<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=us-ascii">
<META content="MSHTML 6.00.2900.2873" name=GENERATOR></HEAD>
<BODY>
<DIV><FONT face=Arial size=2><SPAN class=926493815-16052006>Hi
Fab,</SPAN></FONT></DIV>
<DIV><FONT face=Arial size=2><SPAN
class=926493815-16052006></SPAN></FONT> </DIV>
<DIV><FONT face=Arial size=2><SPAN class=926493815-16052006>While doing some
tests on WSD, I have came to a conclusion that there is a race in the function
ibsp_conn_insert().</SPAN></FONT></DIV>
<DIV><FONT face=Arial size=2><SPAN
class=926493815-16052006></SPAN></FONT> </DIV>
<DIV><FONT face=Arial size=2><SPAN class=926493815-16052006>If I'm right, than
the problem is that the code looks at the root of conn_map without locking
first. Since the root might change, until the lock is taken, I have received
situations in which I was inserting at a time that the p_insert_at was no longer
valid.</SPAN></FONT></DIV>
<DIV><FONT face=Arial size=2><SPAN
class=926493815-16052006></SPAN></FONT> </DIV>
<DIV><FONT face=Arial size=2><SPAN class=926493815-16052006>At the end of the
function there is a similar situation that is probably not a bug. Still, to be
on the safe side I have also inserted this under the lock.</SPAN></FONT></DIV>
<DIV><FONT face=Arial size=2><SPAN
class=926493815-16052006></SPAN></FONT> </DIV>
<DIV><FONT face=Arial size=2><SPAN class=926493815-16052006>The attached patch
fixes this problem.</SPAN></FONT></DIV>
<DIV><FONT face=Arial size=2><SPAN
class=926493815-16052006></SPAN></FONT> </DIV>
<DIV><FONT face=Arial size=2><SPAN
class=926493815-16052006>Thanks</SPAN></FONT></DIV>
<DIV><FONT face=Arial size=2><SPAN
class=926493815-16052006>Tzachi</SPAN></FONT></DIV>
<DIV><FONT face=Arial size=2><SPAN
class=926493815-16052006></SPAN></FONT> </DIV>
<DIV><FONT face=Arial size=2><SPAN class=926493815-16052006>Index:
core/complib/cl_map.c<BR>===================================================================<BR>---
core/complib/cl_map.c (revision 340)<BR>+++
core/complib/cl_map.c (working copy)<BR>@@ -286,6 +286,7
@@<BR> CL_ASSERT( p_map->root.p_up == &p_map->root
);<BR> CL_ASSERT( p_map->root.color != CL_MAP_RED
);<BR> CL_ASSERT( p_map->nil.color != CL_MAP_RED
);<BR>+ CL_ASSERT(p_insert_at->p_map ==
p_map);<BR> <BR> p_item->p_left =
&p_map->nil;<BR> p_item->p_right =
&p_map->nil;<BR>Index:
inc/iba/ib_al.h<BR>===================================================================<BR>---
inc/iba/ib_al.h (revision 340)<BR>+++ inc/iba/ib_al.h (working
copy)<BR>@@ -8104,6 +8104,34 @@<BR> <BR> #define
IB_PNP_REG_COMPLETE IB_PNP_FLAG_REG_COMPLETE<BR> <BR>+AL_INLINE
char * get_pnp_event_name(int event)<BR>+{<BR>+ switch( event
)<BR>+ {<BR>+ case IB_PNP_CA_ADD : return
"IB_PNP_CA_ADD";<BR>+ case IB_PNP_CA_REMOVE : return
"IB_PNP_CA_REMOVE";<BR>+ case IB_PNP_PORT_ADD :
return "IB_PNP_PORT_ADD";<BR>+ case
IB_PNP_PORT_REMOVE : return
"IB_PNP_PORT_REMOVE";<BR>+ case IB_PNP_PORT_INIT :
return "IB_PNP_PORT_INIT";<BR>+ case
IB_PNP_PORT_ARMED : return
"IB_PNP_PORT_ARMED";<BR>+ case IB_PNP_PORT_ACTIVE :
return "IB_PNP_PORT_ACTIVE";<BR>+ case
IB_PNP_PORT_DOWN : return
"IB_PNP_PORT_DOWN";<BR>+ case IB_PNP_PKEY_CHANGE :
return "IB_PNP_PKEY_CHANGE";<BR>+ case
IB_PNP_SM_CHANGE : return
"IB_PNP_SM_CHANGE";<BR>+ case IB_PNP_GID_CHANGE :
return "IB_PNP_GID_CHANGE";<BR>+ case
IB_PNP_LID_CHANGE : return
"IB_PNP_LID_CHANGE";<BR>+ case IB_PNP_SUBNET_TIMEOUT_CHANGE : return
"IB_PNP_SUBNET_TIMEOUT_CHANGE";<BR>+ case
IB_PNP_IOU_ADD : return
"IB_PNP_IOU_ADD";<BR>+ case IB_PNP_IOU_REMOVE :
return "IB_PNP_IOU_REMOVE";<BR>+ case
IB_PNP_IOC_ADD : return
"IB_PNP_IOC_ADD";<BR>+ case IB_PNP_IOC_REMOVE :
return "IB_PNP_IOC_REMOVE";<BR>+ case
IB_PNP_IOC_PATH_ADD : return
"IB_PNP_IOC_PATH_ADD";<BR>+ case IB_PNP_IOC_PATH_REMOVE :
return "IB_PNP_IOC_PATH_REMOVE";<BR>+ case
IB_PNP_REG_COMPLETE : return
"IB_PNP_REG_COMPLETE";<BR>+ }<BR>+ return
"Unknown";<BR>+}<BR>+<BR> typedef
uint32_t ib_pnp_event_t;<BR> /*<BR> * VALUES<BR>Index:
ulp/wsd/user/ibsp_iblow.c<BR>===================================================================<BR>---
ulp/wsd/user/ibsp_iblow.c (revision 340)<BR>+++
ulp/wsd/user/ibsp_iblow.c (working copy)<BR>@@ -1206,13 +1206,15
@@<BR> IN struct
ibsp_socket_info *s )<BR> {<BR> struct
ibsp_socket_info *p_sock;<BR>- cl_rbmap_item_t *p_item,
*p_insert_at;<BR>+ cl_rbmap_item_t *p_item,
*p_insert_at;<BR> boolean_t left =
TRUE;<BR>+ boolean_t ret =
FALSE;<BR> <BR>+ cl_spinlock_acquire( &g_ibsp.socket_info_mutex
);<BR> p_item = cl_rbmap_root( &g_ibsp.conn_map
);<BR> p_insert_at = p_item;<BR> <BR>- cl_spinlock_acquire(
&g_ibsp.socket_info_mutex );<BR>+<BR> CL_ASSERT(
!s->conn_item.p_map );<BR> while( p_item != cl_rbmap_end(
&g_ibsp.conn_map ) )<BR> {<BR>@@ -1247,10 +1249,10
@@<BR> }<BR> <BR> cl_rbmap_insert(
&g_ibsp.conn_map, p_insert_at, &s->conn_item, left
);<BR>-<BR>+ ret = p_item == cl_rbmap_end( &g_ibsp.conn_map
);<BR> done:<BR> cl_spinlock_release(
&g_ibsp.socket_info_mutex );<BR>- return p_item == cl_rbmap_end(
&g_ibsp.conn_map );<BR>+ return
ret;<BR> }<BR> <BR> <BR></SPAN></FONT></DIV></BODY></HTML>