Increment node refcount in ibv_madvise_range() only if madvise() succeeds

ibv_madvise_range() first updates the memory range reference count and
then calls to madvise().  If madvise() fails, the reference count of
the failed node is incorrect.  Fix this by updating the node's
reference count only after a successful call to madvise() (or if no
call to madvise() was needed).

Signed-off-by: Alex Vainman <alexv@voltaire.com>
Signed-off-by: Roland Dreier <rolandd@cisco.com>

diff --git a/src/memory.c b/src/memory.c
index 51839e2ac340208560d3ab39d636e6a7e03f6ff9..6a3305f3fd64c172e332a8807c53e2c3d531d337 100644 (file)
--- a/src/memory.c
+++ b/src/memory.c
@@ -521,10 +521,8 @@ static int ibv_madvise_range(void *base, size_t size, int advice)
                        }
                }
 
-               node->refcnt += inc;
-
-               if ((inc == -1 && node->refcnt == 0) ||
-                   (inc ==  1 && node->refcnt == 1)) {
+               if ((inc == -1 && node->refcnt == 1) ||
+                   (inc ==  1 && node->refcnt == 0)) {
                        /*
                         * If this is the first time through the loop,
                         * and we merged this node with the previous
@@ -547,6 +545,7 @@ static int ibv_madvise_range(void *base, size_t size, int advice)
                                goto out;
                }
 
+               node->refcnt += inc;
                node = __mm_next(node);
        }