When an NFS unmount occurs, once vflush() writes the last dirty

buffer for the last vnode on the mount back to the server, it
returns. At that point, the code continues with the unmount,
including freeing up the nfs specific part of the mount structure.
It is possible that an nfsiod thread will try to check for an
empty I/O queue in the nfs specific part of the mount structure
after it has been free'd by the unmount. This patch avoids this problem by
setting the iodmount entries for the mount back to NULL while holding the
mutex in the unmount and checking the appropriate entry is non-NULL after
acquiring the mutex in the nfsiod thread.

Reported and tested by:	pho
Reviewed by:	kib
MFC after:	2 weeks

2 files changed, 17 insertions, 1 deletions

diff --git a/sys/nfsclient/nfs_nfsiod.c b/sys/nfsclient/nfs_nfsiod.c
index d34c205a48e5..2fb2c88151ac 100644
--- a/sys/nfsclient/nfs_nfsiod.c
+++ b/sys/nfsclient/nfs_nfsiod.c
@@ -308,6 +308,14 @@ nfssvc_iod(void *instance)
 			mtx_unlock(&Giant);
 		mtx_lock(&nfs_iod_mtx);
 		/*
+		 * Make sure the nmp hasn't been dismounted as soon as
+		 * nfs_doio() completes for the last buffer.
+		 */
+		nmp = nfs_iodmount[myiod];
+		if (nmp == NULL)
+			break;
+
+		/*
 		 * If there are more than one iod on this mount, then defect
 		 * so that the iods can be shared out fairly between the mounts
 		 */
diff --git a/sys/nfsclient/nfs_vfsops.c b/sys/nfsclient/nfs_vfsops.c
index 6f00cf90de2f..7a26aa20aff1 100644
--- a/sys/nfsclient/nfs_vfsops.c
+++ b/sys/nfsclient/nfs_vfsops.c
@@ -1362,7 +1362,7 @@ static int
 nfs_unmount(struct mount *mp, int mntflags)
 {
 	struct nfsmount *nmp;
-	int error, flags = 0;
+	int error, flags = 0, i;
 
 	if (mntflags & MNT_FORCE)
 		flags |= FORCECLOSE;
@@ -1387,6 +1387,14 @@ nfs_unmount(struct mount *mp, int mntflags)
 	/*
 	 * We are now committed to the unmount.
 	 */
+	/* Make sure no nfsiods are assigned to this mount. */
+	mtx_lock(&nfs_iod_mtx);
+	for (i = 0; i < NFS_MAXASYNCDAEMON; i++)
+		if (nfs_iodmount[i] == nmp) {
+			nfs_iodwant[i] = NFSIOD_AVAILABLE;
+			nfs_iodmount[i] = NULL;
+		}
+	mtx_unlock(&nfs_iod_mtx);
 	nfs_disconnect(nmp);
 	free(nmp->nm_nam, M_SONAME);