Hi Felix,I don't see how the approch taken in my patch would blow up. From what I can tell, it should be fairly close to how refcount is handled in page_frag_alloc. The main improvement it adds is to prevent it from blowing up if pool-allocated fragments get shared across multiple skbs with corresponding get_page and page_pool_return_skb_page calls.
++cc Alexander and Yunsheng.
Thanks for the report
On Tue, 24 Jan 2023 at 14:43, Felix Fietkau <nbd@xxxxxxxx> wrote:
While testing fragmented page_pool allocation in the mt76 driver, I was able
to reliably trigger page refcount underflow issues, which did not occur with
full-page page_pool allocation.
It appears to me, that handling refcounting in two separate counters
(page->pp_frag_count and page refcount) is racy when page refcount gets
incremented by code dealing with skb fragments directly, and
page_pool_return_skb_page is called multiple times for the same fragment.
Dropping page->pp_frag_count and relying entirely on the page refcount makes
these underflow issues and crashes go away.
This has been discussed here [1]. TL;DR changing this to page
refcount might blow up in other colorful ways. Can we look closer and
figure out why the underflow happens?