Hi,

Sorry for the delay, I had to focus on other issues.

On Mon, Feb 07, 2022 at 10:54:40AM +0800, Yunsheng Lin wrote:

When there are more than two steps for the freeing side, the only case I know
about the skb cloning and expanding case, which is fixed by the below commit:
2cc3aeb5eccc (skbuff: Fix a potential race while recycling page_pool packets)

Maybe there are other case we missed?

Yes it's something similar, I found the problem in skb_try_coalesce().
I sent a possible fix, we can continue the discussion there:

https://lore.kernel.org/netdev/20220324172913.26293-1-jean-philippe@linaro.org/ (local)

Thanks,
Jean