[PATCH] Fix a race between __page_cache_release() and shrink_cache()

__page_cache_release() needs to recheck the page count inside the LRU
lock, because shrink_cache() may have found the page on the LRU and
incremented its refcount again.

Which is carefully documented over __pagevec_release().  Duh.

mm/swap.c

@@ -81,14 +81,17 @@ void __page_cache_release(struct page *page)
 		unsigned long flags;
 
 		spin_lock_irqsave(&_pagemap_lru_lock, flags);
-		if (!TestClearPageLRU(page))
-			BUG();
+		if (TestClearPageLRU(page)) {
 			if (PageActive(page))
 				del_page_from_active_list(page);
 			else
 				del_page_from_inactive_list(page);
+		}
+		if (page_count(page) != 0)
+			page = NULL;
 		spin_unlock_irqrestore(&_pagemap_lru_lock, flags);
 	}
+	if (page)
 		__free_pages_ok(page, 0);
 }