Patchwork [1/6] hw/9pfs: Add reference counting for fid

login
register
mail settings
Submitter Aneesh Kumar K.V
Date June 6, 2011, 5:16 p.m.
Message ID <1307380618-1963-1-git-send-email-aneesh.kumar@linux.vnet.ibm.com>
Download mbox | patch
Permalink /patch/99028/
State New
Headers show

Comments

Aneesh Kumar K.V - June 6, 2011, 5:16 p.m.
Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
---
 hw/9pfs/virtio-9p.c |  205 +++++++++++++++++++++++++++++++++++----------------
 hw/9pfs/virtio-9p.h |    7 ++
 2 files changed, 147 insertions(+), 65 deletions(-)
jvrao - June 9, 2011, 11:10 p.m.
On 06/06/2011 10:16 AM, Aneesh Kumar K.V wrote:
> Signed-off-by: Aneesh Kumar K.V<aneesh.kumar@linux.vnet.ibm.com>

Just one minor issue below; otherwise

Reviewed-by: Venkateswararao Jujjuri "<jvrao@linux.vnet.ibm.com>

> ---
>   hw/9pfs/virtio-9p.c |  205 +++++++++++++++++++++++++++++++++++----------------
>   hw/9pfs/virtio-9p.h |    7 ++
>   2 files changed, 147 insertions(+), 65 deletions(-)
>
> diff --git a/hw/9pfs/virtio-9p.c b/hw/9pfs/virtio-9p.c
> index e2aa863..03d8664 100644
> --- a/hw/9pfs/virtio-9p.c
> +++ b/hw/9pfs/virtio-9p.c
> @@ -232,12 +232,13 @@ static size_t v9fs_string_size(V9fsString *str)
>       return str->size;
>   }
>
> -static V9fsFidState *lookup_fid(V9fsState *s, int32_t fid)
> +static V9fsFidState *get_fid(V9fsState *s, int32_t fid)
>   {
>       V9fsFidState *f;
>
>       for (f = s->fid_list; f; f = f->next) {
>           if (f->fid == fid) {
> +            f->ref++;
>               return f;
>           }
>       }
> @@ -249,16 +250,16 @@ static V9fsFidState *alloc_fid(V9fsState *s, int32_t fid)
>   {
>       V9fsFidState *f;
>
> -    f = lookup_fid(s, fid);
> +    f = get_fid(s, fid);
>       if (f) {
> +        f->ref--;
>           return NULL;
>       }
>
>       f = qemu_mallocz(sizeof(V9fsFidState));
> -
>       f->fid = fid;
>       f->fid_type = P9_FID_NONE;
> -
> +    f->ref = 1;
>       f->next = s->fid_list;
>       s->fid_list = f;
>
> @@ -1014,19 +1015,22 @@ static void v9fs_attach(void *opaque)
>       fidp = alloc_fid(s, fid);
>       if (fidp == NULL) {
>           err = -EINVAL;
> -        goto out;
> +        goto out_nofid;
>       }
>       fidp->uid = n_uname;
>       v9fs_string_sprintf(&fidp->path, "%s", "/");
>       err = fid_to_qid(s, fidp,&qid);
>       if (err<  0) {
>           err = -EINVAL;
> +        put_fid(fidp);
>           free_fid(s, fid);
> -        goto out;
> +        goto out_nofid;
>       }
>       offset += pdu_marshal(pdu, offset, "Q",&qid);
>       err = offset;
> -out:
> +    put_fid(fidp);
> +
> +out_nofid:
>       complete_pdu(s, pdu, err);
>       v9fs_string_free(&uname);
>       v9fs_string_free(&aname);
> @@ -1045,10 +1049,10 @@ static void v9fs_stat(void *opaque)
>
>       pdu_unmarshal(pdu, offset, "d",&fid);
>
> -    fidp = lookup_fid(s, fid);
> +    fidp = get_fid(s, fid);
>       if (fidp == NULL) {
>           err = -ENOENT;
> -        goto out;
> +        goto out_nofid;
>       }
>       err = v9fs_co_lstat(s,&fidp->path,&stbuf);
>       if (err<  0) {
> @@ -1062,6 +1066,8 @@ static void v9fs_stat(void *opaque)
>       err = offset;
>       v9fs_stat_free(&v9stat);
>   out:
> +    put_fid(fidp);
> +out_nofid:
>       complete_pdu(s, pdu, err);
>   }
>
> @@ -1079,10 +1085,10 @@ static void v9fs_getattr(void *opaque)
>
>       pdu_unmarshal(pdu, offset, "dq",&fid,&request_mask);
>
> -    fidp = lookup_fid(s, fid);
> +    fidp = get_fid(s, fid);
>       if (fidp == NULL) {
>           retval = -ENOENT;
> -        goto out;
> +        goto out_nofid;
>       }
>       /*
>        * Currently we only support BASIC fields in stat, so there is no
> @@ -1096,6 +1102,8 @@ static void v9fs_getattr(void *opaque)
>       retval = offset;
>       retval += pdu_marshal(pdu, offset, "A",&v9stat_dotl);
>   out:
> +    put_fid(fidp);
> +out_nofid:
>       complete_pdu(s, pdu, retval);
>   }
>
> @@ -1123,10 +1131,10 @@ static void v9fs_setattr(void *opaque)
>
>       pdu_unmarshal(pdu, offset, "dI",&fid,&v9iattr);
>
> -    fidp = lookup_fid(s, fid);
> +    fidp = get_fid(s, fid);
>       if (fidp == NULL) {
>           err = -EINVAL;
> -        goto out;
> +        goto out_nofid;
>       }
>       if (v9iattr.valid&  ATTR_MODE) {
>           err = v9fs_co_chmod(s,&fidp->path, v9iattr.mode);
> @@ -1188,6 +1196,8 @@ static void v9fs_setattr(void *opaque)
>       }
>       err = offset;
>   out:
> +    put_fid(fidp);
> +out_nofid:
>       complete_pdu(s, pdu, err);
>   }
>
> @@ -1214,7 +1224,7 @@ static void v9fs_walk(void *opaque)
>       int32_t fid, newfid;
>       V9fsString *wnames = NULL;
>       V9fsFidState *fidp;
> -    V9fsFidState *newfidp;
> +    V9fsFidState *newfidp = NULL;;
>       V9fsPDU *pdu = opaque;
>       V9fsState *s = pdu->s;
>
> @@ -1231,12 +1241,12 @@ static void v9fs_walk(void *opaque)
>
>       } else if (nwnames>  P9_MAXWELEM) {
>           err = -EINVAL;
> -        goto out;
> +        goto out_nofid;
>       }
> -    fidp = lookup_fid(s, fid);
> +    fidp = get_fid(s, fid);
>       if (fidp == NULL) {
>           err = -ENOENT;
> -        goto out;
> +        goto out_nofid;
>       }
>       if (fid == newfid) {
>           BUG_ON(fidp->fid_type != P9_FID_NONE);
> @@ -1269,7 +1279,9 @@ static void v9fs_walk(void *opaque)
>               v9fs_string_copy(&newfidp->path,&path);
>               err = v9fs_co_lstat(s,&newfidp->path,&stbuf);
>               if (err<  0) {
> +                put_fid(newfidp);
>                   free_fid(s, newfidp->fid);
> +                newfidp = NULL;
>                   v9fs_string_free(&path);
>                   goto out;
>               }
> @@ -1279,6 +1291,11 @@ static void v9fs_walk(void *opaque)
>       }
>       err = v9fs_walk_marshal(pdu, nwnames, qids);
>   out:
> +    put_fid(fidp);
> +    if (newfidp) {
> +        put_fid(newfidp);
> +    }
> +out_nofid:
>       complete_pdu(s, pdu, err);
>       if (nwnames&&  nwnames<= P9_MAXWELEM) {
>           for (name_idx = 0; name_idx<  nwnames; name_idx++) {
> @@ -1327,10 +1344,10 @@ static void v9fs_open(void *opaque)
>       } else {
>           pdu_unmarshal(pdu, offset, "db",&fid,&mode);
>       }
> -    fidp = lookup_fid(s, fid);
> +    fidp = get_fid(s, fid);
>       if (fidp == NULL) {
>           err = -ENOENT;
> -        goto out;
> +        goto out_nofid;
>       }
>       BUG_ON(fidp->fid_type != P9_FID_NONE);
>
> @@ -1366,6 +1383,8 @@ static void v9fs_open(void *opaque)
>           err = offset;
>       }
>   out:
> +    put_fid(fidp);
> +out_nofid:
>       complete_pdu(s, pdu, err);
>   }
>
> @@ -1388,10 +1407,10 @@ static void v9fs_lcreate(void *opaque)
>       pdu_unmarshal(pdu, offset, "dsddd",&dfid,&name,&flags,
>                     &mode,&gid);
>
> -    fidp = lookup_fid(pdu->s, dfid);
> +    fidp = get_fid(pdu->s, dfid);
>       if (fidp == NULL) {
>           err = -ENOENT;
> -        goto out;
> +        goto out_nofid;
>       }
>       v9fs_string_sprintf(&fullname, "%s/%s", fidp->path.data, name.data);
>
> @@ -1418,6 +1437,8 @@ static void v9fs_lcreate(void *opaque)
>       offset += pdu_marshal(pdu, offset, "Qd",&qid, iounit);
>       err = offset;
>   out:
> +    put_fid(fidp);
> +out_nofid:
>       complete_pdu(pdu->s, pdu, err);
>       v9fs_string_free(&name);
>       v9fs_string_free(&fullname);
> @@ -1434,7 +1455,7 @@ static void v9fs_fsync(void *opaque)
>       V9fsState *s = pdu->s;
>
>       pdu_unmarshal(pdu, offset, "dd",&fid,&datasync);
> -    fidp = lookup_fid(s, fid);
> +    fidp = get_fid(s, fid);
>       if (fidp == NULL) {
>           err = -ENOENT;
>           goto out;
> @@ -1444,6 +1465,7 @@ static void v9fs_fsync(void *opaque)
>           err = offset;
>       }
>   out:
> +    put_fid(fidp);
It should be

