Found by code inspection. There are two places where the parameter
passed to page_mapcount_is_type() is (page->_mapcount), which is
incorrect since it should be one more than the value, as explained in
the comments to page_mapcount_is_type(): (a) page_has_type() in
page-flags.h (b) __dump_folio() in mm/debug.c

PATCH[1] fixes the parameter for (a)
PATCH[2] fixes the parameter for (b)

Note that the issue doesn't cause any visible impacts due to the
safety gap introduced by PGTY_mapcount_underflow limit. So the
tag 'Cc: stable@vger.kernel.org' isn't needed.

Changelog
=========
v2:
  * Improved commit log                                (Vlastimi/David)
  * Use page_type_has_type() in page_has_type()        (David)

Gavin Shan (2):
  mm: Fix parameter passed to page_mapcount_is_type()
  mm/debug: Fix parameter passed to page_mapcount_is_type()

 include/linux/page-flags.h | 2 +-
 mm/debug.c                 | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

-- 
2.48.1