mbuf refcnt issue

[Lombardo, Ed]

Hi Stephen,
I am looking a the rte_mbuf.h file for rte_pktmbuf_free() and it is not clear to me that it checks if the mbuf refcnt is 1 before decrementing it and allowing the mbuf and segments (if any) to be returned to free pool.

Could my application issue be I have tx threads that transmit packets and does rte_pktmbuf_free(), while one other thread will perform rte_pktmbuf_free() on the same mbuf?  I ensured I bump the mbuf refcnt to 2 before other threads can process the same mbuf.

Thanks,
Ed


-----Original Message-----
From: Stephen Hemminger <stephen at networkplumber.org> 
Sent: Tuesday, April 8, 2025 11:54 PM
To: Lombardo, Ed <Ed.Lombardo at netscout.com>
Cc: Dmitry Kozlyuk <dmitry.kozliuk at gmail.com>; users at dpdk.org
Subject: Re: mbuf refcnt issue

External Email: This message originated outside of NETSCOUT. Do not click links or open attachments unless you recognize the sender and know the content is safe.

On Tue, 8 Apr 2025 22:33:56 +0000
"Lombardo, Ed" <Ed.Lombardo at netscout.com> wrote:

> Hi Dmitry,
> I added mbuf refcnt check at the point where we get the packets from DPDK rte_eth_rx_burst() and I am finding many mbufs refcnt set to 2 when I expect them to be 1.  This is more evidence that something has gone wrong within DPDK and the mempool management, perhaps, and I don't know how my setup went into this state.  I changed the traffic type from Telnet to Enterprise traffic and rte_eth_tx_burst() no longer accepts mbufs. 

Not likely a DPDK bug. More likely you are having application problems.
Have you tried enabling things like RTE_LIBRTE_MBUF_DEBUG and RTE_LIBRTE_MEMPOOL_DEBUG and RTE_ENABLE_ASSERT?

Also using a current version of DPDK, address sanitizer, and latest GCC or CLANG can uncover issues with use after free.