put_fid(fidp);

out_nofid:

>       complete_pdu(s, pdu, err);
>   }
>
> @@ -1561,10 +1583,10 @@ static void v9fs_read(void *opaque)
>
>       pdu_unmarshal(pdu, offset, "dqd",&fid,&off,&max_count);
>
> -    fidp = lookup_fid(s, fid);
> +    fidp = get_fid(s, fid);
>       if (fidp == NULL) {
>           err = -EINVAL;
> -        goto out;
> +        goto out_nofid;
>       }
>       if (fidp->fid_type == P9_FID_DIR) {
>
> @@ -1616,6 +1638,8 @@ static void v9fs_read(void *opaque)
>           err = -EINVAL;
>       }
>   out:
> +    put_fid(fidp);
> +out_nofid:
>       complete_pdu(s, pdu, err);
>   }
>
> @@ -1700,8 +1724,12 @@ static void v9fs_readdir(void *opaque)
>
>       pdu_unmarshal(pdu, offset, "dqd",&fid,&initial_offset,&max_count);
>
> -    fidp = lookup_fid(s, fid);
> -    if (fidp == NULL || !fidp->fs.dir) {
> +    fidp = get_fid(s, fid);
> +    if (fidp == NULL) {
> +        retval = -EINVAL;
> +        goto out_nofid;
> +    }
> +    if (!fidp->fs.dir) {
>           retval = -EINVAL;
>           goto out;
>       }
> @@ -1719,6 +1747,8 @@ static void v9fs_readdir(void *opaque)
>       retval += pdu_marshal(pdu, offset, "d", count);
>       retval += count;
>   out:
> +    put_fid(fidp);
> +out_nofid:
>       complete_pdu(s, pdu, retval);
>   }
>
> @@ -1784,10 +1814,10 @@ static void v9fs_write(void *opaque)
>
>       pdu_unmarshal(pdu, offset, "dqdv",&fid,&off,&count, sg,&cnt);
>
> -    fidp = lookup_fid(s, fid);
> +    fidp = get_fid(s, fid);
>       if (fidp == NULL) {
>           err = -EINVAL;
> -        goto out;
> +        goto out_nofid;
>       }
>       if (fidp->fid_type == P9_FID_FILE) {
>           if (fidp->fs.fd == -1) {
> @@ -1827,6 +1857,8 @@ static void v9fs_write(void *opaque)
>       offset += pdu_marshal(pdu, offset, "d", total);
>       err = offset;
>   out:
> +    put_fid(fidp);
> +out_nofid:
>       complete_pdu(s, pdu, err);
>   }
>
> @@ -1851,10 +1883,10 @@ static void v9fs_create(void *opaque)
>       pdu_unmarshal(pdu, offset, "dsdbs",&fid,&name,
>                     &perm,&mode,&extension);
>
> -    fidp = lookup_fid(pdu->s, fid);
> +    fidp = get_fid(pdu->s, fid);
>       if (fidp == NULL) {
>           err = -EINVAL;
> -        goto out;
> +        goto out_nofid;
>       }
>
>       v9fs_string_sprintf(&fullname, "%s/%s", fidp->path.data, name.data);
> @@ -1884,15 +1916,17 @@ static void v9fs_create(void *opaque)
>           }
>       } else if (perm&  P9_STAT_MODE_LINK) {
>           int32_t nfid = atoi(extension.data);
> -        V9fsFidState *nfidp = lookup_fid(pdu->s, nfid);
> +        V9fsFidState *nfidp = get_fid(pdu->s, nfid);
>           if (nfidp == NULL) {
>               err = -EINVAL;
>               goto out;
>           }
>           err = v9fs_co_link(pdu->s,&nfidp->path,&fullname);
>           if (err<  0) {
> +            put_fid(nfidp);
>               goto out;
>           }
> +        put_fid(nfidp);
>       } else if (perm&  P9_STAT_MODE_DEVICE) {
>           char ctype;
>           uint32_t major, minor;
> @@ -1956,6 +1990,8 @@ static void v9fs_create(void *opaque)
>       err = offset;
>
>   out:
> +    put_fid(fidp);
> +out_nofid:
>      complete_pdu(pdu->s, pdu, err);
>      v9fs_string_free(&name);
>      v9fs_string_free(&extension);
> @@ -1980,10 +2016,10 @@ static void v9fs_symlink(void *opaque)
>
>       pdu_unmarshal(pdu, offset, "dssd",&dfid,&name,&symname,&gid);
>
> -    dfidp = lookup_fid(pdu->s, dfid);
> +    dfidp = get_fid(pdu->s, dfid);
>       if (dfidp == NULL) {
>           err = -EINVAL;
> -        goto out;
> +        goto out_nofid;
>       }
>
>       v9fs_string_sprintf(&fullname, "%s/%s", dfidp->path.data, name.data);
> @@ -1999,6 +2035,8 @@ static void v9fs_symlink(void *opaque)
>       offset += pdu_marshal(pdu, offset, "Q",&qid);
>       err = offset;
>   out:
> +    put_fid(dfidp);
> +out_nofid:
>       complete_pdu(pdu->s, pdu, err);
>       v9fs_string_free(&name);
>       v9fs_string_free(&symname);
> @@ -2028,13 +2066,13 @@ static void v9fs_link(void *opaque)
>
>       pdu_unmarshal(pdu, offset, "dds",&dfid,&oldfid,&name);
>
> -    dfidp = lookup_fid(s, dfid);
> +    dfidp = get_fid(s, dfid);
>       if (dfidp == NULL) {
>           err = -ENOENT;
> -        goto out;
> +        goto out_nofid;
>       }
>
> -    oldfidp = lookup_fid(s, oldfid);
> +    oldfidp = get_fid(s, oldfid);
>       if (oldfidp == NULL) {
>           err = -ENOENT;
>           goto out;
> @@ -2048,6 +2086,8 @@ static void v9fs_link(void *opaque)
>       v9fs_string_free(&fullname);
>
>   out:
> +    put_fid(dfidp);
> +out_nofid:
>       v9fs_string_free(&name);
>       complete_pdu(s, pdu, err);
>   }
> @@ -2062,10 +2102,10 @@ static void v9fs_remove(void *opaque)
>
>       pdu_unmarshal(pdu, offset, "d",&fid);
>
> -    fidp = lookup_fid(pdu->s, fid);
> +    fidp = get_fid(pdu->s, fid);
>       if (fidp == NULL) {
>           err = -EINVAL;
> -        goto out;
> +        goto out_nofid;
>       }
>       err = v9fs_co_remove(pdu->s,&fidp->path);
>       if (!err) {
> @@ -2073,8 +2113,9 @@ static void v9fs_remove(void *opaque)
>       }
>
>       /* For TREMOVE we need to clunk the fid even on failed remove */
> +    put_fid(fidp);
>       free_fid(pdu->s, fidp->fid);
> -out:
> +out_nofid:
