@@ -627,14 +627,10 @@ V9fsPDU *pdu_alloc(V9fsState *s)
void pdu_free(V9fsPDU *pdu)
{
V9fsState *s = pdu->s;
- /*
- * Cancelled pdu are added back to the freelist
- * by flush request .
- */
- if (!pdu->cancelled) {
- QLIST_REMOVE(pdu, next);
- QLIST_INSERT_HEAD(&s->free_list, pdu, next);
- }
+
+ g_assert(!pdu->cancelled);
+ QLIST_REMOVE(pdu, next);
+ QLIST_INSERT_HEAD(&s->free_list, pdu, next);
}
/*
@@ -679,9 +675,9 @@ static void coroutine_fn pdu_complete(V9fsPDU *pdu, ssize_t len)
pdu_push_and_notify(pdu);
/* Now wakeup anybody waiting in flush for this request */
- qemu_co_queue_next(&pdu->complete);
-
- pdu_free(pdu);
+ if (!qemu_co_queue_next(&pdu->complete)) {
+ pdu_free(pdu);
+ }
}
static mode_t v9mode_to_mode(uint32_t mode, V9fsString *extension)
If a PDU has a flush request pending, the current code calls pdu_free() twice: 1) pdu_complete()->pdu_free() with pdu->cancelled set, which does nothing 2) v9fs_flush()->pdu_free() with pdu->cancelled cleared, which moves the PDU back to the free list. This works but it complexifies the logic of pdu_free(). With this patch, pdu_complete() only calls pdu_free() if no flush request is pending, i.e. qemu_co_queue_next() returns false. Since pdu_free() is now supposed to be called with pdu->cancelled cleared, the check in pdu_free() is dropped and replaced by an assertion. Signed-off-by: Greg Kurz <groug@kaod.org> --- hw/9pfs/9p.c | 18 +++++++----------- 1 file changed, 7 insertions(+), 11 deletions(-)