[Openib-windows] A crash handling IB_PNP_CA_ADD event

[Leonid Keller]

Hi Fab,

The crash happens while handling IB_PNP_CA_ADD event. IBAL propagates
this event to a registrant - not clear, which - but the latter returns
for some reason an error, and IBAL fails upon handling that: context_map
and map_item seemed to be damaged.
Do you have some idea ?
Could it have happened if an HCA made registartion the second time ?
TIA

	/* Invoke the user callback. */
	status = p_reg->pfn_pnp_cb( &u.user_rec );

	if( status == IB_SUCCESS )
	{
		/* Store the user's event context in the context block.
*/
		p_context->context = u.user_rec.context;
	}
	else
	{
>		cl_qmap_remove_item( &p_reg->context_map,
&p_context->map_item );
		cl_free( p_context );
	}


There follows a crash info: 
*** Fatal System Error: 0x0000007e
(0xFFFFFFFFC0000005,0xFFFFFADF98E6D80C,0xFFFFFADF9A80E980,0xFFFFFADF9A80
E390)
STACK_TEXT: 
fffffadf`9a80eba0 fffffadf`98e79767 : fffffadf`9a26d600
fffffadf`9a80ec60 00000000`00000011 fffffa80`02925a20 :
ibbus!cl_qmap_remove_item+0x3c
[s:\builds\1350\trunk\core\complib\cl_map.c @ 1005]
fffffadf`9a80ebd0 fffffadf`98e798c3 : fffffadf`cd98fe40
fffffadf`ce352800 fffffa80`02925a20 fffffadf`cd6e70e0 :
ibbus!__pnp_notify_user+0x1d7
[s:\builds\1350\trunk\core\al\kernel\al_pnp.c @ 527]
fffffadf`9a80ec40 fffffadf`98e79f30 : fffffadf`ce3528f0
00000000`00000080 fffffadf`cddb6298 fffffadf`cd98fe40 :
ibbus!__pnp_port_notify+0xa3
[s:\builds\1350\trunk\core\al\kernel\al_pnp.c @ 607]
fffffadf`9a80ecb0 fffffadf`98e6ce13 : fffffadf`cddb6278
00000000`00000080 fffffadf`cddb6298 fffffadf`cd98fe40 :
ibbus!__pnp_process_add_ca+0x140
[s:\builds\1350\trunk\core\al\kernel\al_pnp.c @ 936]
fffffadf`9a80ece0 fffffadf`98e6f20b : fffffadf`cddcb950
fffffadf`cddb6160 fffffadf`ce31b760 fffffadf`9a273680 :
ibbus!__cl_async_proc_worker+0x73
[s:\builds\1350\trunk\core\complib\cl_async_proc.c @ 153]
fffffadf`9a80ed10 fffffadf`98e6f8f8 : 00000000`00000000
fffffadf`cddcb950 fffffadf`cddcb950 fffffadf`9a273680 :
ibbus!__cl_thread_pool_routine+0x4b
[s:\builds\1350\trunk\core\complib\cl_threadpool.c @ 66]
fffffadf`9a80ed40 fffff800`01272bae : 00000000`00000000
00000000`00000000 00000000`00000000 00000000`00000000 :
ibbus!__thread_callback+0x28
[s:\builds\1350\trunk\core\complib\kernel\cl_thread.c @ 49]
fffffadf`9a80ed70 fffff800`0102d016 : fffffadf`9a26b180
fffffadf`ce31b760 fffffadf`9a273680 fffffadf`ce3349e0 :
nt!PspSystemThreadStartup+0x3e
fffffadf`9a80edd0 00000000`00000000 : 00000000`00000000
00000000`00000000 00000000`00000000 00000000`00000000 :
nt!KxStartSystemThread+0x16

FAULTING_SOURCE_CODE: 
1001: CL_ASSERT( p_del_item != &p_map->nil );
1002: }
1003: 
1004: /* Remove the item from the list. */
> 1005: __cl_primitive_remove( &p_item->pool_item.list_item );
1006: /* Decrement the item count. */
1007: p_map->count--;
1008: 
1009: /* Get the pointer to the new root's child, if any. */
1010: if( p_del_item->p_left != &p_map->nil )