>       complete_pdu(pdu->s, pdu, err);
>   }
>
> @@ -2083,14 +2124,14 @@ static int v9fs_complete_rename(V9fsState *s, V9fsFidState *fidp,
>   {
>       char *end;
>       int err = 0;
> +    V9fsFidState *dirfidp = NULL;
>       char *old_name, *new_name;
>
>       if (newdirfid != -1) {
> -        V9fsFidState *dirfidp;
> -        dirfidp = lookup_fid(s, newdirfid);
> +        dirfidp = get_fid(s, newdirfid);
>           if (dirfidp == NULL) {
>               err = -ENOENT;
> -            goto out;
> +            goto out_nofid;
>           }
>           BUG_ON(dirfidp->fid_type != P9_FID_NONE);
>
> @@ -2143,6 +2184,10 @@ static int v9fs_complete_rename(V9fsState *s, V9fsFidState *fidp,
>           v9fs_string_copy(&fidp->path, name);
>       }
>   out:
> +    if (dirfidp) {
> +        put_fid(dirfidp);
> +    }
> +out_nofid:
>       return err;
>   }
>
> @@ -2159,10 +2204,10 @@ static void v9fs_rename(void *opaque)
>
>       pdu_unmarshal(pdu, offset, "dds",&fid,&newdirfid,&name);
>
> -    fidp = lookup_fid(s, fid);
> +    fidp = get_fid(s, fid);
>       if (fidp == NULL) {
>           err = -ENOENT;
> -        goto out;
> +        goto out_nofid;
>       }
>       BUG_ON(fidp->fid_type != P9_FID_NONE);
>
> @@ -2171,6 +2216,8 @@ static void v9fs_rename(void *opaque)
>           err = offset;
>       }
>   out:
> +    put_fid(fidp);
> +out_nofid:
>       complete_pdu(s, pdu, err);
>       v9fs_string_free(&name);
>   }
> @@ -2189,10 +2236,10 @@ static void v9fs_wstat(void *opaque)
>
>       pdu_unmarshal(pdu, offset, "dwS",&fid,&unused,&v9stat);
>
> -    fidp = lookup_fid(s, fid);
> +    fidp = get_fid(s, fid);
>       if (fidp == NULL) {
>           err = -EINVAL;
> -        goto out;
> +        goto out_nofid;
>       }
>       /* do we need to sync the file? */
>       if (donttouch_stat(&v9stat)) {
> @@ -2258,6 +2305,8 @@ static void v9fs_wstat(void *opaque)
>       }
>       err = offset;
>   out:
> +    put_fid(fidp);
> +out_nofid:
>       v9fs_stat_free(&v9stat);
>       complete_pdu(s, pdu, err);
>   }
> @@ -2318,10 +2367,10 @@ static void v9fs_statfs(void *opaque)
>       V9fsState *s = pdu->s;
>
>       pdu_unmarshal(pdu, offset, "d",&fid);
> -    fidp = lookup_fid(s, fid);
> +    fidp = get_fid(s, fid);
>       if (fidp == NULL) {
>           retval = -ENOENT;
> -        goto out;
> +        goto out_nofid;
>       }
>       retval = v9fs_co_statfs(s,&fidp->path,&stbuf);
>       if (retval<  0) {
> @@ -2330,6 +2379,8 @@ static void v9fs_statfs(void *opaque)
>       retval = offset;
>       retval += v9fs_fill_statfs(s, pdu,&stbuf);
>   out:
> +    put_fid(fidp);
> +out_nofid:
>       complete_pdu(s, pdu, retval);
>       return;
>   }
> @@ -2355,10 +2406,10 @@ static void v9fs_mknod(void *opaque)
>       pdu_unmarshal(pdu, offset, "dsdddd",&fid,&name,&mode,
>                     &major,&minor,&gid);
>
> -    fidp = lookup_fid(s, fid);
> +    fidp = get_fid(s, fid);
>       if (fidp == NULL) {
>           err = -ENOENT;
> -        goto out;
> +        goto out_nofid;
>       }
>       v9fs_string_sprintf(&fullname, "%s/%s", fidp->path.data, name.data);
>       err = v9fs_co_mknod(s,&fullname, fidp->uid, gid,
> @@ -2374,6 +2425,8 @@ static void v9fs_mknod(void *opaque)
>       err = offset;
>       err += pdu_marshal(pdu, offset, "Q",&qid);
>   out:
> +    put_fid(fidp);
> +out_nofid:
>       complete_pdu(s, pdu, err);
>       v9fs_string_free(&fullname);
>       v9fs_string_free(&name);
> @@ -2407,12 +2460,12 @@ static void v9fs_lock(void *opaque)
>       /* We support only block flag now (that too ignored currently) */
>       if (flock->flags&  ~P9_LOCK_FLAGS_BLOCK) {
>           err = -EINVAL;
> -        goto out;
> +        goto out_nofid;
>       }
> -    fidp = lookup_fid(s, fid);
> +    fidp = get_fid(s, fid);
>       if (fidp == NULL) {
>           err = -ENOENT;
> -        goto out;
> +        goto out_nofid;
>       }
>       err = v9fs_co_fstat(s, fidp->fs.fd,&stbuf);
>       if (err<  0) {
> @@ -2420,6 +2473,8 @@ static void v9fs_lock(void *opaque)
>       }
>       status = P9_LOCK_SUCCESS;
>   out:
> +    put_fid(fidp);
> +out_nofid:
>       err = offset;
>       err += pdu_marshal(pdu, offset, "b", status);
>       complete_pdu(s, pdu, err);
> @@ -2445,10 +2500,10 @@ static void v9fs_getlock(void *opaque)
>                     &glock->start,&glock->length,&glock->proc_id,
>                     &glock->client_id);
>
> -    fidp = lookup_fid(s, fid);
> +    fidp = get_fid(s, fid);
>       if (fidp == NULL) {
>           err = -ENOENT;
> -        goto out;
> +        goto out_nofid;
>       }
>       err = v9fs_co_fstat(s, fidp->fs.fd,&stbuf);
>       if (err<  0) {
> @@ -2460,6 +2515,8 @@ static void v9fs_getlock(void *opaque)
>                             &glock->client_id);
>       err = offset;
>   out:
> +    put_fid(fidp);
> +out_nofid:
>       complete_pdu(s, pdu, err);
>       qemu_free(glock);
>   }
> @@ -2480,10 +2537,10 @@ static void v9fs_mkdir(void *opaque)
>       v9fs_string_init(&fullname);
>       pdu_unmarshal(pdu, offset, "dsdd",&fid,&name,&mode,&gid);
>
> -    fidp = lookup_fid(pdu->s, fid);
> +    fidp = get_fid(pdu->s, fid);
>       if (fidp == NULL) {
>           err = -ENOENT;
> -        goto out;
> +        goto out_nofid;
