On Tue, Mar 14, 2023 at 3:08 PM David Howells <dhowells@xxxxxxxxxx> wrote: > \> +static size_t splice_zeropage_into_pipe(... > ... > + *buf = (struct pipe_buffer) { > + .ops = &zero_pipe_buf_ops, > + .page = ZERO_PAGE(0), > + .offset = offset, > + .len = size, > + }; > + get_page(buf->page); That + get_page(buf->page); is still there, and now it's doubly wrong because it's never dropped and will eventually overflow that count that shouldn't even be there. Linus