[Openib-windows] [IBAL][Patch] reference counter for IOC obj in IOC PnP manager

[Estrin, Alex]

Hi Yossi,

This patch introduces a reference counter to protect ioc obj from 
double memory free.

Possible scenario - IOC Manager handles PORT_DOWN event, frees ioc obj and put it back to
the pool, while there are outstanding send MAD svc that has reference to that ioc obj.
On timeout send callback will try to free ioc obj again.

By using this counter we also protect ioc obj from return to the pool and possible reusage
while outstanding send mad keeps it's reference.
Please review.

Thanks,
Alex

Index: al_ioc_pnp.c
===================================================================
--- al_ioc_pnp.c	(revision 525)
+++ al_ioc_pnp.c	(working copy)
@@ -272,6 +272,7 @@
 	ib_ioc_profile_t		profile;
 	uint8_t					num_valid_entries;
 	ib_svc_entry_t			*p_svc_entries;
+	atomic32_t				ref_cnt;
 
 }	iou_ioc_t;
 #pragma warning(default:4324)
@@ -1052,13 +1053,15 @@
 
 	p_ioc = PARENT_STRUCT( PARENT_STRUCT( p_item, cl_map_item_t, pool_item ),
 		iou_ioc_t, map_item );
+	
+	CL_ASSERT( !p_ioc->ref_cnt );
 
 	CL_ASSERT( !(ioc_slot >> 8) );
 	p_ioc->slot = (uint8_t)ioc_slot;
 	p_ioc->profile = *p_profile;
 	p_ioc->num_valid_entries = 0;
 	p_ioc->p_svc_entries = p_svc_entries;
-
+	cl_atomic_inc( &p_ioc->ref_cnt );
 	return p_ioc;
 }
 
@@ -1068,12 +1071,14 @@
 	IN				ioc_pnp_mgr_t* const		p_ioc_mgr,
 	IN				iou_ioc_t* const			p_ioc )
 {
-	CL_ASSERT( p_ioc->p_svc_entries );
-	cl_free( p_ioc->p_svc_entries );
+	if( ( cl_atomic_dec( &p_ioc->ref_cnt ) ) == 0 )
+	{
+		cl_free( p_ioc->p_svc_entries );
 
-	cl_spinlock_acquire( &p_ioc_mgr->ioc_pool_lock );
-	cl_qpool_put( &p_ioc_mgr->ioc_pool, &p_ioc->map_item.pool_item );
-	cl_spinlock_release( &p_ioc_mgr->ioc_pool_lock );
+		cl_spinlock_acquire( &p_ioc_mgr->ioc_pool_lock );
+		cl_qpool_put( &p_ioc_mgr->ioc_pool, &p_ioc->map_item.pool_item );
+		cl_spinlock_release( &p_ioc_mgr->ioc_pool_lock );
+	}
 }
 
 
@@ -1096,9 +1101,12 @@
 		p_ioc = PARENT_STRUCT(
 			PARENT_STRUCT( p_item, cl_map_item_t, pool_item ),
 			iou_ioc_t, map_item );
-
-		cl_free( p_ioc->p_svc_entries );
-		cl_qlist_insert_head( &list, &p_item->pool_item.list_item );
+		
+		if( ( cl_atomic_dec( &p_ioc->ref_cnt ) ) == 0 )
+		{
+			cl_free( p_ioc->p_svc_entries );
+			cl_qlist_insert_head( &list, &p_item->pool_item.list_item );
+		}
 		p_item = cl_qmap_head( p_ioc_map );
 	}
 	cl_spinlock_acquire( &p_ioc_mgr->ioc_pool_lock );
@@ -2431,7 +2439,7 @@
 __query_svc_entries(
 	IN				ioc_sweep_results_t* const	p_results )
 {
-	ib_api_status_t		status;
+	ib_api_status_t		status = IB_ERROR;
 	cl_fmap_item_t		*p_iou_item;
 	cl_map_item_t		*p_ioc_item;
 	iou_node_t			*p_iou;
@@ -2481,6 +2489,8 @@
 
 				cl_atomic_inc( &p_results->p_svc->query_cnt );
 			}
+			if( status == IB_SUCCESS )
+				cl_atomic_inc( &p_ioc->ref_cnt );
 		}
 	}
 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: al_ioc_pnp.patch
Type: application/octet-stream
Size: 2345 bytes
Desc: al_ioc_pnp.patch
URL: <http://lists.openfabrics.org/pipermail/ofw/attachments/20061026/15e6a360/attachment.obj>