mbuf refcnt issue

[Stephen Hemminger]

On Wed, 9 Apr 2025 04:46:09 +0000
"Lombardo, Ed" <Ed.Lombardo at netscout.com> wrote:

> Hi Stephen,
> I am looking a the rte_mbuf.h file for rte_pktmbuf_free() and it is not clear to me that it checks if the mbuf refcnt is 1 before decrementing it and allowing the mbuf and segments (if any) to be returned to free pool.
> 
> Could my application issue be I have tx threads that transmit packets and does rte_pktmbuf_free(), while one other thread will perform rte_pktmbuf_free() on the same mbuf?  I ensured I bump the mbuf refcnt to 2 before other threads can process the same mbuf.
> 
> Thanks,
> Ed

It doesn't need to check refcnt there. The check is done later (since mbuf can be multi segment).

rte_pktmbuf_free
 -> rte_pktmbuf_free_seg
    -> rte_pktmbuf_prefree_seg
		
static __rte_always_inline struct rte_mbuf *
rte_pktmbuf_prefree_seg(struct rte_mbuf *m)
{
	__rte_mbuf_sanity_check(m, 0);

	if (likely(rte_mbuf_refcnt_read(m) == 1)) {
            normal fast path. breaks the chain.
	} else if (__rte_mbuf_refcnt_update(m, -1) == 0) {
            refcnt > 1 logic

Note, the refcnt doesn't always go to zero when the mbuf is put back in the pool.
The refcnt for a freed mbuf (in the pool) doesn't matter, it is free, it is dead.
The refcnt is reset to 1 when mbuf is extracted from the pool.