[ofa-general] [PATCH 1 of 2] libmlx4: Fix race condition in create/destroy QP

[Jack Morgenstein]

Index: libmlx4/src/qp.c
===================================================================
--- libmlx4.orig/src/qp.c       2008-11-20 11:46:58.000000000 +0200
+++ libmlx4/src/qp.c    2008-11-22 09:44:13.000000000 +0200
@@ -667,37 +667,25 @@ struct mlx4_qp *mlx4_find_qp(struct mlx4
 int mlx4_store_qp(struct mlx4_context *ctx, uint32_t qpn, struct mlx4_qp *qp)
 {
        int tind = (qpn & (ctx->num_qps - 1)) >> ctx->qp_table_shift;
-       int ret = 0;
-
-       pthread_mutex_lock(&ctx->qp_table_mutex);
 
        if (!ctx->qp_table[tind].refcnt) {
                ctx->qp_table[tind].table = calloc(ctx->qp_table_mask + 1,
                                                   sizeof (struct mlx4_qp *));
-               if (!ctx->qp_table[tind].table) {
-                       ret = -1;
-                       goto out;
-               }
+               if (!ctx->qp_table[tind].table)
+                       return -1;
        }
 
        ++ctx->qp_table[tind].refcnt;
        ctx->qp_table[tind].table[qpn & ctx->qp_table_mask] = qp;
-
-out:
-       pthread_mutex_unlock(&ctx->qp_table_mutex);
-       return ret;
+       return 0;
 }
 
 void mlx4_clear_qp(struct mlx4_context *ctx, uint32_t qpn)
 {
        int tind = (qpn & (ctx->num_qps - 1)) >> ctx->qp_table_shift;
 
-       pthread_mutex_lock(&ctx->qp_table_mutex);
-
        if (!--ctx->qp_table[tind].refcnt)
                free(ctx->qp_table[tind].table);
        else
                ctx->qp_table[tind].table[qpn & ctx->qp_table_mask] = NULL;
-
-       pthread_mutex_unlock(&ctx->qp_table_mutex);
 }
Index: libmlx4/src/verbs.c
===================================================================
--- libmlx4.orig/src/verbs.c    2008-11-20 11:46:58.000000000 +0200
+++ libmlx4/src/verbs.c 2008-11-22 11:05:44.000000000 +0200
@@ -452,6 +452,8 @@ struct ibv_qp *mlx4_create_qp(struct ibv
        cmd.sq_no_prefetch = 0; /* OK for ABI 2: just a reserved field */
        memset(cmd.reserved, 0, sizeof cmd.reserved);
 
+       pthread_mutex_lock(&to_mctx(pd->context)->qp_table_mutex);
+
        ret = ibv_cmd_create_qp(pd, &qp->ibv_qp, attr, &cmd.ibv_cmd, sizeof cmd,
                                &resp, sizeof resp);
        if (ret)
@@ -460,6 +462,7 @@ struct ibv_qp *mlx4_create_qp(struct ibv
        ret = mlx4_store_qp(to_mctx(pd->context), qp->ibv_qp.qp_num, qp);
        if (ret)
                goto err_destroy;
+       pthread_mutex_unlock(&to_mctx(pd->context)->qp_table_mutex);
 
        qp->rq.wqe_cnt = qp->rq.max_post = attr->cap.max_recv_wr;
        qp->rq.max_gs  = attr->cap.max_recv_sge;
@@ -477,6 +480,7 @@ err_destroy:
        ibv_cmd_destroy_qp(&qp->ibv_qp);
 
 err_rq_db:
+       pthread_mutex_unlock(&to_mctx(pd->context)->qp_table_mutex);
        if (!attr->srq)
                mlx4_free_db(to_mctx(pd->context), MLX4_DB_TYPE_RQ, qp->db);
 
@@ -580,9 +584,12 @@ int mlx4_destroy_qp(struct ibv_qp *ibqp)
        struct mlx4_qp *qp = to_mqp(ibqp);
        int ret;
 
+       pthread_mutex_lock(&to_mctx(ibqp->context)->qp_table_mutex);
        ret = ibv_cmd_destroy_qp(ibqp);
-       if (ret)
+       if (ret) {
+               pthread_mutex_lock(&to_mctx(ibqp->context)->qp_table_mutex);
                return ret;
+       }
 
        mlx4_lock_cqs(ibqp);
 
@@ -594,6 +601,7 @@ int mlx4_destroy_qp(struct ibv_qp *ibqp)
        mlx4_clear_qp(to_mctx(ibqp->context), ibqp->qp_num);
 
        mlx4_unlock_cqs(ibqp);
+       pthread_mutex_unlock(&to_mctx(ibqp->context)->qp_table_mutex);
 
        if (!ibqp->srq)
                mlx4_free_db(to_mctx(ibqp->context), MLX4_DB_TYPE_RQ, qp->db);
_______________________________________________
general mailing list
general@lists.openfabrics.org
http://lists.openfabrics.org/cgi-bin/mailman/listinfo/general

To unsubscribe, please visit http://openib.org/mailman/listinfo/openib-general