>       }
>       v9fs_string_sprintf(&fullname, "%s/%s", fidp->path.data, name.data);
>       err = v9fs_co_mkdir(pdu->s, fullname.data, mode, fidp->uid, gid);
> @@ -2498,6 +2555,8 @@ static void v9fs_mkdir(void *opaque)
>       offset += pdu_marshal(pdu, offset, "Q",&qid);
>       err = offset;
>   out:
> +    put_fid(fidp);
> +out_nofid:
>       complete_pdu(pdu->s, pdu, err);
>       v9fs_string_free(&fullname);
>       v9fs_string_free(&name);
> @@ -2511,15 +2570,15 @@ static void v9fs_xattrwalk(void *opaque)
>       size_t offset = 7;
>       int32_t fid, newfid;
>       V9fsFidState *file_fidp;
> -    V9fsFidState *xattr_fidp;
> +    V9fsFidState *xattr_fidp = NULL;
>       V9fsPDU *pdu = opaque;
>       V9fsState *s = pdu->s;
>
>       pdu_unmarshal(pdu, offset, "dds",&fid,&newfid,&name);
> -    file_fidp = lookup_fid(s, fid);
> +    file_fidp = get_fid(s, fid);
>       if (file_fidp == NULL) {
>           err = -ENOENT;
> -        goto out;
> +        goto out_nofid;
>       }
>       xattr_fidp = alloc_fid(s, newfid);
>       if (xattr_fidp == NULL) {
> @@ -2534,7 +2593,9 @@ static void v9fs_xattrwalk(void *opaque)
>           size = v9fs_co_llistxattr(s,&xattr_fidp->path, NULL, 0);
>           if (size<  0) {
>               err = size;
> +            put_fid(xattr_fidp);
>               free_fid(s, xattr_fidp->fid);
> +            xattr_fidp = NULL;
>               goto out;
>           }
>           /*
> @@ -2549,7 +2610,9 @@ static void v9fs_xattrwalk(void *opaque)
>                                        xattr_fidp->fs.xattr.value,
>                                        xattr_fidp->fs.xattr.len);
>               if (err<  0) {
> +                put_fid(xattr_fidp);
>                   free_fid(s, xattr_fidp->fid);
> +                xattr_fidp = NULL;
>                   goto out;
>               }
>           }
> @@ -2564,7 +2627,9 @@ static void v9fs_xattrwalk(void *opaque)
>                                    &name, NULL, 0);
>           if (size<  0) {
>               err = size;
> +            put_fid(xattr_fidp);
>               free_fid(s, xattr_fidp->fid);
> +            xattr_fidp = NULL;
>               goto out;
>           }
>           /*
> @@ -2579,7 +2644,9 @@ static void v9fs_xattrwalk(void *opaque)
>                                       &name, xattr_fidp->fs.xattr.value,
>                                       xattr_fidp->fs.xattr.len);
>               if (err<  0) {
> +                put_fid(xattr_fidp);
>                   free_fid(s, xattr_fidp->fid);
> +                xattr_fidp = NULL;
>                   goto out;
>               }
>           }
> @@ -2587,6 +2654,11 @@ static void v9fs_xattrwalk(void *opaque)
>           err = offset;
>       }
>   out:
> +    put_fid(file_fidp);
> +    if (xattr_fidp) {
> +        put_fid(xattr_fidp);
> +    }
> +out_nofid:
>       complete_pdu(s, pdu, err);
>       v9fs_string_free(&name);
>   }
> @@ -2607,10 +2679,10 @@ static void v9fs_xattrcreate(void *opaque)
>       pdu_unmarshal(pdu, offset, "dsqd",
>                     &fid,&name,&size,&flags);
>
> -    file_fidp = lookup_fid(s, fid);
> +    file_fidp = get_fid(s, fid);
>       if (file_fidp == NULL) {
>           err = -EINVAL;
> -        goto out;
> +        goto out_nofid;
>       }
>       /* Make the file fid point to xattr */
>       xattr_fidp = file_fidp;
> @@ -2626,7 +2698,8 @@ static void v9fs_xattrcreate(void *opaque)
>           xattr_fidp->fs.xattr.value = NULL;
>       }
>       err = offset;
> -out:
> +    put_fid(file_fidp);
> +out_nofid:
>       complete_pdu(s, pdu, err);
>       v9fs_string_free(&name);
>   }
> @@ -2641,10 +2714,10 @@ static void v9fs_readlink(void *opaque)
>       V9fsFidState *fidp;
>
>       pdu_unmarshal(pdu, offset, "d",&fid);
> -    fidp = lookup_fid(pdu->s, fid);
> +    fidp = get_fid(pdu->s, fid);
>       if (fidp == NULL) {
>           err = -ENOENT;
> -        goto out;
> +        goto out_nofid;
>       }
>
>       v9fs_string_init(&target);
> @@ -2656,6 +2729,8 @@ static void v9fs_readlink(void *opaque)
>       err = offset;
>       v9fs_string_free(&target);
>   out:
> +    put_fid(fidp);
> +out_nofid:
>       complete_pdu(pdu->s, pdu, err);
>   }
>
> diff --git a/hw/9pfs/virtio-9p.h b/hw/9pfs/virtio-9p.h
> index 1d8c1b1..ce93c20 100644
> --- a/hw/9pfs/virtio-9p.h
> +++ b/hw/9pfs/virtio-9p.h
> @@ -203,6 +203,7 @@ struct V9fsFidState
>   	V9fsXattr xattr;
>       } fs;
>       uid_t uid;
> +    int ref;
>       V9fsFidState *next;
>   };
>
> @@ -361,5 +362,11 @@ static inline size_t do_pdu_unpack(void *dst, struct iovec *sg, int sg_count,
>       return pdu_packunpack(dst, sg, sg_count, offset, size, 0);
>   }
>
> +static inline void put_fid(V9fsFidState *fidp)
> +{
> +    BUG_ON(!fidp->ref);
> +    fidp->ref--;
> +}
> +
>   extern void handle_9p_output(VirtIODevice *vdev, VirtQueue *vq);
>   #endif
Aneesh Kumar K.V - June 10, 2011, 6:27 a.m.
On Thu, 09 Jun 2011 16:10:39 -0700, Venkateswararao Jujjuri <jvrao@linux.vnet.ibm.com> wrote:
> On 06/06/2011 10:16 AM, Aneesh Kumar K.V wrote:
> > Signed-off-by: Aneesh Kumar K.V<aneesh.kumar@linux.vnet.ibm.com>
> 
> Just one minor issue below; otherwise
> 
> Reviewed-by: Venkateswararao Jujjuri "<jvrao@linux.vnet.ibm.com>
> 
> > ---
....

