Description of problem:
If add_to_page_cache_lru() fails, the page will not be locked. But splice jumps to an error path that does a page release and unlock, causing a BUG() in unlock_page().
Proposed upstream patch:
Created attachment 316823 [details]
Upstream patch for this issue
This was addressed via:
Red Hat Enterprise Linux version 5 (RHSA-2008:0957)