Found by code inspection. There are two places where the parameter passed to page_mapcount_is_type() is (page->_mapcount), which is incorrect since it should be one more than the value, as explained in the comments to page_mapcount_is_type(): (a) page_has_type() in page-flags.h (b) __dump_folio() in mm/debug.c PATCH[1] fixes the parameter for (a) PATCH[2] fixes the parameter for (b) Note that the issue doesn't cause any visible impacts due to the safety gap introduced by PGTY_mapcount_underflow limit. So the tag 'Cc: stable@xxxxxxxxxxxxxxx' isn't needed. Changelog ========= v2: * Improved commit log (Vlastimi/David) * Use page_type_has_type() in page_has_type() (David) Gavin Shan (2): mm: Fix parameter passed to page_mapcount_is_type() mm/debug: Fix parameter passed to page_mapcount_is_type() include/linux/page-flags.h | 2 +- mm/debug.c | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) -- 2.48.1
