fixes trac:2340 - race in mca_mpool_base_free

This commit was SVN r22878.

The following Trac tickets were found above:
  Ticket 2340 --> https://svn.open-mpi.org/trac/ompi/ticket/2340

ompi/mca/mpool/base/mpool_base_alloc.c

@@ -10,6 +10,7 @@
  * Copyright (c) 2004-2005 The Regents of the University of California.
  *                         All rights reserved.
  * Copyright (c) 2009      Sun Microsystems, Inc.  All rights reserved.
+ * Copyright (c) 2010      IBM Corporation.  All rights reserved.
  * $COPYRIGHT$
  *
  * Additional copyrights may follow
@@ -289,8 +290,10 @@ int mca_mpool_base_free(void *base)
     }
 
     rc = mca_mpool_base_tree_delete(mpool_tree_item);
-    if(OMPI_SUCCESS == rc)
+    if(OMPI_SUCCESS == rc) {
         unregister_tree_item(mpool_tree_item);
+        mca_mpool_base_tree_item_put(mpool_tree_item);
+    }
     
     return rc;
 }

ompi/mca/mpool/base/mpool_base_tree.c

@@ -11,6 +11,7 @@
  *                         All rights reserved.5A
  * Copyright (c) 2007      Cisco Systems, Inc.  All rights reserved.
  * Copyright (c) 2007      Voltaire. All rights reserved.
+ * Copyright (c) 2010      IBM Corporation.  All rights reserved.
  * $COPYRIGHT$
  * 
  * Additional copyrights may follow
@@ -104,6 +105,13 @@ int mca_mpool_base_tree_insert(mca_mpool_base_tree_item_t* item) {
 
 /* 
  * remove an item from the rb tree 
+ * Does not put the item back onto the free list. That
+ * must be done separately by calling mca_mpool_base_tree_item_put.
+ * This allows a caller to remove an item from the tree 
+ * before safely cleaning up the item and only then returning it
+ * to the free list. If the item is returned to the free list too soon
+ * race conditions can occur
+ *
  */
 int mca_mpool_base_tree_delete(mca_mpool_base_tree_item_t* item) { 
     int rc;
@@ -112,9 +120,6 @@ int mca_mpool_base_tree_delete(mca_mpool_base_tree_item_t* item) {
     rc = ompi_rb_tree_delete(&mca_mpool_base_tree, item->key);
     OPAL_THREAD_UNLOCK(&tree_lock);
 
-    if(OMPI_SUCCESS == rc) { 
-        mca_mpool_base_tree_item_put(item); 
-    }
     return rc;
 }