> >   hw/9pfs/virtio-9p.c |  205 +++++++++++++++++++++++++++++++++++----------------
> >
> >       pdu_unmarshal(pdu, offset, "dd",&fid,&datasync);
> > -    fidp = lookup_fid(s, fid);
> > +    fidp = get_fid(s, fid);
> >       if (fidp == NULL) {
> >           err = -ENOENT;
> >           goto out;
> > @@ -1444,6 +1465,7 @@ static void v9fs_fsync(void *opaque)
> >           err = offset;
> >       }
> >   out:
> > +    put_fid(fidp);
> It should be
> 
> put_fid(fidp);
> 
> out_nofid:
> 

ok


> >       complete_pdu(s, pdu, err);
> >   }


-aneesh

Patch

diff --git a/hw/9pfs/virtio-9p.c b/hw/9pfs/virtio-9p.c
index e2aa863..03d8664 100644
--- a/hw/9pfs/virtio-9p.c
+++ b/hw/9pfs/virtio-9p.c
@@ -232,12 +232,13 @@  static size_t v9fs_string_size(V9fsString *str)
     return str->size;
 }
 
-static V9fsFidState *lookup_fid(V9fsState *s, int32_t fid)
+static V9fsFidState *get_fid(V9fsState *s, int32_t fid)
 {
     V9fsFidState *f;
 
     for (f = s->fid_list; f; f = f->next) {
         if (f->fid == fid) {
+            f->ref++;
             return f;
         }
     }
@@ -249,16 +250,16 @@  static V9fsFidState *alloc_fid(V9fsState *s, int32_t fid)
 {
     V9fsFidState *f;
 
-    f = lookup_fid(s, fid);
+    f = get_fid(s, fid);
     if (f) {
+        f->ref--;
         return NULL;
     }
 
     f = qemu_mallocz(sizeof(V9fsFidState));
-
     f->fid = fid;
     f->fid_type = P9_FID_NONE;
-
+    f->ref = 1;
     f->next = s->fid_list;
     s->fid_list = f;
 
@@ -1014,19 +1015,22 @@  static void v9fs_attach(void *opaque)
     fidp = alloc_fid(s, fid);
     if (fidp == NULL) {
         err = -EINVAL;
-        goto out;
+        goto out_nofid;
     }
     fidp->uid = n_uname;
     v9fs_string_sprintf(&fidp->path, "%s", "/");
     err = fid_to_qid(s, fidp, &qid);
     if (err < 0) {
         err = -EINVAL;
+        put_fid(fidp);
         free_fid(s, fid);
-        goto out;
+        goto out_nofid;
     }
     offset += pdu_marshal(pdu, offset, "Q", &qid);
     err = offset;
-out:
+    put_fid(fidp);
+
+out_nofid:
     complete_pdu(s, pdu, err);
     v9fs_string_free(&uname);
     v9fs_string_free(&aname);
@@ -1045,10 +1049,10 @@  static void v9fs_stat(void *opaque)
 
     pdu_unmarshal(pdu, offset, "d", &fid);
 
-    fidp = lookup_fid(s, fid);
+    fidp = get_fid(s, fid);
     if (fidp == NULL) {
         err = -ENOENT;
-        goto out;
+        goto out_nofid;
     }
     err = v9fs_co_lstat(s, &fidp->path, &stbuf);
     if (err < 0) {
@@ -1062,6 +1066,8 @@  static void v9fs_stat(void *opaque)
     err = offset;
     v9fs_stat_free(&v9stat);
 out:
+    put_fid(fidp);
+out_nofid:
     complete_pdu(s, pdu, err);
 }
 
@@ -1079,10 +1085,10 @@  static void v9fs_getattr(void *opaque)
 
     pdu_unmarshal(pdu, offset, "dq", &fid, &request_mask);
 
-    fidp = lookup_fid(s, fid);
+    fidp = get_fid(s, fid);
     if (fidp == NULL) {
         retval = -ENOENT;
-        goto out;
+        goto out_nofid;
     }
     /*
      * Currently we only support BASIC fields in stat, so there is no
@@ -1096,6 +1102,8 @@  static void v9fs_getattr(void *opaque)
     retval = offset;
     retval += pdu_marshal(pdu, offset, "A", &v9stat_dotl);
 out:
+    put_fid(fidp);
+out_nofid:
     complete_pdu(s, pdu, retval);
 }
 
@@ -1123,10 +1131,10 @@  static void v9fs_setattr(void *opaque)
 
     pdu_unmarshal(pdu, offset, "dI", &fid, &v9iattr);
 
-    fidp = lookup_fid(s, fid);
+    fidp = get_fid(s, fid);
     if (fidp == NULL) {
         err = -EINVAL;
-        goto out;
+        goto out_nofid;
     }
     if (v9iattr.valid & ATTR_MODE) {
         err = v9fs_co_chmod(s, &fidp->path, v9iattr.mode);
@@ -1188,6 +1196,8 @@  static void v9fs_setattr(void *opaque)
     }
     err = offset;
 out:
+    put_fid(fidp);
+out_nofid:
     complete_pdu(s, pdu, err);
 }
 
@@ -1214,7 +1224,7 @@  static void v9fs_walk(void *opaque)
     int32_t fid, newfid;
     V9fsString *wnames = NULL;
     V9fsFidState *fidp;
-    V9fsFidState *newfidp;
+    V9fsFidState *newfidp = NULL;;
     V9fsPDU *pdu = opaque;
     V9fsState *s = pdu->s;
 
@@ -1231,12 +1241,12 @@  static void v9fs_walk(void *opaque)
 
