patch 'mbuf: fix mbuf operations history recording' has been queued to stable release 25.11.3

[Kevin Traynor]

Hi,

FYI, your patch has been queued to stable release 25.11.3

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 07/27/26. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/kevintraynor/dpdk-stable

This queued commit can be viewed at:
https://github.com/kevintraynor/dpdk-stable/commit/b50c4f7fd098537b46a1b433f094f2d88a0986a0

Thanks.

Kevin

---
>From b50c4f7fd098537b46a1b433f094f2d88a0986a0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Morten=20Br=C3=B8rup?= <mb at smartsharesystems.com>
Date: Mon, 11 May 2026 13:39:52 +0000
Subject: [PATCH] mbuf: fix mbuf operations history recording
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[ upstream commit 2d62537eb2c8a43dc363525ac1efe67366d0cd05 ]

This addresses two bugs in mbuf operations history recording.

1. With mbuf operations history recording enabled, when allocating mbufs
from a mempool failed, the array of fetched mbuf pointers was not set, but
it was dereferenced for mbuf operations history recording anyway, which
would trigger a segmentation fault or cause undefined behavior.

This was fixed by changing how the return value from the mempool
allocation is checked, so the function returns early on failure, and only
proceeds on success.

2. When allocating a bulk of mbufs using rte_pktmbuf_alloc_bulk(), two
mbuf library allocation operations were recorded on the mbuf, because the
function calls rte_mbuf_raw_alloc_bulk() for allocation, and both
functions record a mbuf library allocation operation.

This was fixed by not recording a mbuf library allocation operation in
rte_pktmbuf_alloc_bulk().

3. When freeing a bulk of segmented mbufs, the free operations were only
recorded on the first segments.

This was fixed by freeing the pending bulks of segments using
rte_mbuf_raw_free_bulk(), which records the free operation on the mbufs,
instead of calling rte_mempool_put_bulk() directly.
The bulk operation recording at the start of the function, which only
affected the first segments of segmented packets, was removed.

Fixes: d265a24a32a4 ("mbuf: record mbuf operations history")

Signed-off-by: Morten Brørup <mb at smartsharesystems.com>
Acked-by: Thomas Monjalon <thomas at monjalon.net>
Acked-by: Konstantin Ananyev <konstantin.ananyev at huawei.com>
---
 lib/mbuf/rte_mbuf.c |  8 +++-----
 lib/mbuf/rte_mbuf.h | 12 +++++-------
 2 files changed, 8 insertions(+), 12 deletions(-)

diff --git a/lib/mbuf/rte_mbuf.c b/lib/mbuf/rte_mbuf.c
index 421fdb148a..a7e93613eb 100644
--- a/lib/mbuf/rte_mbuf.c
+++ b/lib/mbuf/rte_mbuf.c
@@ -541,6 +541,6 @@ __rte_pktmbuf_free_seg_via_array(struct rte_mbuf *m,
 		if (*nb_pending == pending_sz ||
 		    (*nb_pending > 0 && m->pool != pending[0]->pool)) {
-			rte_mempool_put_bulk(pending[0]->pool,
-					(void **)pending, *nb_pending);
+			rte_mbuf_raw_free_bulk(pending[0]->pool,
+					pending, *nb_pending);
 			*nb_pending = 0;
 		}
@@ -563,6 +563,4 @@ void rte_pktmbuf_free_bulk(struct rte_mbuf **mbufs, unsigned int count)
 	unsigned int idx, nb_pending = 0;
 
-	rte_mbuf_history_mark_bulk(mbufs, count, RTE_MBUF_HISTORY_OP_LIB_FREE);
-
 	for (idx = 0; idx < count; idx++) {
 		m = mbufs[idx];
@@ -582,5 +580,5 @@ void rte_pktmbuf_free_bulk(struct rte_mbuf **mbufs, unsigned int count)
 
 	if (nb_pending > 0)
-		rte_mempool_put_bulk(pending[0]->pool, (void **)pending, nb_pending);
+		rte_mbuf_raw_free_bulk(pending[0]->pool, pending, nb_pending);
 }
 
diff --git a/lib/mbuf/rte_mbuf.h b/lib/mbuf/rte_mbuf.h
index 64f337c51c..edbae3bb94 100644
--- a/lib/mbuf/rte_mbuf.h
+++ b/lib/mbuf/rte_mbuf.h
@@ -664,12 +664,12 @@ rte_mbuf_raw_alloc_bulk(struct rte_mempool *mp, struct rte_mbuf **mbufs, unsigne
 {
 	int rc = rte_mempool_get_bulk(mp, (void **)mbufs, count);
-	if (likely(rc == 0)) {
-		for (unsigned int idx = 0; idx < count; idx++)
-			__rte_mbuf_raw_sanity_check_mp(mbufs[idx], mp);
-	}
+	if (unlikely(rc))
+		return rc;
+	for (unsigned int idx = 0; idx < count; idx++)
+		__rte_mbuf_raw_sanity_check_mp(mbufs[idx], mp);
 
 	rte_mbuf_history_mark_bulk(mbufs, count, RTE_MBUF_HISTORY_OP_LIB_ALLOC);
 
-	return rc;
+	return 0;
 }
 
@@ -1075,6 +1075,4 @@ static inline int rte_pktmbuf_alloc_bulk(struct rte_mempool *pool,
 		return rc;
 
-	rte_mbuf_history_mark_bulk(mbufs, count, RTE_MBUF_HISTORY_OP_LIB_ALLOC);
-
 	rte_mbuf_raw_reset_bulk(pool, mbufs, count);
 
-- 
2.55.0

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2026-07-23 17:58:00.671823045 +0100
+++ 0070-mbuf-fix-mbuf-operations-history-recording.patch	2026-07-23 17:57:58.687695359 +0100
@@ -1 +1 @@
-From 2d62537eb2c8a43dc363525ac1efe67366d0cd05 Mon Sep 17 00:00:00 2001
+From b50c4f7fd098537b46a1b433f094f2d88a0986a0 Mon Sep 17 00:00:00 2001
@@ -8,0 +9,2 @@
+[ upstream commit 2d62537eb2c8a43dc363525ac1efe67366d0cd05 ]
+
@@ -38 +39,0 @@
-Cc: stable at dpdk.org
@@ -49 +50 @@
-index c2476e7704..005bfaa573 100644
+index 421fdb148a..a7e93613eb 100644
@@ -76 +77 @@
-index e7c3bbadd4..60ec8158cd 100644
+index 64f337c51c..edbae3bb94 100644
@@ -97 +98 @@
-@@ -1069,6 +1069,4 @@ static inline int rte_pktmbuf_alloc_bulk(struct rte_mempool *pool,
+@@ -1075,6 +1075,4 @@ static inline int rte_pktmbuf_alloc_bulk(struct rte_mempool *pool,