On Mon, 30 Jun 2025 17:41:02 +0800 Jiawen Wu wrote:
wx_dma_sync_frag() incorrectly attempted to return the page to page_pool, which is already handled via buffer reuse or wx_build_skb() paths.
The conditions is:
if (unlikely(WX_CB(skb)->page_released))
And only wx_put_rx_buffer() sets that to true. And it sets page to NULL, so I don't understand how this is supposed to work.
Please improve the commit message, if not the code..
Under high MTU and high throughput, this causes list corruption inside page_pool due to double free.
[ 876.949950] Call Trace: [ 876.949951] <IRQ> [ 876.949952] __rmqueue_pcplist+0x53/0x2c0 [ 876.949955] alloc_pages_bulk_noprof+0x2e0/0
This is just the stack trace you're missing the earlier lines which tell us what problem happened and where.