From 7a5147540ae91e2a00a8ba87f1cc8e10e796d119 Mon Sep 17 00:00:00 2001
From: Paul Saab <ps@FreeBSD.org>
Date: Fri, 18 Feb 2005 23:41:39 +0000
Subject: [PATCH] Fix for a potential NFS client race where shared data is
 updated from base context as well as the socket callback.

Submitted by:	Mohan Srinivasan
---
 sys/nfsclient/nfs_socket.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/sys/nfsclient/nfs_socket.c b/sys/nfsclient/nfs_socket.c
index e18973fa4d8..57d58bb308d 100644
--- a/sys/nfsclient/nfs_socket.c
+++ b/sys/nfsclient/nfs_socket.c
@@ -1027,10 +1027,12 @@ tryagain:
 			error = nfs_send(nmp->nm_so, nmp->nm_nam, m2, rep);
 			nfs_sndunlock(rep);
 		}
+		mtx_lock(&nfs_reqq_mtx);
 		if (!error && (rep->r_flags & R_MUSTRESEND) == 0) {
 			nmp->nm_sent += NFS_CWNDSCALE;
 			rep->r_flags |= R_SENT;
 		}
+		mtx_unlock(&nfs_reqq_mtx);
 	} else {
 		splx(s);
 		rep->r_rtt = -1;
@@ -1056,10 +1058,12 @@ tryagain:
 	/*
 	 * Decrement the outstanding request count.
 	 */
+	mtx_lock(&nfs_reqq_mtx);
 	if (rep->r_flags & R_SENT) {
 		rep->r_flags &= ~R_SENT;	/* paranoia */
 		nmp->nm_sent -= NFS_CWNDSCALE;
 	}
+	mtx_unlock(&nfs_reqq_mtx);
 
 	/*
 	 * If there was a successful reply and a tprintf msg.