From 5b7fabf16766a4876980280727a49bb0f2f18b78 Mon Sep 17 00:00:00 2001
From: Thomas Schoebel-Theuer <tst@1und1.de>
Date: Fri, 21 Mar 2014 07:31:55 +0100
Subject: [PATCH] server: fix refcounting

---
 kernel/mars_server.c | 18 ++++++++++++++----
 kernel/mars_server.h |  1 +
 2 files changed, 15 insertions(+), 4 deletions(-)

diff --git a/kernel/mars_server.c b/kernel/mars_server.c
index a0b1fd8a..7804c7da 100644
--- a/kernel/mars_server.c
+++ b/kernel/mars_server.c
@@ -96,8 +96,12 @@ int cb_thread(void *data)
 			mars_shutdown_socket(sock);
 		}
 
-		GENERIC_INPUT_CALL(brick->inputs[0], mref_put, mref);
-		atomic_dec(&brick->in_flight);
+		if (mref_a->do_put) {
+			GENERIC_INPUT_CALL(brick->inputs[0], mref_put, mref);
+			atomic_dec(&brick->in_flight);
+		} else {
+			mars_free_mref(mref);
+		}
 	}
 
 	mars_shutdown_socket(sock);
@@ -145,6 +149,7 @@ err:
 	MARS_FAT("cannot handle callback - giving up\n");
 }
 
+static
 int server_io(struct server_brick *brick, struct mars_socket *sock, struct mars_cmd *cmd)
 {
 	struct mref_object *mref;
@@ -187,7 +192,7 @@ int server_io(struct server_brick *brick, struct mars_socket *sock, struct mars_
 		status = 0; // continue serving requests
 		goto done;
 	}
-	
+	mref_a->do_put = true;
 	atomic_inc(&brick->in_flight);
 	GENERIC_INPUT_CALL(brick->inputs[0], mref_io, mref);
 
@@ -213,7 +218,12 @@ void _clean_list(struct server_brick *brick, struct list_head *start)
 		if (!mref)
 			continue;
 
-		GENERIC_INPUT_CALL(brick->inputs[0], mref_put, mref);
+		if (mref_a->do_put) {
+			GENERIC_INPUT_CALL(brick->inputs[0], mref_put, mref);
+			atomic_dec(&brick->in_flight);
+		} else {
+			mars_free_mref(mref);
+		}
 	}
 }
 
diff --git a/kernel/mars_server.h b/kernel/mars_server.h
index afce35e4..785a3d92 100644
--- a/kernel/mars_server.h
+++ b/kernel/mars_server.h
@@ -17,6 +17,7 @@ struct server_mref_aspect {
 	GENERIC_ASPECT(mref);
 	struct server_brick *brick;
 	struct list_head cb_head;
+	bool do_put;
 };
 
 struct server_output {