On 2023/4/26 1:15, Jesper Dangaard Brouer wrote: > @@ -609,6 +609,8 @@ void page_pool_put_defragged_page(struct page_pool *pool, struct page *page, > recycle_stat_inc(pool, ring_full); > page_pool_return_page(pool, page); > } > + if (pool->p.flags & PP_FLAG_SHUTDOWN) > + page_pool_shutdown_attempt(pool); It seems we have allowed page_pool_shutdown_attempt() to be called concurrently here, isn't there a time window between atomic_inc_return_relaxed() and page_pool_inflight() for pool->pages_state_release_cnt, which may cause double calling of page_pool_free()?
