[ofa-general] [PATCH 2 of 2] libmthca: Fix race condition in create/destroy QP

[Jack Morgenstein]

Index: libmthca/src/verbs.c
===================================================================
--- libmthca.orig/src/verbs.c	2008-11-22 10:33:08.000000000 +0200
+++ libmthca/src/verbs.c	2008-11-22 10:58:01.258153000 +0200
@@ -566,6 +566,7 @@ struct ibv_qp *mthca_create_qp(struct ib
 		cmd.sq_db_index = cmd.rq_db_index = 0;
 	}
 
+	pthread_mutex_lock(&to_mctx(pd->context)->qp_table_mutex);
 	ret = ibv_cmd_create_qp(pd, &qp->ibv_qp, attr, &cmd.ibv_cmd, sizeof cmd,
 				&resp, sizeof resp);
 	if (ret)
@@ -579,6 +580,7 @@ struct ibv_qp *mthca_create_qp(struct ib
 	ret = mthca_store_qp(to_mctx(pd->context), qp->ibv_qp.qp_num, qp);
 	if (ret)
 		goto err_destroy;
+	pthread_mutex_unlock(&to_mctx(pd->context)->qp_table_mutex);
 
 	qp->sq.max 	    = attr->cap.max_send_wr;
 	qp->rq.max 	    = attr->cap.max_recv_wr;
@@ -592,6 +594,7 @@ err_destroy:
 	ibv_cmd_destroy_qp(&qp->ibv_qp);
 
 err_rq_db:
+	pthread_mutex_unlock(&to_mctx(pd->context)->qp_table_mutex);
 	if (mthca_is_memfree(pd->context))
 		mthca_free_db(to_mctx(pd->context)->db_tab, MTHCA_DB_TYPE_RQ,
 			      qp->rq.db_index);
@@ -686,9 +689,12 @@ int mthca_destroy_qp(struct ibv_qp *qp)
 {
 	int ret;
 
+	pthread_mutex_lock(&to_mctx(qp->context)->qp_table_mutex);
 	ret = ibv_cmd_destroy_qp(qp);
-	if (ret)
+	if (ret) {
+		pthread_mutex_unlock(&to_mctx(qp->context)->qp_table_mutex);
 		return ret;
+	}
 
 	mthca_lock_cqs(qp);
 
@@ -700,6 +706,7 @@ int mthca_destroy_qp(struct ibv_qp *qp)
 	mthca_clear_qp(to_mctx(qp->context), qp->qp_num);
 
 	mthca_unlock_cqs(qp);
+	pthread_mutex_unlock(&to_mctx(qp->context)->qp_table_mutex);
 
 	if (mthca_is_memfree(qp->context)) {
 		mthca_free_db(to_mctx(qp->context)->db_tab, MTHCA_DB_TYPE_RQ,
Index: libmthca/src/qp.c
===================================================================
--- libmthca.orig/src/qp.c	2008-11-22 10:33:08.000000000 +0200
+++ libmthca/src/qp.c	2008-11-22 10:55:33.313592000 +0200
@@ -909,39 +909,27 @@ struct mthca_qp *mthca_find_qp(struct mt
 int mthca_store_qp(struct mthca_context *ctx, uint32_t qpn, struct mthca_qp *qp)
 {
 	int tind = (qpn & (ctx->num_qps - 1)) >> ctx->qp_table_shift;
-	int ret = 0;
-
-	pthread_mutex_lock(&ctx->qp_table_mutex);
 
 	if (!ctx->qp_table[tind].refcnt) {
 		ctx->qp_table[tind].table = calloc(ctx->qp_table_mask + 1,
 						   sizeof (struct mthca_qp *));
-		if (!ctx->qp_table[tind].table) {
-			ret = -1;
-			goto out;
-		}
+		if (!ctx->qp_table[tind].table)
+			return -1;
 	}
 
 	++ctx->qp_table[tind].refcnt;
 	ctx->qp_table[tind].table[qpn & ctx->qp_table_mask] = qp;
-
-out:
-	pthread_mutex_unlock(&ctx->qp_table_mutex);
-	return ret;
+	return 0;
 }
 
 void mthca_clear_qp(struct mthca_context *ctx, uint32_t qpn)
 {
 	int tind = (qpn & (ctx->num_qps - 1)) >> ctx->qp_table_shift;
 
-	pthread_mutex_lock(&ctx->qp_table_mutex);
-
 	if (!--ctx->qp_table[tind].refcnt)
 		free(ctx->qp_table[tind].table);
 	else
 		ctx->qp_table[tind].table[qpn & ctx->qp_table_mask] = NULL;
-
-	pthread_mutex_unlock(&ctx->qp_table_mutex);
 }
 
 int mthca_free_err_wqe(struct mthca_qp *qp, int is_send,