From 780acc5dcfccbf064bc664ca2043b8123e08f4a1 Mon Sep 17 00:00:00 2001
From: Jim906 <jim_l@fastmail.com>
Date: Wed, 22 Oct 2025 08:55:28 -0400
Subject: [PATCH] nfs4: Add locking to protect a ConditionVariable

* Ensure that after RPC::Server::SendCallAsync() returns, its client
  can't delete RPC::Request::fEvent while fEvent.NotifyAll() is still
  in progress in the notifying thread.
* Fixes #19764.

Change-Id: I516fe5a1c4e0f6939c62d6d5e3b91771ab12223c
Reviewed-on: https://review.haiku-os.org/c/haiku/+/9709
Tested-by: Commit checker robot <no-reply+buildbot@haiku-os.org>
Reviewed-by: waddlesplash <waddlesplash@gmail.com>
---
 .../kernel/file_systems/nfs4/RPCServer.cpp    | 19 +++++++++++++++++++
 .../kernel/file_systems/nfs4/RPCServer.h      |  4 ++++
 2 files changed, 23 insertions(+)

diff --git a/src/add-ons/kernel/file_systems/nfs4/RPCServer.cpp b/src/add-ons/kernel/file_systems/nfs4/RPCServer.cpp
index 49099c6c3a..2e0f002c99 100644
--- a/src/add-ons/kernel/file_systems/nfs4/RPCServer.cpp
+++ b/src/add-ons/kernel/file_systems/nfs4/RPCServer.cpp
@@ -21,6 +21,19 @@
 using namespace RPC;
 
 
+Request::Request()
+{
+	mutex_init(&fEventLock, "nfs4 Request");
+}
+
+
+Request::~Request()
+{
+	mutex_lock(&fEventLock);
+	mutex_destroy(&fEventLock);
+}
+
+
 RequestManager::RequestManager()
 	:
 	fQueueHead(NULL),
@@ -203,7 +216,10 @@ Server::WakeCall(Request* request)
 	request->fError = B_IO_ERROR;
 	*request->fReply = NULL;
 	request->fDone = true;
+	mutex_lock(&request->fEventLock);
+		// don't let the sending thread free request->fEvent until NotifyAll returns
 	request->fEvent.NotifyAll();
+	mutex_unlock(&request->fEventLock);
 
 	return B_OK;
 }
@@ -294,7 +310,10 @@ Server::_Listener()
 		if (req != NULL) {
 			*req->fReply = reply;
 			req->fDone = true;
+			mutex_lock(&req->fEventLock);
+				// don't let the sending thread free req->fEvent until NotifyAll returns
 			req->fEvent.NotifyAll();
+			mutex_unlock(&req->fEventLock);
 		} else
 			delete reply;
 	}
diff --git a/src/add-ons/kernel/file_systems/nfs4/RPCServer.h b/src/add-ons/kernel/file_systems/nfs4/RPCServer.h
index 50e218b813..28c1945c7c 100644
--- a/src/add-ons/kernel/file_systems/nfs4/RPCServer.h
+++ b/src/add-ons/kernel/file_systems/nfs4/RPCServer.h
@@ -21,8 +21,12 @@
 namespace RPC {
 
 struct Request {
+						Request();
+						~Request();
+
 	uint32				fXID;
 	ConditionVariable	fEvent;
+	mutex				fEventLock;
 
 	bool				fDone;
 	Reply**				fReply;