     } else if (nwnames > P9_MAXWELEM) {
         err = -EINVAL;
-        goto out;
+        goto out_nofid;
     }
-    fidp = lookup_fid(s, fid);
+    fidp = get_fid(s, fid);
     if (fidp == NULL) {
         err = -ENOENT;
-        goto out;
+        goto out_nofid;
     }
     if (fid == newfid) {
         BUG_ON(fidp->fid_type != P9_FID_NONE);
@@ -1269,7 +1279,9 @@  static void v9fs_walk(void *opaque)
             v9fs_string_copy(&newfidp->path, &path);
             err = v9fs_co_lstat(s, &newfidp->path, &stbuf);
             if (err < 0) {
+                put_fid(newfidp);
                 free_fid(s, newfidp->fid);
+                newfidp = NULL;
                 v9fs_string_free(&path);
                 goto out;
             }
@@ -1279,6 +1291,11 @@  static void v9fs_walk(void *opaque)
     }
     err = v9fs_walk_marshal(pdu, nwnames, qids);
 out:
+    put_fid(fidp);
+    if (newfidp) {
+        put_fid(newfidp);
+    }
+out_nofid:
     complete_pdu(s, pdu, err);
     if (nwnames && nwnames <= P9_MAXWELEM) {
         for (name_idx = 0; name_idx < nwnames; name_idx++) {
@@ -1327,10 +1344,10 @@  static void v9fs_open(void *opaque)
     } else {
         pdu_unmarshal(pdu, offset, "db", &fid, &mode);
     }
-    fidp = lookup_fid(s, fid);
+    fidp = get_fid(s, fid);
     if (fidp == NULL) {
         err = -ENOENT;
-        goto out;
+        goto out_nofid;
     }
     BUG_ON(fidp->fid_type != P9_FID_NONE);
 
@@ -1366,6 +1383,8 @@  static void v9fs_open(void *opaque)
         err = offset;
     }
 out:
+    put_fid(fidp);
+out_nofid:
     complete_pdu(s, pdu, err);
 }
 
@@ -1388,10 +1407,10 @@  static void v9fs_lcreate(void *opaque)
     pdu_unmarshal(pdu, offset, "dsddd", &dfid, &name, &flags,
                   &mode, &gid);
 
-    fidp = lookup_fid(pdu->s, dfid);
+    fidp = get_fid(pdu->s, dfid);
     if (fidp == NULL) {
         err = -ENOENT;
-        goto out;
+        goto out_nofid;
     }
     v9fs_string_sprintf(&fullname, "%s/%s", fidp->path.data, name.data);
 
@@ -1418,6 +1437,8 @@  static void v9fs_lcreate(void *opaque)
     offset += pdu_marshal(pdu, offset, "Qd", &qid, iounit);
     err = offset;
 out:
+    put_fid(fidp);
+out_nofid:
     complete_pdu(pdu->s, pdu, err);
     v9fs_string_free(&name);
     v9fs_string_free(&fullname);
@@ -1434,7 +1455,7 @@  static void v9fs_fsync(void *opaque)
     V9fsState *s = pdu->s;
 
     pdu_unmarshal(pdu, offset, "dd", &fid, &datasync);
-    fidp = lookup_fid(s, fid);
+    fidp = get_fid(s, fid);
     if (fidp == NULL) {
         err = -ENOENT;
         goto out;
@@ -1444,6 +1465,7 @@  static void v9fs_fsync(void *opaque)
         err = offset;
     }
 out:
+    put_fid(fidp);
     complete_pdu(s, pdu, err);
 }
 
@@ -1561,10 +1583,10 @@  static void v9fs_read(void *opaque)
 
     pdu_unmarshal(pdu, offset, "dqd", &fid, &off, &max_count);
 
-    fidp = lookup_fid(s, fid);
+    fidp = get_fid(s, fid);
     if (fidp == NULL) {
         err = -EINVAL;
-        goto out;
+        goto out_nofid;
     }
     if (fidp->fid_type == P9_FID_DIR) {
 
@@ -1616,6 +1638,8 @@  static void v9fs_read(void *opaque)
         err = -EINVAL;
     }
 out:
+    put_fid(fidp);
+out_nofid:
     complete_pdu(s, pdu, err);
 }
 
@@ -1700,8 +1724,12 @@  static void v9fs_readdir(void *opaque)
 
     pdu_unmarshal(pdu, offset, "dqd", &fid, &initial_offset, &max_count);
 
-    fidp = lookup_fid(s, fid);
-    if (fidp == NULL || !fidp->fs.dir) {
+    fidp = get_fid(s, fid);
+    if (fidp == NULL) {
+        retval = -EINVAL;
+        goto out_nofid;
+    }
+    if (!fidp->fs.dir) {
         retval = -EINVAL;
         goto out;
     }
@@ -1719,6 +1747,8 @@  static void v9fs_readdir(void *opaque)
     retval += pdu_marshal(pdu, offset, "d", count);
     retval += count;
 out:
+    put_fid(fidp);
+out_nofid:
     complete_pdu(s, pdu, retval);
 }
 
@@ -1784,10 +1814,10 @@  static void v9fs_write(void *opaque)
 
     pdu_unmarshal(pdu, offset, "dqdv", &fid, &off, &count, sg, &cnt);
 
-    fidp = lookup_fid(s, fid);
+    fidp = get_fid(s, fid);
     if (fidp == NULL) {
         err = -EINVAL;
-        goto out;
+        goto out_nofid;
     }
     if (fidp->fid_type == P9_FID_FILE) {
         if (fidp->fs.fd == -1) {
@@ -1827,6 +1857,8 @@  static void v9fs_write(void *opaque)
     offset += pdu_marshal(pdu, offset, "d", total);
     err = offset;
 out:
+    put_fid(fidp);
+out_nofid:
     complete_pdu(s, pdu, err);
 }
 
@@ -1851,10 +1883,10 @@  static void v9fs_create(void *opaque)
     pdu_unmarshal(pdu, offset, "dsdbs", &fid, &name,
                   &perm, &mode, &extension);
 
-    fidp = lookup_fid(pdu->s, fid);
+    fidp = get_fid(pdu->s, fid);
     if (fidp == NULL) {
         err = -EINVAL;
-        goto out;
+        goto out_nofid;
     }
 
     v9fs_string_sprintf(&fullname, "%s/%s", fidp->path.data, name.data);
@@ -1884,15 +1916,17 @@  static void v9fs_create(void *opaque)
         }
     } else if (perm & P9_STAT_MODE_LINK) {
         int32_t nfid = atoi(extension.data);
-        V9fsFidState *nfidp = lookup_fid(pdu->s, nfid);
+        V9fsFidState *nfidp = get_fid(pdu->s, nfid);
         if (nfidp == NULL) {
             err = -EINVAL;
             goto out;
         }
         err = v9fs_co_link(pdu->s, &nfidp->path, &fullname);
         if (err < 0) {
+            put_fid(nfidp);
             goto out;
         }
+        put_fid(nfidp);
     } else if (perm & P9_STAT_MODE_DEVICE) {
         char ctype;
         uint32_t major, minor;
@@ -1956,6 +1990,8 @@  static void v9fs_create(void *opaque)
     err = offset;
 
 out:
+    put_fid(fidp);
+out_nofid:
    complete_pdu(pdu->s, pdu, err);
    v9fs_string_free(&name);
    v9fs_string_free(&extension);
@@ -1980,10 +2016,10 @@  static void v9fs_symlink(void *opaque)
 
     pdu_unmarshal(pdu, offset, "dssd", &dfid, &name, &symname, &gid);
 
