[SRP] Fix memory corruption when connection establishment times out.

git-svn-id: svn://openib.tc.cornell.edu/gen1@485 ad392aa1-c5ef-ae45-8dd8-e69d62a5ef86

diff --git a/trunk/ulp/srp/kernel/srp_hca.c b/trunk/ulp/srp/kernel/srp_hca.c
index bb8851aa1e4ec757996cdba21009c1fca71ba467..34e194088c23f250f73c0268dfdee00538e1ee62 100644 (file)
--- a/trunk/ulp/srp/kernel/srp_hca.c
+++ b/trunk/ulp/srp/kernel/srp_hca.c
@@ -73,11 +73,8 @@ srp_open_ca_by_port_gid(
                goto exit;\r
        }\r
 \r
-       status = p_hca->p_hba->ifc.open_ca( h_al,\r
-                                                p_hca->ca_guid,\r
-                                                srp_async_event_handler_cb,\r
-                                                p_context,\r
-                                                &p_hca->h_ca );\r
+       status = p_hca->p_hba->ifc.open_ca( h_al, p_hca->ca_guid,\r
+               srp_async_event_handler_cb, p_context, &p_hca->h_ca );\r
        if ( status != IB_SUCCESS )\r
        {\r
                SRP_TRACE( SRP_DBG_ERROR,\r
@@ -85,8 +82,6 @@ srp_open_ca_by_port_gid(
                goto exit;\r
        }\r
 \r
-       p_hca->initialized = TRUE;\r
-\r
        status = p_hca->p_hba->ifc.alloc_pd( p_hca->h_ca,\r
                                                  IB_PDT_NORMAL,\r
                                                  p_context,\r
@@ -121,15 +116,8 @@ srp_open_ca_by_port_gid(
        {\r
                SRP_TRACE( SRP_DBG_ERROR,\r
                        ("Physical Memory Registration Failure. Status = %d\n", status) );\r
-       }\r
-\r
 exit:\r
-       if ( status != IB_SUCCESS )\r
-       {\r
-               if ( p_hca->initialized == TRUE )\r
-               {\r
-                       srp_close_ca( p_hca );\r
-               }\r
+               srp_close_ca( p_hca );\r
        }\r
 \r
        SRP_EXIT( SRP_DBG_PNP );\r
@@ -137,44 +125,6 @@ exit:
        return ( status );\r
 }\r
 \r
-\r
-/* srp_close_ca_cb */\r
-/*!\r
-Notifies StorPort when CA has closed\r
-\r
-@param p_context - session being closed\r
-\r
-@return - none\r
-*/\r
-void\r
-srp_close_ca_cb(\r
-       IN void *p_context)\r
-{\r
-       srp_session_t       *p_srp_session = (srp_session_t *)p_context;\r
-       SCSI_REQUEST_BLOCK  *p_srb         = p_srp_session->p_shutdown_srb;\r
-\r
-       SRP_ENTER( SRP_DBG_PNP );\r
-\r
-       if ( p_srb != NULL )\r
-       {\r
-               p_srb->SrbStatus = SRB_STATUS_SUCCESS;\r
-               SRP_TRACE( SRP_DBG_DEBUG,\r
-                                  ("Returning SrbStatus %s(0x%x) for Function = %s(0x%x), Path = 0x%x, Target = 0x%x, Lun = 0x%x\n",\r
-                                  g_srb_status_name[p_srb->SrbStatus],\r
-                                  p_srb->SrbStatus,\r
-                                  g_srb_function_name[p_srb->Function],\r
-                                  p_srb->Function,\r
-                                  p_srb->PathId,\r
-                                  p_srb->TargetId,\r
-                                  p_srb->Lun) );\r
-               StorPortNotification( RequestComplete, p_srp_session->p_hba->p_ext, p_srb );\r
-       }\r
-\r
