2 files changed, 12 insertions, 3 deletions

diff --git a/fs/pipe.c b/fs/pipe.c
index 7fefb10db8d9..5a369273c51b 100644
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -127,8 +127,15 @@ static void anon_pipe_buf_unmap(struct pipe_inode_info *pipe,
 static int anon_pipe_buf_steal(struct pipe_inode_info *pipe,
                                struct pipe_buffer *buf)
 {
-        buf->flags |= PIPE_BUF_FLAG_STOLEN;
-        return 0;
+        struct page *page = buf->page;
+
+        if (page_count(page) == 1) {
+                buf->flags |= PIPE_BUF_FLAG_STOLEN;
+                lock_page(page);
+                return 0;
+        }
+
+        return 1;
 }
 
 static void anon_pipe_buf_get(struct pipe_inode_info *info,
diff --git a/fs/splice.c b/fs/splice.c
index a46ddd28561e..9df28d30efa0 100644
--- a/fs/splice.c
+++ b/fs/splice.c
@@ -599,8 +599,10 @@ static int pipe_to_file(struct pipe_inode_info *info, struct pipe_buffer *buf,
                         goto find_page;
 
                 page = buf->page;
-                if (add_to_page_cache(page, mapping, index, gfp_mask))
+                if (add_to_page_cache(page, mapping, index, gfp_mask)) {
+                        unlock_page(page);
                         goto find_page;
+                }
 
                 if (!(buf->flags & PIPE_BUF_FLAG_LRU))
                         lru_cache_add(page);