mbuf double free

#include <stdio.h>
#include <string.h>
#include <stdint.h>
#include <errno.h>
#include <sys/queue.h>

#include <rte_launch.h>
#include <rte_eal.h>
#include <rte_per_lcore.h>
#include <rte_lcore.h>
#include <rte_debug.h>
#include <rte_mempool.h>
#include <rte_mbuf.h>
#include <rte_ether.h>

#define RAW_MEMPOOL

#define MBUF_COUNT  (1024-1)
#define PRIV_SIZE   16
// ETH_MAX_len = 1518
// ETH_MTU = ETH_MAX_LEN - ETH_HDR_LEN - ETHER_CRC_LEN = 1518 - 14 - 4 = 1500
#define MBUF_DATAROOM_SIZE (RTE_PKTMBUF_HEADROOM + RTE_ETHER_MAX_LEN)
#define MBUF_SIZE   (sizeof(struct rte_mbuf) + PRIV_SIZE + MBUF_DATAROOM_SIZE)
#define CACHE_SIZE  32


static void mbuf_dump(struct rte_mbuf* m)
{
    printf("RTE_PKTMBUF_HEADROOM: %u\n", RTE_PKTMBUF_HEADROOM);
    printf("sizeof(mbuf): %lu\n", sizeof(struct rte_mbuf));
    printf("m: %p\n", m);
    printf("m->refcnt: %u\n", m->refcnt);
    printf("m->buf_addr: %p\n", m->buf_addr);
    printf("m->data_off: %u\n", m->data_off);
    printf("m->buf_len: %u\n", m->buf_len);
    printf("m->pkt_len: %u\n", m->pkt_len);
    printf("m->data_len: %u\n", m->data_len);
    printf("m->nb_segs: %u\n", m->nb_segs);
    printf("m->next: %p\n", m->next);
    printf("m->buf_addr+m->data_off: %p\n", (char*)m->buf_addr+m->data_off);
    printf("rte_pktmbuf_mtod(m): %p\n", rte_pktmbuf_mtod(m, char*));
    printf("rte_pktmbuf_data_len(m): %u\n", rte_pktmbuf_data_len(m));
    printf("rte_pktmbuf_pkt_len(m): %u\n", rte_pktmbuf_pkt_len(m)); 
    printf("rte_pktmbuf_headroom(m): %u\n", rte_pktmbuf_headroom(m));
    printf("rte_pktmbuf_tailroom(m): %u\n", rte_pktmbuf_tailroom(m));
    printf("rte_pktmbuf_data_room_size(mpool): %u\n", 
                rte_pktmbuf_data_room_size(m->pool));
    printf("rte_pktmbuf_priv_size(mpool): %u\n\n",
                rte_pktmbuf_priv_size(m->pool));
}

static int mbuf_demo(void)
{
    struct rte_mempool* mpool;
    struct rte_mbuf *m;
    struct rte_mempool_objsz objsz;
    uint32_t mbuf_size;

#ifdef RAW_MEMPOOL
    struct rte_pktmbuf_pool_private priv;
    priv.mbuf_data_room_size = MBUF_DATAROOM_SIZE;
    priv.mbuf_priv_size = PRIV_SIZE;

    mpool = rte_mempool_create("test_pool",
                               MBUF_COUNT,
                               MBUF_SIZE,
                               CACHE_SIZE,
                               sizeof(struct rte_pktmbuf_pool_private),
                               rte_pktmbuf_pool_init,
                               &priv,
                               rte_pktmbuf_init,
                               NULL,
                               SOCKET_ID_ANY,
                               MEMPOOL_F_SC_GET);
#else
    mpool = rte_pktmbuf_pool_create("test_pool",
                                    MBUF_COUNT,
                                    CACHE_SIZE,
                                    PRIV_SIZE,
                                    MBUF_DATAROOM_SIZE,
                                    SOCKET_ID_ANY);
#endif
    if(NULL == mpool)
        return -1;
    
    mbuf_size = rte_mempool_calc_obj_size(MBUF_SIZE, 0, &objsz);
    printf("mbuf_size: %u\n", mbuf_size);
    printf("elt_size: %u, header_size: %u, trailer_size: %u, total_size: %u\n",
        objsz.elt_size, objsz.header_size, objsz.trailer_size, objsz.total_size);

    m = rte_pktmbuf_alloc(mpool);
        mbuf_dump(m);
    rte_pktmbuf_append(m, 1000);
    mbuf_dump(m);

    printf("mempool count before free: %u\n", rte_mempool_avail_count(mpool));
    printf("before free m->refcnt: %u\n", m->refcnt);
    rte_pktmbuf_free(m);
    printf("after free m->refcnt: %u\n", m->refcnt);
    printf("mempool count after free: %u\n", rte_mempool_avail_count(mpool));
    printf("=========================== mbuf double free ======================== \n");
    rte_pktmbuf_free(m);
    printf("after free m->refcnt: %u\n", m->refcnt);
    printf("mempool count after free: %u\n", rte_mempool_avail_count(mpool));
    return 0;
}



int
main(int argc, char **argv)
{
    int ret;
    //unsigned lcore_id;

    ret = rte_eal_init(argc, argv);
    if (ret < 0)
        rte_panic("Cannot init EAL\n");