-       cl_event_signal( &p_srp_session->hca.hca_destroyed_event );\r
-\r
-       SRP_EXIT( SRP_DBG_PNP );\r
-}\r
-\r
 /* srp_close_ca */\r
 /*!\r
 Closes the channel adapter\r
@@ -185,41 +135,18 @@ Closes the channel adapter
 */\r
 void\r
 srp_close_ca(\r
-       IN OUT  srp_hca_t   *p_hca )\r
+       IN OUT  srp_hca_t       *p_hca )\r
 {\r
        SRP_ENTER( SRP_DBG_PNP );\r
 \r
-       if ( p_hca->initialized == TRUE )\r
+       if( p_hca->h_ca )\r
        {\r
-               cl_status_t cl_status;\r
-\r
-               SRP_TRACE( SRP_DBG_DEBUG, ("Closing Channel Adapter.\n") );\r
-\r
-               cl_status = cl_event_init( &p_hca->hca_destroyed_event, TRUE );\r
-               if ( cl_status != CL_SUCCESS )\r
-               {\r
-                       SRP_TRACE( SRP_DBG_ERROR, ("Cannot Initialize HCA Destroyed Event. Status = %d\n", cl_status) );\r
-                       p_hca->p_hba->ifc.close_ca( p_hca->h_ca, NULL );\r
-               }\r
-               else\r
-               {\r
-                       p_hca->p_hba->ifc.close_ca( p_hca->h_ca, srp_close_ca_cb );\r
-\r
-                       cl_status = cl_event_wait_on( &p_hca->hca_destroyed_event, EVENT_NO_TIMEOUT, FALSE );\r
-                       if ( cl_status != CL_SUCCESS )\r
-                       {\r
-                               SRP_TRACE( SRP_DBG_ERROR, ("Wait On HCA Destroyed Event Failed. Status = %d\n", cl_status) );\r
-                       }\r
-\r
-                       cl_event_destroy( &p_hca->hca_destroyed_event );\r
-               }\r
-\r
-               SRP_TRACE( SRP_DBG_DEBUG,\r
-                       ("Closed Channel Adapter.\n") );\r
-\r
-               cl_memclr( p_hca, sizeof( *p_hca ) );\r
+               p_hca->p_hba->ifc.close_ca( p_hca->h_ca, ib_sync_destroy );\r
+               SRP_TRACE( SRP_DBG_DEBUG, ("Closed Channel Adapter.\n") );\r
        }\r
 \r
+       cl_memclr( p_hca, sizeof( *p_hca ) );\r
+\r
        SRP_EXIT( SRP_DBG_PNP );\r
 }\r
 \r
@@ -296,7 +223,6 @@ srp_init_hca(
 \r
        cl_memclr( p_hca, sizeof( *p_hca ) );\r
 \r
-       p_hca->initialized = FALSE;\r
        p_hca->p_hba = p_hba;\r
 \r
        SRP_EXIT( SRP_DBG_PNP );\r
@@ -304,18 +230,3 @@ srp_init_hca(
        return ( IB_SUCCESS );\r
 }\r
 \r
-/* srp_free_hca */\r
-/*!\r
-Frees hca resources\r
-\r
-@param p_hca  - pointer to the hca structure\r
-\r
-@return -  none\r
-*/\r
-void\r
-srp_free_hca(\r
-       IN OUT  srp_hca_t   *p_hca  )\r
-{\r
-       cl_memclr( p_hca, sizeof( *p_hca ) );\r
-}\r
-\r

diff --git a/trunk/ulp/srp/kernel/srp_hca.h b/trunk/ulp/srp/kernel/srp_hca.h
index 57838ab15d6336e0e1935f40a2a60c63e9d371df..2c6e4b1ba057fe7499d189acd750aa9573d58f3e 100644 (file)
--- a/trunk/ulp/srp/kernel/srp_hca.h
+++ b/trunk/ulp/srp/kernel/srp_hca.h
@@ -40,7 +40,6 @@
 \r
 typedef struct _srp_hca\r
 {\r
-       BOOLEAN                                 initialized;\r
        srp_hba_t                               *p_hba;\r
 \r
        ib_net64_t                              ca_guid;\r
@@ -50,7 +49,6 @@ typedef struct _srp_hca
        uint64_t                                vaddr;\r
        net32_t                                 lkey;\r
        net32_t                                 rkey;\r
