Description of problem: If add_to_page_cache_lru() fails, the page will not be locked. But splice jumps to an error path that does a page release and unlock, causing a BUG() in unlock_page().
Proposed upstream patch: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=6a860c979b35469e4d77da781a96bdb2ca05ae64 Reference: http://lkml.org/lkml/2007/7/20/168
Created attachment 316823 [details] Upstream patch for this issue
Reproducer: https://bugzilla.redhat.com/show_bug.cgi?id=461082#c3
This was addressed via: Red Hat Enterprise Linux version 5 (RHSA-2008:0957)