On Wed, 28 Jun 2023 20:11:50 +0800 Liang Chen wrote:

+static inline void page_pool_page_ref(struct page *page)
+{
+	struct page *head_page = compound_head(page);
+
+	if (page_pool_is_pp_page(head_page) &&
+			page_pool_is_pp_page_frag(head_page))
+		atomic_long_inc(&head_page->pp_frag_count);
+	else
+		get_page(head_page);

AFAICT this is not correct, you cannot take an extra *pp* reference 
on a pp page, unless it is a frag. If the @to skb is a pp skb (and it
must be, if we get here) we will have two skbs with pp_recycle = 1.
Which means if they both get freed at the same time they will both
try to return / release the page.

I haven't looked at Yunsheng's v5 yet, but that's why I was asking 
to rename the pp_frag_count to pp_ref_count. pp_frag_count is a true
refcount (rather than skb->pp_recycle acting as a poor man's single
shot refcount), so in case of frag'd pages / after Yunsheng's work
we will be able to take new refs.

Long story short please wait until Yunsheng's changes are finalized.