Re: [PATCH net v2] page_pool: keep frag_offset aligned for odd-sized requests

[Bruno Xavier]

On Fri, Aug 28, 2026 at 08:08:22AM +0200, Florian Schauer wrote:
> Round the fragment size up to at least the alignment struct skb_shared_info
> requires, so fragments are always suitably aligned for the objects callers
> build on them.

I sent a caller-side fix for the same defect a day after your v1, without
having seen it:

  net: skbuff: keep the page_pool fragment offset aligned in skb_pp_cow_data()
  https://lore.kernel.org/netdev/20260827122926.31123-1-bfxavier@xxxxxxxxx/

Fabricio connected the threads. xdp_copy_frags_from_zc() at
net/core/xdp.c:700 passes a raw length to the same per-cpu pool, so the
caller-side fix is not enough. Yours is the right one and I have asked for
mine to be dropped.

skb_pp_cow_data() is also called from veth, drivers/net/veth.c:762, so the
fragment loop runs outside generic XDP mode as well. Good to flag that in
the changelog.

The skbs that actually panic are small and linear, not the large packets
that leave frag_offset odd. skb->end was 114 to 178 on my traces against
384 to 955 in ordinary traffic, because the tail fragment of a page is the
one that gets an arbitrary size, page_pool_alloc_netmem() setting
*size = max_size - *offset. Your patch aligns that remainder too, and it
is the case that actually reaches cache-line offset 61 to 63.

Another configuration for the record. ThinkPad T14 Gen 6, Fedora 44,
7.1.9-200.fc44, netbird attaching a generic XDP program to lo and holding
a raw IPv4 socket. Four panics, all skb_clone+0x159, split-lock detection
in the sld_warn state that still dies on kernel split locks. Tracing
napi_build_skb() on the same box puts the misaligned heads on
skb_pp_cow_data() <- netif_receive_generic_xdp <- do_xdp_generic, and the
clones that hit them on raw_v4_input().

Building your v2 here now, Tested-by to follow.

Thanks,
Bruno