--- x/mm/mmu_gather.c
+++ y/mm/mmu_gather.c
@@ -26,7 +26,11 @@ static bool tlb_next_batch(struct mmu_ga
 	batch = tlb->active;
 	if (batch->next) {
 		tlb->active = batch->next;
-		return true;
+		batch = tlb->active;
+		if (batch->nr < batch->max)
+			return true;
+		else
+			return false;
 	}
 
 	if (tlb->batch_count == MAX_GATHER_BATCH_COUNT)
--- x/fs/splice.c
+++ y/fs/splice.c
@@ -91,7 +91,6 @@ out_unlock:
 static void page_cache_pipe_buf_release(struct pipe_inode_info *pipe,
 					struct pipe_buffer *buf)
 {
-	put_page(buf->page);
 	buf->flags &= ~PIPE_BUF_FLAG_LRU;
 }
 
--- x/block/bio.c
+++ y/block/bio.c
@@ -1208,11 +1208,8 @@ static int bio_iov_add_page(struct bio *
 
 	if (!__bio_try_merge_page(bio, page, len, offset, &same_page)) {
 		__bio_add_page(bio, page, len, offset);
-		return 0;
 	}
 
-	if (same_page)
-		bio_release_page(bio, page);
 	return 0;
 }
 
@@ -1225,8 +1222,6 @@ static int bio_iov_add_zone_append_page(
 	if (bio_add_hw_page(q, bio, page, len, offset,
 			queue_max_zone_append_sectors(q), &same_page) != len)
 		return -EINVAL;
-	if (same_page)
-		bio_release_page(bio, page);
 	return 0;
 }