[Bug 137145] [mbuf] Reference count computing isn't correct when more than one threads call function m_copypacket

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=137145

--- Comment #10 from Andriy Gapon <[email protected]> ---
(In reply to Gleb Smirnoff from comment #9)
You are right when the scenario is going from one owner to more.
But there is a scenario of multiple owners, some dropping their reference and
some just getting it.

For example, let's start with refcnt of 2 and three threads: T1, T2, T3.
T1 and T2 are getting a new reference while T3 is dropping its reference.
There is also another owner, Tx, that just keeps its reference.

1. T1 reads refcnt, sees 2;
2. T3 decrements refcnt to 1
3. T2 reads refctnt see 1;
4. T2 proceeds to non-atomic *refcnt += 1 and reads refcnt as 1 again;
5. T1 proceeds to atomic_add_int and increments refcnt to 2;
6. T2 sets refcnt to 2 as well (based on step 4);

In the end, we have 3 owners (T1, T2, Tx) but the refcnt is 2.

-- 
You are receiving this mail because:
You are the assignee for the bug.