I created a small ad-hoc kernel module to try the page frag allocator.

First of all: "frag" is a fragment of a page (on RHEL9/x86_64 we use
pages order 3 (32768 bytes size)
my test module will try to allocate and free 10 fragments of 4096
bytes each, this means we will need 2 pages.

struct page_frag_cache  pf_cache;
static void *ptrs[10];

static int __init fragtest_init(void)
{
        int i;
        printk(KERN_INFO "page_frag test start\n");

        printk("---------- ALLOC --------------\n");
        for (i = 0; i < 10; ++i)
                ptrs[i] = dbgpage_frag_alloc(&pf_cache, 4096, GFP_KERNEL);

        printk("---------- FREE ---------------\n");

        for (i = 0; i < 10; ++i)
                dbgpage_frag_free(ptrs[i]);

        return 0;
}

dbgpage_frag_alloc() and dbgpage_frag_free() are exact copies of page_frag_alloc()
and page_frag_free() but with a few debug printk()s

Let's see the dmesg:

[ 3004.858166] page_frag test start
[ 3004.860155] ---------- ALLOC --------------
[ 3004.862329] page 00000000f2b75b49 refcnt 32769 dbgpage_frag_alloc_align() pagecnt_bias = 32768 nc->offset = 28672
[ 3004.864949] page 00000000f2b75b49 refcnt 32769 dbgpage_frag_alloc_align() pagecnt_bias = 32767 nc->offset = 24576
[ 3004.867566] page 00000000f2b75b49 refcnt 32769 dbgpage_frag_alloc_align() pagecnt_bias = 32766 nc->offset = 20480
[ 3004.870166] page 00000000f2b75b49 refcnt 32769 dbgpage_frag_alloc_align() pagecnt_bias = 32765 nc->offset = 16384
[ 3004.872730] page 00000000f2b75b49 refcnt 32769 dbgpage_frag_alloc_align() pagecnt_bias = 32764 nc->offset = 12288
[ 3004.874850] page 00000000f2b75b49 refcnt 32769 dbgpage_frag_alloc_align() pagecnt_bias = 32763 nc->offset = 8192
[ 3004.876775] page 00000000f2b75b49 refcnt 32769 dbgpage_frag_alloc_align() pagecnt_bias = 32762 nc->offset = 4096
[ 3004.878872] page 00000000f2b75b49 refcnt 32769 dbgpage_frag_alloc_align() pagecnt_bias = 32761 nc->offset = 0

Note: we have allocated 8 fragments and the space has been exhausted,
the page refcount gets updated  (refcnt = refcnt - pagecnt_bias == 8 fragments)
goto refill will allocate a new page:

[ 3004.880804] page 00000000f2b75b49 refcnt 8
dbgpage_frag_alloc_align(), goto refill

now we allocate the remaining 2 fragments in the new page:

[ 3004.882271] page 0000000038802bd1 refcnt 32769 dbgpage_frag_alloc_align() pagecnt_bias = 32768 nc->offset = 28672
[ 3004.884327] page 0000000038802bd1 refcnt 32769 dbgpage_frag_alloc_align() pagecnt_bias = 32767 nc->offset = 24576
[ 3004.886352] ---------- FREE ---------------
[ 3004.887187] page 00000000f2b75b49 refcnt 7 dbgpage_frag_free() page NOT freed
[ 3004.888597] page 00000000f2b75b49 refcnt 6 dbgpage_frag_free() page NOT freed
[ 3004.890014] page 00000000f2b75b49 refcnt 5 dbgpage_frag_free() page NOT freed
[ 3004.891423] page 00000000f2b75b49 refcnt 4 dbgpage_frag_free() page NOT freed
[ 3004.892844] page 00000000f2b75b49 refcnt 3 dbgpage_frag_free() page NOT freed
[ 3004.894259] page 00000000f2b75b49 refcnt 2 dbgpage_frag_free() page NOT freed
[ 3004.895678] page 00000000f2b75b49 refcnt 1 dbgpage_frag_free() page NOT freed
[ 3004.897097] page 00000000f2b75b49 dbgpage_frag_free() page freed
Ok, we freed the first 8 fragments, refcnt reaches 0, the page gets
freed and we can proceed with the 2 remaining frags

[ 3004.898294] page 0000000038802bd1 refcnt 32768 dbgpage_frag_free() page NOT freed
[ 3004.899775] page 0000000038802bd1 refcnt 32767 dbgpage_frag_free() page NOT freed
Hey! The refcount of the second page is not synced! It has never been updated!
We free the 2 fragments but the page remains allocated --> memory leak


So in conclusion it's wrong to assume that page_frag_alloc() followed
by page_frag_free()s will free all the used memory.
We can probably use the __page_frag_cache_drain() function to force
the release of the cachepage.