[openib-general] [PATCH] Missing check for atomic_dec in ib_post_send_mad

[Krishna Kumar]

I believe the recent changes to catch all atomic_dec races with unregister
failed to catch one spot in ib_post_send_mad. This routine increments
mad_agent_priv->refcnt, and while unregister can run, if the ib_send_mad()
fails, we drop the refcnt without checking if the refcnt has dropped to
zero. The unregister would block indefinitely waiting to be woken up. I
think the rest of the atomic_dec's looks good though.

Patch included as attachment as well as inline ...

Thanks,

- KK

diff -ruNp 1/mad.c 2/mad.c
--- 1/mad.c	2004-11-01 16:01:05.000000000 -0800
+++ 2/mad.c	2004-11-01 16:01:09.000000000 -0800
@@ -432,7 +432,8 @@ int ib_post_send_mad(struct ib_mad_agent
 			spin_unlock_irqrestore(&mad_agent_priv->lock, flags);

 			*bad_send_wr = cur_send_wr;
-			atomic_dec(&mad_agent_priv->refcount);
+			if (atomic_dec_and_test(&mad_agent_priv->refcount))
+				wake_up(&mad_agent_priv->wait);
 			return ret;
 		}
 		cur_send_wr= next_send_wr;
-------------- next part --------------
diff -ruNp 1/mad.c 2/mad.c
--- 1/mad.c	2004-11-01 16:01:05.000000000 -0800
+++ 2/mad.c	2004-11-01 16:01:09.000000000 -0800
@@ -432,7 +432,8 @@ int ib_post_send_mad(struct ib_mad_agent
 			spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
 
 			*bad_send_wr = cur_send_wr;
-			atomic_dec(&mad_agent_priv->refcount);
+			if (atomic_dec_and_test(&mad_agent_priv->refcount))
+				wake_up(&mad_agent_priv->wait);
 			return ret;		
 		}
 		cur_send_wr= next_send_wr;