, uErr);
+                pgmUnlock(pVM);
                 if (RT_SUCCESS(rc))
                 {
@@ -788,5 +798,7 @@
                      *       page is not present, which is not true in this case.
                      */
+                    pgmLock(pVM);
                     rc = PGM_BTH_NAME(SyncPage)(pVCpu, PdeSrc, pvFault, 1, uErr);
+                    pgmUnlock(pVM);
                     if (RT_SUCCESS(rc))
                     {
@@ -1615,4 +1627,6 @@
     PPGMPOOL pPool = pVM->pgm.s.CTX_SUFF(pPool);
     LogFlow(("SyncPage: GCPtrPage=%RGv cPages=%u uErr=%#x\n", GCPtrPage, cPages, uErr));
+
+    Assert(PGMIsLockOwner(pVM));
 
 #if    (   PGM_GST_TYPE == PGM_TYPE_32BIT  \
@@ -2967,5 +2981,7 @@
     ASMAtomicWriteSize(pPdeDst, PdeDst.u);
 
+    pgmLock(pVM);
     rc = PGM_BTH_NAME(SyncPage)(pVCpu, PdeSrc, GCPtrPage, PGM_SYNC_NR_PAGES, 0 /* page not present */);
+    pgmUnlock(pVM);
     STAM_PROFILE_STOP(&pVCpu->pgm.s.CTX_MID_Z(Stat,SyncPT), a);
     return rc;