-    dfidp = lookup_fid(pdu->s, dfid);
+    dfidp = get_fid(pdu->s, dfid);
     if (dfidp == NULL) {
         err = -EINVAL;
-        goto out;
+        goto out_nofid;
     }
 
     v9fs_string_sprintf(&fullname, "%s/%s", dfidp->path.data, name.data);
@@ -1999,6 +2035,8 @@  static void v9fs_symlink(void *opaque)
     offset += pdu_marshal(pdu, offset, "Q", &qid);
     err = offset;
 out:
+    put_fid(dfidp);
+out_nofid:
     complete_pdu(pdu->s, pdu, err);
     v9fs_string_free(&name);
     v9fs_string_free(&symname);
@@ -2028,13 +2066,13 @@  static void v9fs_link(void *opaque)
 
     pdu_unmarshal(pdu, offset, "dds", &dfid, &oldfid, &name);
 
-    dfidp = lookup_fid(s, dfid);
+    dfidp = get_fid(s, dfid);
     if (dfidp == NULL) {
         err = -ENOENT;
-        goto out;
+        goto out_nofid;
     }
 
-    oldfidp = lookup_fid(s, oldfid);
+    oldfidp = get_fid(s, oldfid);
     if (oldfidp == NULL) {
         err = -ENOENT;
         goto out;
@@ -2048,6 +2086,8 @@  static void v9fs_link(void *opaque)
     v9fs_string_free(&fullname);
 
 out:
+    put_fid(dfidp);
+out_nofid:
     v9fs_string_free(&name);
     complete_pdu(s, pdu, err);
 }
@@ -2062,10 +2102,10 @@  static void v9fs_remove(void *opaque)
 
     pdu_unmarshal(pdu, offset, "d", &fid);
 
-    fidp = lookup_fid(pdu->s, fid);
+    fidp = get_fid(pdu->s, fid);
     if (fidp == NULL) {
         err = -EINVAL;
-        goto out;
+        goto out_nofid;
     }
     err = v9fs_co_remove(pdu->s, &fidp->path);
     if (!err) {
@@ -2073,8 +2113,9 @@  static void v9fs_remove(void *opaque)
     }
 
     /* For TREMOVE we need to clunk the fid even on failed remove */
+    put_fid(fidp);
     free_fid(pdu->s, fidp->fid);
-out:
+out_nofid:
     complete_pdu(pdu->s, pdu, err);
 }
 
@@ -2083,14 +2124,14 @@  static int v9fs_complete_rename(V9fsState *s, V9fsFidState *fidp,
 {
     char *end;
     int err = 0;
+    V9fsFidState *dirfidp = NULL;
     char *old_name, *new_name;
 
     if (newdirfid != -1) {
-        V9fsFidState *dirfidp;
-        dirfidp = lookup_fid(s, newdirfid);
+        dirfidp = get_fid(s, newdirfid);
         if (dirfidp == NULL) {
             err = -ENOENT;
-            goto out;
+            goto out_nofid;
         }
         BUG_ON(dirfidp->fid_type != P9_FID_NONE);
 
@@ -2143,6 +2184,10 @@  static int v9fs_complete_rename(V9fsState *s, V9fsFidState *fidp,
         v9fs_string_copy(&fidp->path, name);
     }
 out:
+    if (dirfidp) {
+        put_fid(dirfidp);
+    }
+out_nofid:
     return err;
 }
 
@@ -2159,10 +2204,10 @@  static void v9fs_rename(void *opaque)
 
     pdu_unmarshal(pdu, offset, "dds", &fid, &newdirfid, &name);
 
-    fidp = lookup_fid(s, fid);
+    fidp = get_fid(s, fid);
     if (fidp == NULL) {
         err = -ENOENT;
-        goto out;
+        goto out_nofid;
     }
     BUG_ON(fidp->fid_type != P9_FID_NONE);
 
@@ -2171,6 +2216,8 @@  static void v9fs_rename(void *opaque)
         err = offset;
     }
 out:
+    put_fid(fidp);
+out_nofid:
     complete_pdu(s, pdu, err);
     v9fs_string_free(&name);
 }
@@ -2189,10 +2236,10 @@  static void v9fs_wstat(void *opaque)
 
     pdu_unmarshal(pdu, offset, "dwS", &fid, &unused, &v9stat);
 
-    fidp = lookup_fid(s, fid);
+    fidp = get_fid(s, fid);
     if (fidp == NULL) {
         err = -EINVAL;
-        goto out;
+        goto out_nofid;
     }
     /* do we need to sync the file? */
     if (donttouch_stat(&v9stat)) {
@@ -2258,6 +2305,8 @@  static void v9fs_wstat(void *opaque)
     }
     err = offset;
 out:
+    put_fid(fidp);
+out_nofid:
     v9fs_stat_free(&v9stat);
     complete_pdu(s, pdu, err);
 }
@@ -2318,10 +2367,10 @@  static void v9fs_statfs(void *opaque)
     V9fsState *s = pdu->s;
 
     pdu_unmarshal(pdu, offset, "d", &fid);
-    fidp = lookup_fid(s, fid);
+    fidp = get_fid(s, fid);
     if (fidp == NULL) {
         retval = -ENOENT;
-        goto out;
+        goto out_nofid;
     }
     retval = v9fs_co_statfs(s, &fidp->path, &stbuf);
     if (retval < 0) {
@@ -2330,6 +2379,8 @@  static void v9fs_statfs(void *opaque)
     retval = offset;
     retval += v9fs_fill_statfs(s, pdu, &stbuf);
 out:
+    put_fid(fidp);
+out_nofid:
     complete_pdu(s, pdu, retval);
     return;
 }
@@ -2355,10 +2406,10 @@  static void v9fs_mknod(void *opaque)
     pdu_unmarshal(pdu, offset, "dsdddd", &fid, &name, &mode,
                   &major, &minor, &gid);
 
-    fidp = lookup_fid(s, fid);
+    fidp = get_fid(s, fid);
     if (fidp == NULL) {
         err = -ENOENT;
-        goto out;
+        goto out_nofid;
     }
     v9fs_string_sprintf(&fullname, "%s/%s", fidp->path.data, name.data);
     err = v9fs_co_mknod(s, &fullname, fidp->uid, gid,
@@ -2374,6 +2425,8 @@  static void v9fs_mknod(void *opaque)
     err = offset;
     err += pdu_marshal(pdu, offset, "Q", &qid);
 out:
+    put_fid(fidp);
+out_nofid:
     complete_pdu(s, pdu, err);
     v9fs_string_free(&fullname);
     v9fs_string_free(&name);
@@ -2407,12 +2460,12 @@  static void v9fs_lock(void *opaque)
     /* We support only block flag now (that too ignored currently) */
     if (flock->flags & ~P9_LOCK_FLAGS_BLOCK) {
         err = -EINVAL;
-        goto out;
+        goto out_nofid;
     }
-    fidp = lookup_fid(s, fid);
+    fidp = get_fid(s, fid);
     if (fidp == NULL) {
         err = -ENOENT;
-        goto out;
+        goto out_nofid;
     }
     err = v9fs_co_fstat(s, fidp->fs.fd, &stbuf);
     if (err < 0) {
@@ -2420,6 +2473,8 @@  static void v9fs_lock(void *opaque)
     }
     status = P9_LOCK_SUCCESS;
 out:
+    put_fid(fidp);
+out_nofid:
     err = offset;
     err += pdu_marshal(pdu, offset, "b", status);
     complete_pdu(s, pdu, err);
@@ -2445,10 +2500,10 @@  static void v9fs_getlock(void *opaque)
                   &glock->start, &glock->length, &glock->proc_id,
                   &glock->client_id);
 
