rte_pktmbuf_alloc() is returning same address on two consecutive calls

rte_pktmbuf_alloc() is returning same address on two consecutive calls

[NAGENDRA BALAGANI]

[-- Attachment #1: Type: text/plain, Size: 1266 bytes --]

Hi Team,

In my dpdk application, I am facing an issue where rte_pktmbuf_alloc() is returning same address for two consecutive calls in a single thread context.

Following is the code snippet,

int Func(struct rte_mbuf *mblk)
{
              struct rte_mbuf *tmpbuf = nullptr;;
              struct rte_mbuf *copybuf  = nullptr;
              char  *nextPtr = NULL;

              tmpbuf = rte_pktmbuf_alloc(mbuf_pool);

              nextPtr = rte_pktmbuf_append(tmpbuf, IPV4_HDR_LEN);
              //update some info on nextptr

              copybuf = rte_pktmbuf_copy(mblk, mbuf_pool, 0, pkt_len);

              ....
              return 0;
}

With the above snippet, 'tmpbuf' and 'copybuf' which are getting allocated from same pool (mbuf_pool), pointing to same address, Due to this tmpbuf which gets allocated first, and further populated, is getting over written inside rte_pktmbuf_copy() call which is not expected .
When I further debug , rte_pktmbuf_copy() is internally using rte_pktmbuf_alloc() to get the free buffer from mbuf_pool and copy the data from mblk.

Please let us know if there is any known issue with rte_pktmbuf_alloc(), and why it may be giving same address on two consecutive calls.

Regards,
Nagendra


[-- Attachment #2: Type: text/html, Size: 4734 bytes --]

Re: rte_pktmbuf_alloc() is returning same address on two consecutive calls

[Stephen Hemminger]

On Thu, 23 Feb 2023 14:54:13 +0000
NAGENDRA BALAGANI <nagendra.balagani@oracle.com> wrote:

> Hi Team,
> 
> In my dpdk application, I am facing an issue where rte_pktmbuf_alloc() is returning same address for two consecutive calls in a single thread context.
> 
> Following is the code snippet,
> 
> int Func(struct rte_mbuf *mblk)
> {
>               struct rte_mbuf *tmpbuf = nullptr;;
>               struct rte_mbuf *copybuf  = nullptr;
>               char  *nextPtr = NULL;
> 
>               tmpbuf = rte_pktmbuf_alloc(mbuf_pool);
> 
>               nextPtr = rte_pktmbuf_append(tmpbuf, IPV4_HDR_LEN);
>               //update some info on nextptr
> 
>               copybuf = rte_pktmbuf_copy(mblk, mbuf_pool, 0, pkt_len);
> 
>               ....
>               return 0;
> }
> 
> With the above snippet, 'tmpbuf' and 'copybuf' which are getting allocated from same pool (mbuf_pool), pointing to same address, Due to this tmpbuf which gets allocated first, and further populated, is getting over written inside rte_pktmbuf_copy() call which is not expected .
> When I further debug , rte_pktmbuf_copy() is internally using rte_pktmbuf_alloc() to get the free buffer from mbuf_pool and copy the data from mblk.
> 
> Please let us know if there is any known issue with rte_pktmbuf_alloc(), and why it may be giving same address on two consecutive calls.
> 
> Regards,
> Nagendra
> 

Most likely your mbuf pool has gotten corrupted before you get to that code.
Try building with the config options for POOL and MBUF debug.

RE: [External] : Re: rte_pktmbuf_alloc() is returning same address on two consecutive calls

[NAGENDRA BALAGANI]

Hi Stephen/Team,

Thanks for the inputs, After debugging deep into the code get to know that, in my application code I am trying to do double free of same mbuf in certain condition.

 in my case, I didn't enable RTE_DEBUG_MBUF macro, so rte_alloc or free  api's not performing rte_mbuf_sanity_check(), as a result the same mbuf address is getting added twice to the cache list.

I don't want to enable the MBUF DEBUG flag for my application and run  (as is cause performance impact). I am trying to find out minimal check that is enough to avoid the double free of buffer,  I checked the ref_cnt of the mbuf  just before freeing it second time, its given as '1',  Is this expected?

Please, suggest is there any minimal checking that will help to avoid double free.

Regards,
Nagendra

-----Original Message-----
From: Stephen Hemminger <stephen@networkplumber.org> 
Sent: Thursday, February 23, 2023 11:31 PM
To: NAGENDRA BALAGANI <nagendra.balagani@oracle.com>
Cc: dev@dpdk.org; Kapil Kumar Jain <kapil.k.jain@oracle.com>; Ramakamesh Duvvuri <kamesh.duvvuri@oracle.com>
Subject: [External] : Re: rte_pktmbuf_alloc() is returning same address on two consecutive calls

On Thu, 23 Feb 2023 14:54:13 +0000
NAGENDRA BALAGANI <nagendra.balagani@oracle.com> wrote:

> Hi Team,
> 
> In my dpdk application, I am facing an issue where rte_pktmbuf_alloc() is returning same address for two consecutive calls in a single thread context.
> 
> Following is the code snippet,
> 
> int Func(struct rte_mbuf *mblk)
> {
>               struct rte_mbuf *tmpbuf = nullptr;;
>               struct rte_mbuf *copybuf  = nullptr;
>               char  *nextPtr = NULL;
> 
>               tmpbuf = rte_pktmbuf_alloc(mbuf_pool);
> 
>               nextPtr = rte_pktmbuf_append(tmpbuf, IPV4_HDR_LEN);
>               //update some info on nextptr
> 
>               copybuf = rte_pktmbuf_copy(mblk, mbuf_pool, 0, pkt_len);
> 
>               ....
>               return 0;
> }
> 
> With the above snippet, 'tmpbuf' and 'copybuf' which are getting allocated from same pool (mbuf_pool), pointing to same address, Due to this tmpbuf which gets allocated first, and further populated, is getting over written inside rte_pktmbuf_copy() call which is not expected .
> When I further debug , rte_pktmbuf_copy() is internally using rte_pktmbuf_alloc() to get the free buffer from mbuf_pool and copy the data from mblk.
> 
> Please let us know if there is any known issue with rte_pktmbuf_alloc(), and why it may be giving same address on two consecutive calls.
> 
> Regards,
> Nagendra
> 

Most likely your mbuf pool has gotten corrupted before you get to that code.
Try building with the config options for POOL and MBUF debug.