X-Git-Url: https://git.saurik.com/apple/xnu.git/blobdiff_plain/04b8595b18b1b41ac7a206e4b3d51a635f8413d7..eee3565979933af707c711411001ba11fe406a3c:/bsd/nfs/nfs_bio.c?ds=sidebyside

diff --git a/bsd/nfs/nfs_bio.c b/bsd/nfs/nfs_bio.c
index c0715a2b0..acaf26c24 100644
--- a/bsd/nfs/nfs_bio.c
+++ b/bsd/nfs/nfs_bio.c
@@ -97,6 +97,8 @@
 #include <sys/buf_internal.h>
 #include <libkern/OSAtomic.h>
 
+#define NFS_BIO_DBG(...) NFS_DBG(NFS_FAC_BIO, 7, ## __VA_ARGS__)
+
 kern_return_t	thread_terminate(thread_t); /* XXX */
 
 #define	NFSBUFHASH(np, lbn)	\
@@ -3797,7 +3799,29 @@ again:
 		}
 	}
 
-	if (req->r_achain.tqe_next == NFSREQNOLIST || req->r_achain.tqe_next == NFSIODCOMPLETING)
+	/*
+	 * If we got here while being on the resendq we need to get off. This
+	 * happens when the timer fires and errors out requests from nfs_sigintr
+	 * or we receive a reply (UDP case) while being on the resend queue so
+	 * we're just finishing up and are not going to be resent.
+	 */
+	lck_mtx_lock(&req->r_mtx);
+	if (req->r_flags & R_RESENDQ) {
+		lck_mtx_lock(&nmp->nm_lock);
+		if (req->r_rchain.tqe_next != NFSREQNOLIST) {
+			NFS_BIO_DBG("Proccessing async request on resendq. Removing");
+			TAILQ_REMOVE(&nmp->nm_resendq, req, r_rchain);
+			req->r_rchain.tqe_next = NFSREQNOLIST;
+			assert(req->r_refs > 1);
+			/* Remove resendq reference */
+			req->r_refs--;
+		}
+		lck_mtx_unlock(&nmp->nm_lock);
+		req->r_flags &= ~R_RESENDQ;
+	}
+	lck_mtx_unlock(&req->r_mtx);
+
+	if (req->r_achain.tqe_next == NFSREQNOLIST)
 		TAILQ_INSERT_TAIL(&nmp->nm_iodq, req, r_achain);
 
 	/* If this mount doesn't already have an nfsiod working on it... */
@@ -3835,11 +3859,17 @@ nfs_asyncio_resend(struct nfsreq *req)
 
 	if (nfs_mount_gone(nmp))
 		return;
+
 	nfs_gss_clnt_rpcdone(req);
 	lck_mtx_lock(&nmp->nm_lock);
 	if (!(req->r_flags & R_RESENDQ)) {
 		TAILQ_INSERT_TAIL(&nmp->nm_resendq, req, r_rchain);
 		req->r_flags |= R_RESENDQ;
+		/*
+		 * We take a reference on this request so that it can't be
+		 * destroyed while a resend is queued or in progress.
+		 */
+		nfs_request_ref(req, 1);
 	}
 	nfs_mount_sock_thread_wake(nmp);
 	lck_mtx_unlock(&nmp->nm_lock);