-       cl_event_t                              hca_destroyed_event;\r
 \r
 }      srp_hca_t;\r
 \r
@@ -75,8 +73,4 @@ srp_init_hca(
        IN      OUT                     srp_hca_t                                       *p_hca,\r
        IN                              srp_hba_t                                       *p_hba );\r
 \r
-void\r
-srp_free_hca(\r
-       IN      OUT                     srp_hca_t                                       *p_hca  );\r
-\r
 #endif  /* _SRP_HCA_H_ */\r

diff --git a/trunk/ulp/srp/kernel/srp_session.c b/trunk/ulp/srp/kernel/srp_session.c
index 0790e4a8c590a0b887fc60def041885238d29da2..7d064a692a4d5034687c4731d0729e308d41b5c8 100644 (file)
--- a/trunk/ulp/srp/kernel/srp_session.c
+++ b/trunk/ulp/srp/kernel/srp_session.c
@@ -81,9 +81,25 @@ __srp_cleanup_session(
 \r
        srp_close_ca( &p_srp_session->hca );\r
 \r
+       if ( p_srp_session->p_shutdown_srb != NULL )\r
+       {\r
+               p_srp_session->p_shutdown_srb->SrbStatus = SRB_STATUS_SUCCESS;\r
+               SRP_TRACE( SRP_DBG_DEBUG,\r
+                       ("Returning SrbStatus %s(0x%x) for Function = %s(0x%x), "\r
+                       "Path = 0x%x, Target = 0x%x, Lun = 0x%x\n",\r
+                       g_srb_status_name[p_srp_session->p_shutdown_srb->SrbStatus],\r
+                       p_srp_session->p_shutdown_srb->SrbStatus,\r
+                       p_srp_session->p_shutdown_srb[p_srp_session->p_shutdown_srb->Function],\r
+                       p_srp_session->p_shutdown_srb->Function,\r
+                       p_srp_session->p_shutdown_srb->PathId,\r
+                       p_srp_session->p_shutdown_srb->TargetId,\r
+                       p_srp_session->p_shutdown_srb->Lun) );\r
+               StorPortNotification( RequestComplete, p_srp_session->p_hba->p_ext,\r
+                       p_srp_session->p_shutdown_srb );\r
+       }\r
+\r
        srp_free_connection( &p_srp_session->connection );\r
        srp_destroy_descriptors( &p_srp_session->descriptors );\r
-       srp_free_hca( &p_srp_session->hca );\r
 \r
        SRP_TRACE( SRP_DBG_VERBOSE, ("Session Object ref_cnt = %d\n", p_srp_session->obj.ref_cnt) );\r
 \r
@@ -302,24 +318,15 @@ srp_session_login(
                                                                          &p_srp_session->p_hba->p_srp_path_record->path_rec.sgid,\r
                                                                          p_srp_session );\r
        if ( status != IB_SUCCESS )\r
-       {\r
-               srp_free_hca( &p_srp_session->hca );\r
                goto exit;\r
-       }\r
 \r
        status = srp_connect( &p_srp_session->connection,\r
                                                  &p_srp_session->hca,\r
                                                  1, /* initiator_extension */\r
                                                  (uint8_t)p_srp_session->p_hba->ioc_info.profile.send_msg_depth,\r
                                                  p_srp_session );\r
-       if ( status != IB_SUCCESS )\r
-       {\r
-               srp_free_hca( &p_srp_session->hca );\r
-       }\r
 \r
 exit:\r
-\r
        SRP_EXIT( SRP_DBG_PNP );\r
-\r
        return ( status );\r
 }\r