On Thu, Nov 05, 2020 at 12:56:43PM +0100, Vlastimil Babka wrote:
+++ b/mm/page_alloc.c @@ -5139,6 +5139,10 @@ void *page_frag_alloc(struct page_frag_cache *nc, if (!page_ref_sub_and_test(page, nc->pagecnt_bias)) goto refill;
if (nc->pfmemalloc) {free_the_page(page, compound_order(page));goto refill;Theoretically the refill can fail and we return NULL while leaving nc->va pointing to a freed page, so I think you should set nc->va to NULL.
Geez, can't the same thing already happen after we sub the nc->pagecnt_bias from page ref, and last users of the page fragments then return them and dec the ref to zero and the page gets freed?
I don't think you read __page_frag_cache_refill() closely enough ...
if (unlikely(!page)) page = alloc_pages_node(NUMA_NO_NODE, gfp, 0);
nc->va = page ? page_address(page) : NULL;