-    fidp = lookup_fid(s, fid);
+    fidp = get_fid(s, fid);
     if (fidp == NULL) {
         err = -ENOENT;
-        goto out;
+        goto out_nofid;
     }
     err = v9fs_co_fstat(s, fidp->fs.fd, &stbuf);
     if (err < 0) {
@@ -2460,6 +2515,8 @@  static void v9fs_getlock(void *opaque)
                           &glock->client_id);
     err = offset;
 out:
+    put_fid(fidp);
+out_nofid:
     complete_pdu(s, pdu, err);
     qemu_free(glock);
 }
@@ -2480,10 +2537,10 @@  static void v9fs_mkdir(void *opaque)
     v9fs_string_init(&fullname);
     pdu_unmarshal(pdu, offset, "dsdd", &fid, &name, &mode, &gid);
 
-    fidp = lookup_fid(pdu->s, fid);
+    fidp = get_fid(pdu->s, fid);
     if (fidp == NULL) {
         err = -ENOENT;
-        goto out;
+        goto out_nofid;
     }
     v9fs_string_sprintf(&fullname, "%s/%s", fidp->path.data, name.data);
     err = v9fs_co_mkdir(pdu->s, fullname.data, mode, fidp->uid, gid);
@@ -2498,6 +2555,8 @@  static void v9fs_mkdir(void *opaque)
     offset += pdu_marshal(pdu, offset, "Q", &qid);
     err = offset;
 out:
+    put_fid(fidp);
+out_nofid:
     complete_pdu(pdu->s, pdu, err);
     v9fs_string_free(&fullname);
     v9fs_string_free(&name);
@@ -2511,15 +2570,15 @@  static void v9fs_xattrwalk(void *opaque)
     size_t offset = 7;
     int32_t fid, newfid;
     V9fsFidState *file_fidp;
-    V9fsFidState *xattr_fidp;
+    V9fsFidState *xattr_fidp = NULL;
     V9fsPDU *pdu = opaque;
     V9fsState *s = pdu->s;
 
     pdu_unmarshal(pdu, offset, "dds", &fid, &newfid, &name);
-    file_fidp = lookup_fid(s, fid);
+    file_fidp = get_fid(s, fid);
     if (file_fidp == NULL) {
         err = -ENOENT;
-        goto out;
+        goto out_nofid;
     }
     xattr_fidp = alloc_fid(s, newfid);
     if (xattr_fidp == NULL) {
@@ -2534,7 +2593,9 @@  static void v9fs_xattrwalk(void *opaque)
         size = v9fs_co_llistxattr(s, &xattr_fidp->path, NULL, 0);
         if (size < 0) {
             err = size;
+            put_fid(xattr_fidp);
             free_fid(s, xattr_fidp->fid);
+            xattr_fidp = NULL;
             goto out;
         }
         /*
@@ -2549,7 +2610,9 @@  static void v9fs_xattrwalk(void *opaque)
                                      xattr_fidp->fs.xattr.value,
                                      xattr_fidp->fs.xattr.len);
             if (err < 0) {
+                put_fid(xattr_fidp);
                 free_fid(s, xattr_fidp->fid);
+                xattr_fidp = NULL;
                 goto out;
             }
         }
@@ -2564,7 +2627,9 @@  static void v9fs_xattrwalk(void *opaque)
                                  &name, NULL, 0);
         if (size < 0) {
             err = size;
+            put_fid(xattr_fidp);
             free_fid(s, xattr_fidp->fid);
+            xattr_fidp = NULL;
             goto out;
         }
         /*
@@ -2579,7 +2644,9 @@  static void v9fs_xattrwalk(void *opaque)
                                     &name, xattr_fidp->fs.xattr.value,
                                     xattr_fidp->fs.xattr.len);
             if (err < 0) {
+                put_fid(xattr_fidp);
                 free_fid(s, xattr_fidp->fid);
+                xattr_fidp = NULL;
                 goto out;
             }
         }
@@ -2587,6 +2654,11 @@  static void v9fs_xattrwalk(void *opaque)
         err = offset;
     }
 out:
+    put_fid(file_fidp);
+    if (xattr_fidp) {
+        put_fid(xattr_fidp);
+    }
+out_nofid:
     complete_pdu(s, pdu, err);
     v9fs_string_free(&name);
 }
@@ -2607,10 +2679,10 @@  static void v9fs_xattrcreate(void *opaque)
     pdu_unmarshal(pdu, offset, "dsqd",
                   &fid, &name, &size, &flags);
 
-    file_fidp = lookup_fid(s, fid);
+    file_fidp = get_fid(s, fid);
     if (file_fidp == NULL) {
         err = -EINVAL;
-        goto out;
+        goto out_nofid;
     }
     /* Make the file fid point to xattr */
     xattr_fidp = file_fidp;
@@ -2626,7 +2698,8 @@  static void v9fs_xattrcreate(void *opaque)
         xattr_fidp->fs.xattr.value = NULL;
     }
     err = offset;
-out:
+    put_fid(file_fidp);
+out_nofid:
     complete_pdu(s, pdu, err);
     v9fs_string_free(&name);
 }
@@ -2641,10 +2714,10 @@  static void v9fs_readlink(void *opaque)
     V9fsFidState *fidp;
 
     pdu_unmarshal(pdu, offset, "d", &fid);
-    fidp = lookup_fid(pdu->s, fid);
+    fidp = get_fid(pdu->s, fid);
     if (fidp == NULL) {
         err = -ENOENT;
-        goto out;
+        goto out_nofid;
     }
 
     v9fs_string_init(&target);
@@ -2656,6 +2729,8 @@  static void v9fs_readlink(void *opaque)
     err = offset;
     v9fs_string_free(&target);
 out:
+    put_fid(fidp);
+out_nofid:
     complete_pdu(pdu->s, pdu, err);
 }
 
diff --git a/hw/9pfs/virtio-9p.h b/hw/9pfs/virtio-9p.h
index 1d8c1b1..ce93c20 100644
--- a/hw/9pfs/virtio-9p.h
+++ b/hw/9pfs/virtio-9p.h
@@ -203,6 +203,7 @@  struct V9fsFidState
 	V9fsXattr xattr;
     } fs;
     uid_t uid;
+    int ref;
     V9fsFidState *next;
 };
 
@@ -361,5 +362,11 @@  static inline size_t do_pdu_unpack(void *dst, struct iovec *sg, int sg_count,
     return pdu_packunpack(dst, sg, sg_count, offset, size, 0);
 }
 
+static inline void put_fid(V9fsFidState *fidp)
+{
+    BUG_ON(!fidp->ref);
+    fidp->ref--;
+}
+
 extern void handle_9p_output(VirtIODevice *vdev, VirtQueue *vq);
 #endif