    /* call on every slave lcore */
    //RTE_LCORE_FOREACH_SLAVE(lcore_id) {
    //    rte_eal_remote_launch(lcore_hello, NULL, lcore_id);:
    //}

    mbuf_demo();

    rte_eal_mp_wait_lcore();
    return 0;
}

[root@localhost mbuf]# build/app/helloworld -c 0xf -n 4
EAL: Detected 128 lcore(s)
EAL: Detected 4 NUMA nodes
EAL: Multi-process socket /var/run/dpdk/rte/mp_socket
EAL: Selected IOVA mode ‘PA‘
EAL: No available hugepages reported in hugepages-2048kB
EAL: Probing VFIO support...
EAL: VFIO support initialized
EAL: PCI device 0000:05:00.0 on NUMA socket 0
EAL:   probe driver: 19e5:200 net_hinic
EAL:   using IOMMU type 1 (Type 1)
net_hinic: Initializing pf hinic-0000:05:00.0 in primary process
net_hinic: Device 0000:05:00.0 hwif attribute:
net_hinic: func_idx:0, p2p_idx:0, pciintf_idx:0, vf_in_pf:0, ppf_idx:0, global_vf_id:15, func_type:2
net_hinic: num_aeqs:4, num_ceqs:4, num_irqs:32, dma_attr:2
net_hinic: Get public resource capability:
net_hinic: host_id: 0x0, ep_id: 0x0, intr_type: 0x0, max_cos_id: 0x7, er_id: 0x0, port_id: 0x0
net_hinic: host_total_function: 0xf2, host_oq_id_mask_val: 0x8, max_vf: 0x78
net_hinic: pf_num: 0x2, pf_id_start: 0x0, vf_num: 0xf0, vf_id_start: 0x10
net_hinic: Get share resource capability:
net_hinic: host_pctxs: 0x0, host_cctxs: 0x0, host_scqs: 0x0, host_srqs: 0x0, host_mpts: 0x0
net_hinic: Get l2nic resource capability:
net_hinic: max_sqs: 0x10, max_rqs: 0x10, vf_max_sqs: 0x4, vf_max_rqs: 0x4
net_hinic: Initialize 0000:05:00.0 in primary successfully
EAL: PCI device 0000:06:00.0 on NUMA socket 0
EAL:   probe driver: 19e5:200 net_hinic
EAL: PCI device 0000:7d:00.0 on NUMA socket 0
EAL:   probe driver: 19e5:a222 net_hns3
EAL: PCI device 0000:7d:00.1 on NUMA socket 0
EAL:   probe driver: 19e5:a221 net_hns3
EAL: PCI device 0000:7d:00.2 on NUMA socket 0
EAL:   probe driver: 19e5:a222 net_hns3
EAL: PCI device 0000:7d:00.3 on NUMA socket 0
EAL:   probe driver: 19e5:a221 net_hns3
mbuf_size: 1920
elt_size: 1792, header_size: 128, trailer_size: 0, total_size: 1920
RTE_PKTMBUF_HEADROOM: 128
sizeof(mbuf): 128
m: 0x13f919c00
m->refcnt: 1
m->buf_addr: 0x13f919c90
m->data_off: 128
m->buf_len: 1646
m->pkt_len: 0
m->data_len: 0
m->nb_segs: 1
m->next: (nil)
m->buf_addr+m->data_off: 0x13f919d10
rte_pktmbuf_mtod(m): 0x13f919d10
rte_pktmbuf_data_len(m): 0
rte_pktmbuf_pkt_len(m): 0
rte_pktmbuf_headroom(m): 128
rte_pktmbuf_tailroom(m): 1518
rte_pktmbuf_data_room_size(mpool): 1646
rte_pktmbuf_priv_size(mpool): 16

RTE_PKTMBUF_HEADROOM: 128
sizeof(mbuf): 128
m: 0x13f919c00
m->refcnt: 1
m->buf_addr: 0x13f919c90
m->data_off: 128
m->buf_len: 1646
m->pkt_len: 1000
m->data_len: 1000
m->nb_segs: 1
m->next: (nil)
m->buf_addr+m->data_off: 0x13f919d10
rte_pktmbuf_mtod(m): 0x13f919d10
rte_pktmbuf_data_len(m): 1000
rte_pktmbuf_pkt_len(m): 1000
rte_pktmbuf_headroom(m): 128
rte_pktmbuf_tailroom(m): 518
rte_pktmbuf_data_room_size(mpool): 1646
rte_pktmbuf_priv_size(mpool): 16

mempool count before free: 1022
before free m->refcnt: 1
after free m->refcnt: 1
mempool count after free: 1023
=========================== mbuf double free ======================== 
after free m->refcnt: 1
mempool count after free: 1023