--- x/mm/mmu_gather.c
+++ y/mm/mmu_gather.c
@@ -26,7 +26,11 @@ static bool tlb_next_batch(struct mmu_ga
 	batch = tlb->active;
 	if (batch->next) {
 		tlb->active = batch->next;
-		return true;
+		batch = tlb->active;
+		if (batch->nr < batch->max)
+			return true;
+		else
+			return false;
 	}
 
 	if (tlb->batch_count == MAX_GATHER_BATCH_COUNT)
--- x/fs/splice.c
+++ y/fs/splice.c
@@ -91,7 +91,6 @@ out_unlock:
 static void page_cache_pipe_buf_release(struct pipe_inode_info *pipe,
 					struct pipe_buffer *buf)
 {
-	put_page(buf->page);
 	buf->flags &= ~PIPE_BUF_FLAG_LRU;
 }