{"push_id":544804151,"size":1,"distinct_size":1,"ref":"refs/heads/fix_acm_crash","head":"78e53596593bcc1f0cb142ea2cd2ce6b8b0c0032","before":"8d2725bff198f32089f71ec99f93f029a31e42ab","commits":[{"sha":"78e53596593bcc1f0cb142ea2cd2ce6b8b0c0032","author":{"email":"260b68a1a9b9c30477995bcbe46ddb686bd128dc@mellanox.com","name":"Ilya Nelkenbaum"},"message":"acm.c: Fix ACM crash\n\nThe crash happens in the following scenario:\n\n -  Some SA PR request is sent from ACM to SM, whose mastership is being\n    taken\n\n -  The answer to PR won't be received since new SM is taking the\n    mastership\n\n -  acm_update_sa_dest() is being called and the following lines are\n    executed:\n\n        acm_update_sa_dest()\n        {\n            ...\n            atomic_dec(&port->sa_dest.refcnt);\n            while (atomic_get(&port->sa_dest.refcnt))\n                sleep(0);\n            ...\n        }\n\n    so before entering this function 'sa_dest.refcnt' value is 2, because\n    SA request was issued but no answer was received. When we get to\n    'while()' it is changed to 1, and we keep busy wait till it will be\n    zero.\n\n  - When 'acm_process_timeouts()' is called, send message is being freed\n    and as part of it, the following is executed:\n\n       void acm_free_send()\n       {\n           ...\n           acm_put_dest(msg->dest);\n           ...\n       }\n\n   After decreasing 'sa_dest.ref_cnt' it will be equal to 0, and thus\n   'sa_dest' structure (that is not dynamically allocated) will\n   be freed.\n\nSigned-off-by: Ilya Nelkenbaum <ilyan@mellanox.com>","distinct":true,"url":"https://api.github.com/repos/ilyanelken/ibssa2/commits/78e53596593bcc1f0cb142ea2cd2ce6b8b0c0032"}]}